Frequently Asked Questions

This section is designed to allow stakeholders easy access to all Frequently Asked Questions about student privacy.  All of the questions contained on this page have been tagged for easy browsing by either topic or audience.  This section is regularly updated as new questions are received.  You may also search the FAQs by using the search box on the top right of the page.

Does FERPA permit educational agencies and institutions to disclose PII from education records to CWAs or tribal organizations, without consent, when the student reaches 18 years of age or attends a postsecondary institution but remains in foster care?

Yes.  Once a student reaches 18 years old or attends a postsecondary institution at any age, the student becomes an eligible student and the rights under FERPA transfer to that student.  FERPA governs the disclosure of PII from the education records of an eligible student in the same fashion as it governs the disclosure of PII from the education records of a student under the age of 18.  As a practical matter, most States consider an individual who has reached the age of 18 to be an adult; therefore, the individual would generally not remain in foster care placement.  However, if under State or tribal law an individual is who is 18 or older or is attending a postsecondary institution remains in a foster care placement, then the educational agency or institution may choose to disclose education records to the CWA that is legally responsible for the care and protection of the eligible student without the consent of the eligible student.

Does FERPA permit school officials to release information that they personally observed or of which they have personal knowledge?

FERPA applies to the disclosure of education records and of personally identifiable information (PII) from education records that are maintained by the school.  Therefore, FERPA does not prohibit a school official from releasing information about a student that was obtained through the school official’s personal knowledge or observation, rather than from the student’s education records.  For example, if a teacher overhears a student making threatening remarks to other students, FERPA does not protect that information from disclosure.  Therefore, a school official may disclose what he or she overheard to appropriate authorities, including disclosing the information to local law enforcement officials, school officials, and parents.

Does FERPA permit schools to disclose a student’s education records to the state or local Child Welfare Agency (CWA) or tribal organization?

There are exceptions to consent in FERPA that permit, but do not require, local educational agencies (LEAs) and schools to disclose personally identifiable information (PII) from education records under certain conditions without the written consent of the parent or eligible student.  FERPA permits LEAs and schools to disclose education records of students placed in foster care, without consent of the parent or eligible student, to an agency caseworker or other representative of a state or local child welfare agency (CWA) or tribal organization authorized to access a student’s case plan, when such agency or organization is legally responsible, in accordance with state or tribal law, for the care and protection of the student. 

A “case plan” is defined at 42 U.S.C. 675(1) as a written document that must include a number of specified items that, among other things, must address both the proper care of children in foster care placement.  The plan also addresses the services that are provided to children in foster care placement, their parents, and their foster parents.  The plan also includes, but is not limited to, ensuring the educational stability of children in foster care. 

This exception to FERPA only applies to those children for whom the CWA or tribal organization is legally responsible, in accordance with state or tribal law, for the care and protection of a child in foster care placement.  FERPA would not permit LEAs and schools and to disclose PII from education records to the CWA or tribal organization for children who are not in foster care placement, even if those children  are receiving other services through the CWA or tribal organization (e.g., vocational and skill assessments, training, tutoring, educational services, family services, and community enrichment activities). 

Does FERPA permit schools to disclose any and all education records on a student to another school where the student seeks or intends to enroll?

Yes.  FERPA states a school may disclose education records, without parental consent (§ 99.31(a)(2)), to another school in which a student seeks or intends to enroll, subject to conditions set forth in § 99.34.  This exception to FERPA’s general consent requirement also permits a school to disclose education records when a student is being placed in a juvenile justice facility that is considered a school. 

Does FERPA permit the disclosure of personally identifiable information (PII)I from education records to officials of a state’s juvenile justice system?

FERPA permits schools to non-consensually disclose PII from education records to state and local officials or other authorities if the disclosure is allowed by a state law adopted after November 19, 1974, and if the disclosure concerns the juvenile justice system and its ability to serve, prior to adjudication, the student whose records are disclosed.  See §§ 99.31(a)(5) and 99.38.  The officials and authorities to whom such information is disclosed must certify in writing to the school that the information will not be provided to any other party, except as provided for under state law without written consent.  

Does FERPA permit the sharing of education records with outside law enforcement officials, mental health officials, and other experts in the community who serve on a school’s threat assessment team?

Yes.  Under FERPA, a school or school district may disclose personally identifiable information (PII) from education records without consent to threat assessment team members who are not employees of the school or school district if they qualify as “school officials” with “legitimate educational interests.”

In establishing a threat assessment team, the school must follow the FERPA provisions in § 99.31(a)(1)(i)(B) concerning outsourcing this function if team members will be privy to PII from students’ education records.  While not a requirement of FERPA, one way to ensure that members of the team do not redisclose PII obtained from education records would be to have a written agreement with each of the team members specifying their requirements and responsibilities. 

Schools are reminded that members of the threat assessment team may only use PII from education records for the purposes for which the disclosure was made, i.e., to conduct threat assessments, and must be subject to FERPA’s redisclosure requirements in § 99.33(a).  For example, a representative from the city police who serves on a school’s threat assessment team generally could not give the police department any PII from a student’s education records to which he or she was privy as a member of the team.  However, if the threat assessment team determines that a health or safety emergency exists, then the police officer may disclose, on behalf of the school, PII from a student’s education records to appropriate officials under the health or safety emergency exception under §§ 99.31(a)(10) and 99.36, as discussed below.

Does FERPA require educational agencies and institutions to disclose personally identifiable information (PII) from education records to Child Welfare Agencies (CWAs) or tribal organizations whenever requested?

No. Under 20 U.S.C. § 1232g(b)(1)(L), FERPA permits, but does not require, LEAs and schools to disclose PII from the education records of a student who is in foster care placement to CWAs or tribal organizations.  Further, under FERPA, an LEA or school may choose to disclose all or part of the education records it maintains on a student who is in foster care placement.  We encourage LEAs and schools to disclose the information from education records that a child’s welfare caseworker would need to effectively implement a child’s case plan and to ensure the child’s education needs are met.

How are Military Recruiter requirements under 10 U.S.C. § 503 enforced?

In addition to the potential for loss of funds under ESEA for failure to comply with § 9528 of the ESEA, an LEA that denies a military recruiter access to the requested information on students after July 1, 2002, will be subject to specific interventions under 10 U.S.C. § 503.  

In this regard, the law requires that a senior military officer (e.g., Colonel or Navy Captain) visit the LEA within 120 days.  If the access problem is not resolved with the LEA, the Department of Defense must notify the state’s Governor within 60 days.  Problems still unresolved after one year are reported to Congress, if the Secretary of Defense determines that the LEA denies recruiting access to at least two of the armed forces (Army, Navy, Marine Corps, etc.).  The expectation is that public officials will work with the LEA to resolve the problem.  

Additionally, the Department of Defense has developed a national high school data base to document recruiter access.  Presently, 95 percent of the nation’s 22,000 secondary schools provide a degree of access to military recruiters that is consistent with current law. 

How does a school know when a health or safety emergency exists so that a disclosure may be made under this exception to consent?

An educational agency or institution must make this determination on a case-by-case basis, taking into account the totality of the circumstances pertaining to a threat to the health or safety of a student or others.  If the school determines that there is an articulable and significant threat to the health or safety of a student or other individuals and that a third party needs personally identifiable information (PII) from education records to protect the health or safety of the student or other individuals, it may disclose that information to appropriate parties without consent.