Skip to main content

Top Navigation


Return to FERPA Page

Prepared by: Nancy S. Footer (Vice Chancellor & General Counsel, University of North Texas System) and Steven J. McDonald (General Counsel, Rhode Island School of Design)
Spring 2006 (Print PDF)

I. Background
Enacted on August 21, 1974, as a seemingly inconsequential floor amendment, the Family Educational Rights & Privacy Act, 20 U.S.C. § 1232g, popularly known as “FERPA” or the “Buckley Amendment”, nevertheless quickly became one of the mainstays of college and university law practice.  Its extensive implementing regulations may be found at 34 C.F.R. Part 99.  Congress passed FERPA in response to a growing public awareness and concern about the public dissemination by schools of information commonly considered private in nature, the withholding of “secret files” on students, and recordkeeping practices in general.  Much like other “records” statutes of that era, it established rights to inspect, to seek amendment of, and, in general, to control dissemination of educational information.

II. To whom does FERPA apply?
FERPA applies to all public and private institutions of higher education that receive funds made available under programs administered by the Department of Education, including federal grant monies, Pell grants, guaranteed student loan programs, and other such funds.  If an institution receives funds under one or more such programs, FERPA applies to the institution as a whole, including each component or department within the institution.  In other words, virtually all institutions of higher education, whether public or private, are subject to FERPA.  Elementary and secondary schools are also subject to FERPA.

III. Definitions
Selected definitions include:

A. Student — any individual who is or has been in attendance at an institution and about whom the institution maintains education records.  This definition does not include applicants to an institution.

B. Parent — Parent of a student, including a natural parent, a guardian, or an individual acting as a parent in the absence of a parent or guardian.

C. Attendance — attendance in person or by correspondence.  This definition also includes that period of time during which a student might be working under a work-study program.  The institution has some discretion to define when, between admission and the first day of classes, a student is first considered “in attendance”.

D. Disclosure — to permit access to or to release personally identifiable information contained in education records by any means, including oral, written, or electronic means.

E. Personally identifiable information — student’s name, parent and family member names, address of student and parent or family members, a personal identifier such as a social security number or student number, or a list of personal characteristics or other information that would make the student’s identity easily traceable.

F. Directory information — information contained in education records that would not generally be considered harmful or an invasion of privacy if released.  Within those parameters, each institution may designate for itself what it considers to be directory information.  Examples of the types of information your institution might designate include: name, local and home address, local and home telephone number, electronic mail address, date and place of birth, major field of study, participation in recognized activities and sports, weight and height of athletes, dates of attendance, degrees, honors, and awards received, the most recent previous educational institution attended, and photographs. 

G. Education records — all records that are directly related to a student and that are maintained by an educational institution, except:

1. Records of instructional, supervisory, and administrative personnel that are kept in the sole possession of the maker of the record and are not revealed to anyone except a substitute.  Examples: grade books and faculty instructional materials.

2. Records that are created by the law enforcement unit of an educational institution (including non-commissioned public safety offices), created at least in part for law enforcement purposes, and maintained by the law enforcement unit.

3. Records relating to an individual who is employed by an educational institution that are maintained in the normal course of business, related solely to the individual as an employee, and not available for any other purpose.  Exception:  records of an individual who is employed by the educational institution as a result of his or her status as a student are education records and are not excepted from coverage under this section.  Examples might include employment records of graduate assistants and work-study students.

4. Records that contain information about an individual after he or she is no longer a student at the institution.

5. Records that are made or maintained by a physician, psychologist, psychiatrist, or other recognized professional or paraprofessional acting in such capacity, made or used only in connection with treatment of the student, and disclosed only to persons providing the treatment.  Treatment does not include remedial educational activities.

IV. Disclosure of records
A. Permissible disclosures of education records generally take one of three forms — they are disclosed to the student; they are disclosed to another person or entity with the express written consent of the student; or they are disclosed to another person or entity without the prior consent of the student but only under the circumstances described below.  The student’s right of inspection and review of his or her own records is covered in Section V.

B. A college or university student’s education records may be disclosed without the student’s prior consent if the request fits within one of the following categories:

1. The disclosure is of directory information (see definition in III.F.), unless the student has requested in writing that all or any portion of those items designated as directory information not be disclosed.

2. The disclosure is to a “school official” who has a “legitimate educational interest” (see definitions in IV.D.) in the information.

3. The disclosure is to another educational institution where the student seeks or intends to enroll, if the home institution has given its students notice that it will comply with such requests.

4. The disclosure is to authorized representatives of the Comptroller General or Attorney General of the U.S., the U.S. Secretary of Education, or state or local educational authorities in connection with an audit or evaluation of federal or state supported education programs, or for enforcement of or compliance with federal legal requirements that relate to those programs.  In the absence of consent or a specific federal law to the contrary, data collected under this provision of FERPA must be protected so that individuals are not personally identifiable except to the individuals set forth in this provision and, furthermore, the data must be destroyed when no longer needed.

5. The disclosure is in connection with financial aid that the student has applied for or received and is for the purpose of determining eligibility, amount, or conditions of aid, or to enforce the terms and conditions of the aid.

6. The disclosure is to organizations conducting studies for or on behalf of educational agencies to develop, validate, or administer predictive tests, administer student aid programs, or improve instruction.  As a condition of disclosure, the study must be conducted in a way that does not permit personal identification of students or parents by individuals outside of the organization and the information disclosed must be destroyed when no longer needed for purposes of the study.

7. The disclosure is to accrediting agencies to carry out accrediting functions.

8. The disclosure is to the parent or legal guardian of a dependent student, as defined by the Internal Revenue Code.

9. The information is disclosed to comply with a lawfully issued subpoena or court order.  The institution must make a reasonable effort to inform the student in advance of compliance unless the subpoena or court order is a federal grand jury or other law enforcement subpoena or order and expressly states that its existence not be disclosed.  Counsel acting on behalf of a college or university may also disclose relevant education records to a court without a subpoena or court order when the college or university has initiated legal action against a parent or student.  By the same token, a college or university may disclose a student’s relevant education records without consent in order to defend itself against a lawsuit by that student or the student’s parent(s).   As a side note, college and university counsel should be aware that the USA PATRIOT Act amended FERPA to allow the Attorney General or his/her designee to apply to a court for an ex parte order allowing the AG to collect education records relevant to an investigation of terrorism.

10. The disclosure is made to appropriate parties in the event of an emergency, if knowledge of the information is necessary to protect the health or safety of the student or other individuals.

11. The disclosure is of the final results of disciplinary proceedings against a student who is an alleged perpetrator of a violent crime (18 U.S.C. § 16) or non-forcible sex offense, if the institution finds that the student committed a violation of the institution’s rules or policies.  The institution may release only the name of the accused student, violation committed, and sanction imposed.  Personally identifiable information of any other student involved, such as the victim or a witness, may be disclosed only with the prior written consent of that student.

12. The disclosure is to a victim of an alleged crime of violence or a non-forcible sex offense.  The institution may release only the name of the accused student, the finding on the violation alleged, and any sanctions imposed, but, in this case, it may do so regardless of whether the violation was proven under the institution’s rules or policies.

13. The disclosure is of a violation of federal, state, or local law or of any rule or policy of the institution governing the use or possession of alcohol or controlled substances and is made to the student’s parent or legal guardian, if the student is under the age of 21 at the time of disclosure and the institution has determined that the student committed a disciplinary violation.

If the information requested does not fit into one of the categories described above, you must obtain the student’s consent prior to disclosing the records.  The consent must be in writing, signed by the student, and dated, and must specify the records to be released, the purpose of the disclosure, and the party or class of parties to whom the disclosure may be made. Electronic signatures are allowable if the format “identifies and authenticates a particular person as the source of the electronic consent” and “indicates such person’s approval of the information contained in the electronic consent”.

FERPA generally imposes limitations on re-disclosure by the recipients of education records.  Exceptions include disclosures of directory information, disclosures in response to a court order or subpoena, and disclosures to a student or parent.  In most other circumstances, you must inform the party receiving the information that it cannot re-disclose the information without the consent of the student and that the information may be used only for the purpose for which the disclosure was made.

D. Each institution must include in its annual notice of FERPA rights the institution’s criteria for determining who constitutes a school official and what constitutes a legitimate educational interest.  A school official may be defined as faculty, administrative and classified staff, administrators, trustees, other students serving on official institutional committees or assisting an institutional official in performing his or her duties, and third parties with whom the institution has contracted, such as attorneys, auditors, or collection agents.  A school official may be said to have a legitimate educational interest in a student’s education records if the official needs the information to fulfill his or her professional responsibilities.

E. FERPA permits, but does not require, an institution to disclose personally identifiable information in any of the situations listed above.

F. An educational institution generally must maintain a record of each request and release of personally identifiable information from a student’s education records.  Exceptions include disclosures to a school official, a parent or student, a person with written consent, or a person requesting directory information.

G. A student’s privacy rights under FERPA terminate upon death.

V. Rights of inspection and review; amendment
A. FERPA also gives college and university students the right to inspect and review their own education records.  If the requested records contain information on more than one student, the requesting student may have access only to those portions pertaining to him- or herself.  The institution must provide access to the records no later than 45 days after requested and  must respond to reasonable requests for explanations and interpretations of the records.  You may not destroy records if there is an outstanding request for inspection. FERPA does not require you to provide copies of records to the student, unless “circumstances effectively prevent” the student from exercising the right to inspect otherwise, nor does it require that you make the following records available for review:

1. Financial records of the student’s parents; and

2. Confidential letters and statements of recommendation, if the student has waived the right to review and inspect these documents and the letters are related to the student’s admission, application for employment, or receipt of an honor or honorary recognition.  The waiver is valid only if it is not a condition of admission to or receipt of a benefit or service from the institution and it is in writing and signed by the student.  If the student provides such a waiver, the student must be given, upon request, the names of the persons providing the recommendations, and the institution may not use the letters for any purpose other than that for which they were originally intended.  The student may revoke the waiver in writing; however, revocation affects only those documents received after the date of the revocation.  In other words, a student may not revoke the waiver in order to see documents already received.

B.  If a student believes that his or her education records contain inaccurate or misleading information or information that violates the student’s right to privacy, the student may request that the institution amend the records.  If the institution does not agree to do so, it must inform the student in writing and advise the student of the right to a hearing.  The hearing must meet the following minimum requirements:

1. It must be held within a reasonable time after the request;

2. The student must be provided reasonable notice of the date, time, and place;

3. The individual conducting the hearing must not have a direct interest in the outcome;

4. The student must have a “full and fair opportunity” to present his or her case and may be assisted or represented by an attorney; and,

5. The decision must be in writing, rendered within a reasonable time after the hearing, and based solely on the evidence presented at the hearing, and it must include a summary of the evidence and the reasons for the decision.

If, as a result of the hearing, the institution agrees with the student, it must amend the record and notify the student in writing.  If the institution does not agree, it must advise the student that he or she may place a written statement in the file commenting on the contested information and/or stating the nature of the disagreement.  If the student chooses this option, the statement must be maintained with the contested information and disclosed in conjunction with any subsequent release of the contested information.

C. The courts have ruled that this portion of FERPA is intended to deal with “scrivener’s errors”, not to provide a means by which a student may challenge substantive decisions, such as grades, or obtain information on how a particular grade was assigned.   “At most, a student is only entitled to know whether or not the assigned grade was recorded accurately in the student’s record.”  Tarka v. Cunningham, 741 F. Supp. 1281 (W.D. Tex. 1990).

VI. Annual notification of rights
FERPA requires that each institution annually notify its students of their rights under the act.  I suggest that you start with the United States Department of Education model notice of rights, which can be found at You must also provide your list of directory information for all students, which may be included in your notice of rights.  See for the Department of Education’s suggested statement on directory information.

VII. Enforcement
A. The Family Policy Compliance Office of the Department of Education is authorized to investigate and review potential violations and to provide technical assistance regarding compliance issues.

B. In the event that the office determines that a complaint is meritorious, the office will recommend steps necessary to insure compliance with the act and provide a reasonable time for an institution to come into compliance.

If an institution does not come into compliance, the department is authorized to terminate all or any portion of the institution’s federal funds.

D. In Gonzaga University v. Doe, 536 U.S. 273 (2002), the Supreme Court held that FERPA does not create personal rights that an individual may enforce through 42 U.S.C. § 1983.

Return to FERPA Page