Frequently Asked Questions

This section is designed to allow stakeholders easy access to all Frequently Asked Questions about student privacy.  All of the questions contained on this page have been tagged for easy browsing by either topic or audience.  This section is regularly updated as new questions are received.  You may also search the FAQs by using the search box on the top right of the page.

Must an educational agency or institution have a written agreement to disclose personally identifiable information (PII) from education records without consent for the purposes of conducting a study or an audit or evaluation of an education program?

Yes. Both the studies exception and the audit or evaluation exception specifically require that the parties execute a written agreement when disclosing PII from education records without consent.

Must postsecondary institutions provide a parent with access to an eligible student’s education records?

While the rights under FERPA transfer from the parents to the student when the student turns 18 or enrolls in a postsecondary institution at any age, FERPA provides ways in which an institution can share education records on the student with his or her parents.  Schools may disclose any and all information to parents, without the consent of the eligible student, if the student is a dependent for tax purposes under the IRS rules.  FERPA also permits a school to disclose information from an eligible student’s education records to parents if a health or safety emergency involves their son or daughter.  Another provision in FERPA permits a college or university to let parents of students under the age of 21 know when the student has violated any law or policy concerning the use of possession of alcohol or a controlled substance.  School officials may also share information with a parent about an eligible student that is based on that official’s personal knowledge or observation and that is not based on information contained in an education record.

To which educational agencies or institutions does FERPA apply?

FERPA applies to educational agencies or institutions that receive funds from programs administered by the U.S. Department of Education.  By “educational agencies or institutions” we mean public schools, school districts (or “local educational agencies” (LEAs)), and postsecondary institutions, such as colleges and universities.  Private and parochial schools at the elementary and secondary level generally do not receive such funding and are, therefore, not subject to FERPA. 

Under FERPA, may an educational agency or institution disclose education records to any of its employees without consent?

No.  FERPA permits an educational agency or institution to disclose, without consent, personally identifiable information from students’ education records only to school officials within the educational agency or institution that the educational agency or institution has determined to have legitimate educational interests in the information. 34 CFR § 99.31(a)(1).  Generally, a school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.

What constitutes de-identified records and information?

Records and information are de-identified once all personally identifiable information has been removed, including, but not limited to, any information that, alone or in combination is linkable to a specific student that a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.

What does “articulable and significant threat” mean?

The phrase “articulable and significant threat” means that a school official is able to explain, based on all the information available at the time, what the significant threat is under § 99.36 when he or she makes and records the disclosure.  For instance, if a school official believes that a student poses a significant threat, such as a threat of substantial bodily harm to any person, including to the student, then, under FERPA, the school official may disclose personally identifiable information (PII) from the student’s education records without consent to any person whose knowledge of the information will assist in protecting a person from that threat. This is a flexible standard under which school administrators may bring appropriate resources to bear on the situation. If, based on the information available at the time of the determination, there is a rational basis for the educational agency’s or institution’s decisions about the nature of the emergency and the appropriate parties to whom the information should be disclosed, the Department will not substitute its judgment for that of the school in evaluating the circumstances and making its determination. 

What federal law requires that states provide assurances to the Secretary of Education that they had procedures in place to facilitate the transfer of student disciplinary information with respect to an LEA’s suspension or expulsion of a student?

Section 4155(b) of the Elementary and Secondary Education Act (ESEA), as amended, 20 U.S.C. § 7165(b), required, in accordance with FERPA, each state receiving funds under the ESEA to provide an assurance to the Secretary that it had “a procedure in place to facilitate the transfer of disciplinary records, with respect to a suspension or expulsion, by local educational agencies to any private or public elementary school or secondary school for any student who is enrolled or seeks, intends, or is instructed to enroll, on a full- or part-time basis, in the school.”  LEAs and schools, therefore, should include a notice in their annual notification of rights under FERPA that they forward education records to other schools that have requested the records and in which the student seeks or intends to enroll (§§ 99.7, 99.31(a)(2), and 99.34(a)(1)(ii)).  Unless the school or LEA includes this notice in their annual notification of FERPA rights or the parent or eligible student initiates the transfer of records, the school or LEA otherwise would be required to make a reasonable effort to notify the parent or eligible student of the disclosure at the last known address of the parent or eligible student.