Family Educational Rights and Privacy Act of 1974, as amended (FERPA) 20 USC 1232g 34 CFR Part 99 Summary of FERPA Provisions Relevant to Crisis Situations
Summary Heading link
General Rule: An educational agency or institution may not have a policy or practice of disclosing education records, or personally identifiable information from education records other than directory information, without the prior written consent of a parent or “eligible student” (one who is at least 18 years of age or attends a postsecondary institution). Education records do not include:
- Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the records.
- Records created and maintained by a law enforcement unit for law enforcement purposes.
- Employment records, so long as they are maintained separately from any Education Record.
- Records made or maintained by a physician, psychiatrist, psychologist or other recognized professional or paraprofessional that are used in connection with treatment of the student and are disclosed only to individuals providing the treatment.
- Records that only contain information about a person after that person is no longer a student at the educational institution, such as alumni files.
Exceptions: There are several instances in which “education records” may be disclosed without written consent, however, FERPA does not require that records be disclosed unless the student specifically requests disclosure (to him/herself or a third party). The following is a list of exceptions that may be relevant in crisis situations:
BEFORE AND DURING A CRISIS
| Statutory Language | Cite | Protection | Interpretation |
|---|---|---|---|
| The disclosure is in compliance with a health or safety emergency. | 34 CFR 99.31(a)(10) | Disclosure only to appropriate parties if knowledge of the information is necessary to protect the health or safety of the student or other individuals. Some factors to consider are: (1) the severity of the threat to the health and safety of those involved, (2) the need for the information, (3) the time required to deal with the emergency, and (4) the ability of those to whom a disclosure is made to deal with the emergency. | The parties to whom the disclosure is made do not have to be other university officials. Disclosure is O.K. if it is to protect the student OR other individuals. FERPA’s restrictions apply only to information derived from student education records, not to personal knowledge derived from direct, personal experience with a student. Department of Education, Office of Family Policy Compliance (OFPC): “The Department has consistently interpreted this provision narrowly by limiting its application to a specific situation that presents imminent danger to students or other members of the community, or that requires an immediate need for information in order to avert or diffuse serious threats to the safety or health of a student or other individuals… Typically, law enforcement officials, public health officials, and trained medical personnel are the types of parties to whom information may be disclosed under this FERPA exception....” 3/11/05 Family Policy Compliance Officer (FPCO) Letter to Strayer University. |
| The disclosure is to other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have a legitimate educational interest. | 34 CFR 99.31(a)(1) | Each institution must define for itself who qualifies as a “school official” and what is a “legitimate educational interest” and give annual notice of its definitions to its students. | The DOE has given the following model definitions: School Official—A person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted as its agent to provide a service instead of using University employees or officials (such as an attorney, auditor, or collection agent); a person serving on the Board of Trustees, or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his/her tasks. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibilities for the University. May consider adding the following to the definition of legitimate educational interest: “maintaining the safety and security of the campus.” There need not be an emergency situation for this exception to apply. |
| The disclosure is to a parent of a dependent student. | 34 CFR 99.31(a)(8) | Students must be defined as a dependent under Section 152 of the Internal Revenue Code of 1954 (proof is required). | OFPC: Proof of dependency may include a copy of the parents’ most recent federal income tax form. Or, institution may ask students to pre-identify as a dependent at the time of registration. 10/29/93 FPCO Letter to University of New Mexico. Quote from Discussion with LeRoy Rooker (FPCO): “The “dependent student” exception to FERPA’s general consent rule applies in domestic situations because that provision specifically references the IRS rules. There is no comparable provision for international students. Consent is required unless one of the other exceptions applies.” A recommended practice would be to encourage a student in crisis to inform his/her parents of the situation before making the decision to contact the parents without the student’s consent. Before contacting parents and where possible, a college should determine whether informing the parents may be detrimental to the student (e.g., where a parent is the cause of the crisis). |
| The disclosure does not include “education records” as that term is defined. | 34 CFR 99.3 | A “record” means any information that is recorded in any way, including, but not limited to, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche. | FERPA’s restrictions apply only to information derived from student education records, not to personal knowledge derived from direct, personal experience with a student. However, it is still good practice to limit the disclosure of such information on a need-to-know basis in order to comply with other privacy laws that could apply. |
AFTER A CRISIS
| Statutory Language | Cite | Protection | Interpretation |
|---|---|---|---|
| The disclosure is in connection with a disciplinary proceeding at an institution of post-secondary education. | 34 CFR 99.34(a)(14) | Only if, through the school’s disciplinary proceedings, it is determined that (1) the student is an alleged perpetrator of a crime of violence or non-forcible sex offense; and (2) there has been a finding that the perpetrator violated the institution’s rules or policies. “Crime of violence” includes arson, assault offenses, burglary, criminal homicide, forcible sex offenses, destruction, damage/vandalism of property, kidnapping/abduction, and robbery. | There are no restrictions on disclosure or re-disclosure of the final results of a disciplinary proceeding. 3/10/03 FPCO Letter of Technical Assistance. Disclosure can be made to the public. |
| The disclosure is to the victim of an alleged perpetrator of a crime of violence or non-forcible sex offense. | 34 CFR 99.31(a)(13) | Disclosure may only include the final results of the disciplinary proceedings conducted by the institution with respect to the alleged crime or offense, regardless of whether the institution concluded a violation was committed. | The final determination can be shared with the victim whether or not the alleged perpetrator is found “guilty” of a violation of the University’s discipline code. |
| The disclosure consists of information the University has designated as “directory information”. | 34 CFR 99.37 | Institution must give public notice to students in attendance at the institution of (1) the types of personally identifiable information that the institution has designated as directory information, (2) the student’s right to refuse to let the institution designate any or all of those types of information about the student as directory information (opt-out provision), and (3) the period of time within which a student must notify the institution in writing that he/she does not want any or all of those types of information about the student designated as directory information. | Be careful not to release directory information combined with other non-directory information. For example, if the media seeks the names of student victims of a violent act on campus, the University could not release those names without consent assuming that the institution’s spokesperson derives those names from an education record. The names of students may be directory information, but the fact that they were victims of a crime or violent act is not directory information. However, the University could confirm whether or not a victim is a student if the inquiry is something like, “I understand that John Doe was one of the people hurt during the incident, is John Doe a student at University?” Assuming that John Doe has not opted out of sharing directory information and that the University has designated names as directory information, the University could confirm whether or not John Doe is a student. |
| The disclosure is to officials of another school, school system or institutions of postsecondary education where the student seeks or intends to enroll. | 34 CFR 99.34(a)(2) | Must (1) make a reasonable attempt to notify student at last known address unless disclosure is initiated by the student, or the institution’s annual notification includes a notice that the institution forwards education records to other agencies or institutions that have requested records and in which the student seeks or intends to enroll; (2) give the student, upon request, a copy of the record that was disclosed, (3) give the student, upon request, an opportunity for a hearing under subpart C. | This could be used, for example, to alert another school to the erratic or inappropriate behavior of a current student. Of course, the information shared should be factual and on a need-to-know basis. This can be advantageous to a student in crisis. The next institution may pick up where the previous institution left off in monitoring the student and providing appropriate services to him/her. |
| The disclosure is to comply with a judicial order or lawfully issued subpoena. | 34 CFR 99.31(a)(9) | The institution must first make a reasonable effort to notify the student in advance of compliance except where the disclosure is in compliance with a federal grand jury subpoena or any other subpoena issued for law enforcement purposes and the court has ordered that the existence and contents of the subpoena not be disclosed. | The subpoena or court order must be valid (e.g., from a court having jurisdiction over the institution). FPCO Letter of Finding re: Sufficient Notice to Student of Subpoena: FPCO found that 6-7 days advance notice is sufficient, noting the following: “…we encourage educational agencies and institutions to strive to provide a sound and sensible time period to allow a parent or eligible student to take action to quash a subpoena… Further, while regular mail is a normal means of notification, we also encourage educational agencies and institutions in an effort to notify students before compliance with a subpoena, to consider using certified mail, telephone, or facsimile as appropriate supplemental means of notification.” Be sure that the information you supply is responsive to the subpoena/court order. |
| The disclosure is to a parent of a student regarding a student’s violation of any federal, state, or local law, or of any rule or policy of the institution, governing the use or possession of alcohol or a controlled substance. | 34 CFR 99.31(a)(15) | Only if (a) the institution determines that the student has committed a disciplinary violation with respect to the use or possession, and (2) the student is under the age of 21 at the time of the disclosure to the parent. | Institutions are encouraged to develop a policy about disclosure under these circumstances. |
| The disclosure is to the U.S. Departments of Homeland Security or Immigration and Customs Enforcement for Education Records of international Students attending the University under an F-1, M-1 or J-1 visa. | § 641(c)(2) of the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 (IIRIRA), as amended, (8 U.S.C. § 1372) | FERPA shall not apply to aliens described in subsection (a) of § 641 to the extent that the Attorney General determines necessary to carry out the SEVIS program. | See FPCO Letter to AACRAO re: Sevis and Disclosures to DHS/ICE, August 27, 2004. This letter provides a rather detailed list of information that can be disclosed to DHS/ICE. For instance, for students who fall “out of status” (e.g., are dismissed from the institution for disciplinary reasons), the disclosure of this dismissal to the Department of Homeland Security is not only permitted by FERPA, but required by IIRIRA. Note: Technically, this disclosure is made with the student’s consent. A consent is required when students submit their I-20. It is not a “FERPA” consent, but it is a consent. |
| “…FERPA would not prohibit an educational agency or institution from disclosing records relating to a deceased student.” | 11/22/91 FPCO letter to University of Nevada System | FERPA would also not compel the disclosure of such records. The Educational agency may exercise its own discretion with respect to disclosure of records relating to deceased students. | Common law privacy protections generally die with the person. The same is true for FERPA protections. |
Enforcement & Penalties: Responsibility for administering FERPA has been assigned to the Family Policy Compliance Office within the Department of Education. This office reviews and investigates complaints of a policy or practice that violates FERPA and attempts to bring about compliance through voluntary means. The penalty for noncompliance can be the withdrawal of DOE funds from the institution, but action to terminate funding generally will be taken only if compliance cannot be secured by voluntary means. In the 33 years that FERPA has been in existence, no institution has had their federal funding withdrawn as a result of a violation of FERPA. There is no private right of action for violation of FERPA, though a student may allege a common law violation of his/her privacy rights.
Consent: Keep in mind that a student may consent to the disclosure of certain information. As such, if the disclosure does not fit into one of the exceptions, it’s always a good idea to ask the student to permit the disclosure. A valid consent must contain (1) the identity the person or group of people to whom the disclosure is to be made, (2) a description of the records to be disclosed, and (3) the purpose of the disclosure, and must be both signed and dated by the student.
Re-disclosure: Those individuals who receive information under one or more of the 15 disclosure exceptions set forth in § 99.31 may not generally re-disclose that information to any other party without appropriate written consent of the student. 34 CFR § 99.33.
Prepared by Renee R. McCarthy, Associate University Counsel, University of Illinois, for Governor’s Task Force on Campus Security
Footnote 1. Disclaimer at end of Summary. (back up…)
Disclaimer: The information contained in this document is for general guidance on matters of interest only. The application and impact of laws can vary broadly based on the specific facts involved. Due to the changing nature of laws, rules and regulations, and the inherent hazards of electronic communication, there may be delays, omissions or inaccuracies in information contained in this document. Accordingly, the information in this document is provided with the understanding that the author is not herein engaged in rendering legal or other professional advice and services to the reader. As such, it should not be used as a substitute for consultation with an attorney or other competent advisor.
While every attempt has been made to ensure that the information contained in this document has been obtained from reliable sources, the author is not responsible for any errors or omissions, or for the results obtained from the use of this information. All information in this document is provided “as is”, with no guarantee of completeness, accuracy, reliability, timeliness or of the results obtained from the use of this information, and without warranty of any kind, express or implied.
In no event will the author of this document be liable to you or anyone else for any decision made or action taken in reliance on the information in this document or for any direct, indirect, consequential, incidental, punitive, actual, exemplary, special or similar damages arising directly or indirectly from the reliance on, use of, or failure to use the information in this document, even if advised of the possibility of such damages. Certain links in this document connect to other Web Sites maintained by third parties over whom the author of this document has no control. The author of this document makes no representations as to the accuracy or any other aspect of information contained in other Web Sites.