Section Two

Education agency administrators and parents share a common interest in ensuring that personal information about children in elementary and secondary schools is kept confidential. Many are unaware of the protection offered by state and federal laws. In this section, we inform administrators and parents about how federal laws protect information maintained in school and education agency records. The guidelines in this section offer practical information to education agency personnel and policymakers on developing procedures that will work for families and schools.

This material reflects only the broad outline of federal privacy policy requirements. We describe federal policy principles, many of which are supplemented by additional state statutes or local regulations. We caution that our interpretations are not legally binding, and we advise readers to direct specific questions either to local and state legal experts or to the appropriate federal government offices.

COMMONLY ASKED QUESTIONS

Q. What agencies are subject to federal laws on the privacy of education records?

A. Education agencies and institutions that collect and maintain education records are subject to federal privacy laws if they receive funds from the U.S. Department of Education. If information derives from an education record or is maintained in the record, federal as well as state and local privacy rules apply. See Section 2, Guidelines A.

Q. Do privacy assurances differ across federal education programs?

A. Privacy components of laws are administered by federal agencies other than the U.S. Department of Education, and these may be applicable to programs directed in schools.However, the Family Educational Rights and Privacy Act (FERPA) is a comprehensive law that applies broadly to information collected in public agencies or schools that receive federal education funds. Thus, FERPA applies to information collected and maintained by most public elementary, secondary, and postsecondary education institutions and by some private institutions in this country. See Section 2, Guidelines A.

Q. Are individuals liable for penalties if they do not adhere to the requirements of FERPA?

A. No, not typically. Institutions receiving funds from the U.S. Department of Education are legally responsible for complying with these laws. Individual liability would depend on state laws and local policies. See Section 2, Guidelines A1.

Q. What do state and local education agency personnel need to know about federal privacy laws pertaining to education records?

A. Strong federal laws protect the privacy of education records in schools. Individuals who work with education records in agencies or schools are responsible for knowing the privacy regulations that apply to their work. Agency administrators need to understand federal and state laws, as well as local policies, that govern parent access to records and restrict inappropriate disclosure of information about students and their families. See Section 2, Guidelines A and B.

Q. About which federal student records laws do school district or state education agency administrators need to be informed?

A. FERPA and the Protection of Pupil Rights Amendment (PPRA) are the two major laws governing the protection of education records and student and family privacy. The other key laws with specific federal regulatory requirements pertaining to schools are the National School Lunch Act and the Individuals with Disabilities Education Act. See Section 2, Guidelines B to E.

Q. What are the FERPA restrictions on matching data from student information files with data from other agency files?

A. FERPA generally prohibits data matches without parent consent except to (1) officials in other schools or school systems where a student intends to enroll; (2) authorized state or federal education representatives; and (3) organizations that are conducting approved studies on behalf of an education agency. Under certain circumstances, school officials can make cooperative data sharing arrangements, but they cannot reveal personally identifiable information. See Section 2, Guidelines B5.

Q. What are the responsibilities of state education agencies for providing parent or eligible students access to education records?

A. A state education agency must provide parents and eligible students with access to education records the agency maintains. Although these agencies are not required to establisha written policy, they are obligated to honor rights of access and to restrict disclosure of information except to authorized individuals. See Section 2, Guidelines B6.

GUIDELINES

A. Privacy-Related Laws That Apply to Agencies and Schools

A1. Which education agencies or institutions must adhere to federal education privacy laws?

Education agencies and institutions that receive funds from the U.S. Department of Education must adhere to federal privacy laws pertaining to education records of students. These generally include public elementary and secondary schools, school districts, intermediate education agencies, and state education agencies or their representatives. Most private and public colleges and universities are also subject to federal privacy laws because they receive federal funds from the U.S. Department of Education. However, because few private elementary and secondary schools receive federal funds directly, they are rarely subject to these privacy restrictions.

State or local education agencies that conduct programs administered by other federal agencies--the U.S. Departments of Agriculture, Health and Human Services, or Labor, for example--may also be required to meet confidentiality provisions of applicable statutes.

A2. Which federal laws directly affect data that education agencies collect and maintain?

A number of federal laws govern data collections by schools, districts, and state education agencies, and two of those laws apply most broadly: FERPA and PPRA. Exhibits 2-1 and 2-2 contain fact sheets describing FERPA and PPRA. Together, the two laws have far-reaching legal implications for state and local policies and procedures that guide three aspects of education agencies' data collection activities:

Rights of a parent to review and to seek to amend records administered by state or local education agencies or their representatives
Procedures by which education records can be released and protected
Rights of parents to review and, under some circumstances, to provide consent for their child's participation in surveys, analyses, or evaluations that are administered by state or local education agencies or their representatives

Privacy protection under FERPA is generally incorporated into laws authorizing federal education programs. Thus, FERPA and PPRA requirements apply to programs such as Title I, Migrant Education, Safe and Drug Free Schools and Communities, School-to-Work Opportunities, Education of Neglected and Delinquent Youth, Even Start, and Even Start Family Literacy. Similarly, most states include the core privacy protection of FERPA in their educationlegislation; in many cases they extend and strengthen this protection.

In addition to FERPA and PPRA, other federal laws affect school, district, or state education agency data collection, maintenance, and disclosure procedures. Among them are:

The Individuals with Disabilities Education Act (IDEA), which applies to the education records covered by this law. However, IDEA release and disclosure requirements are substantially identical to those in FERPA.
The Federal Drug and Alcohol Patient Records Confidentiality Law (42 CFR), which applies to the services and treatment of records pertaining to students who receive assistance from programs administered by the Substance Abuse and Mental Health Services Administration.
The National School Lunch Act, which restricts the release of eligibility and services information about students and families who participate in the federal free and reduced-price lunch program.
The Paperwork Reduction Acts of 1980 and 1995, which include rules that restrict what the federal government can ask state and local agencies to collect for the federal government.

Two other federal laws, the Freedom of Information Act (FOIA) of 1966 and the Computer Matching and Privacy Protection Act of 1988 do not apply to the education records maintained by schools or state education agencies because they pertain only to data the federal government collects directly from individuals. However, many states have passed FOIA or other privacy laws very much like the federal statutes that may apply to the information schools collect. When agencies or schools establish data policies and procedures, they should consult state statutes on these matters, as well as the federal requirements.

The Federal Policy for the Protection of Human Subjects, administered by sixteen federal departments and agencies, establishes procedures for protecting the rights of individuals--including students and families--who participate in federally sponsored research activities and programs. This statute establishes the preliminary rules researchers must follow when they conduct studies sponsored by federal agencies. Although these regulations may apply to data collections by schools, FERPA establishes additional basic disclosure restrictions that guide the treatment of any information collected in schools--whether the activity is sponsored by an education or other agency or individual--if the information either derives from education records or is maintained in those records for any period of time.

B. Privacy Protection under FERPA: Responsibilities of Agencies and Schools

The U.S. Congress passed FERPA in 1974 to protect student and family privacy. Also known as the Buckley Amendment, FERPA grants parents certain rights of access to their children's education records and restricts disclosure of information from those records without their consent. It also allows parents and eligible students to amend records they believe to be inaccurate or misleading. Appendices B, C, and D contain the original FERPA regulations,subsequent changes, and the most recently issued regulations. The original FERPA statute and its amendments are incorporated in the U.S. Code (20 USC 1232g). The Federal Register (34 CFR Part 99) contains regulations for administering the law.

This section reflects the 1996 revision of FERPA regulations that resulted from modifications to FERPA made in the Improving America's Schools Act of 1994. The U.S. Department of Education published revised regulations in the Federal Register on November 21, 1996 (pp. 59291-59298), to ensure greater flexibility in implementing the privacy laws pertaining to student records. See Appendix D for a copy of these revised regulations.

The law regards as an education record most information that teachers, school administrators, and education officials maintain about students in a tangible format, whether in electronic, photographic, or paper files. Regardless of where the information about students originates, if it is maintained by schools or education agencies, protecting its privacy is governed by FERPA. School districts, schools or state education agencies, if asked, must comply with parents' or eligible students' requests for access and review.

FERPA requires school districts--but not state education agencies--to notify parents and eligible students annually of their rights under FERPA. Among the changes in FERPA that resulted from the 1996 regulations was the removal of requirements for districts to adopt written policies pertaining to FERPA. Although local written policies are no longer required, regulations continue to encourage districts to develop privacy policies, but they grant agencies the discretion to adopt local implementation procedures and policies. Because state or local privacy protection laws or policies may supplement or refine FERPA, many state and local education agencies establish written policies to ensure the law will be applied uniformly.

B1. FERPA Defines Protected Education Records

FERPA defines education records as information:

Directly related to a student, specifically any information recorded in any way, including, but not limited to, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche
Maintained by education agencies or institutions, or by parties acting for the agency or institutions (e.g., special education schools and health or social services institutions)

Records pertaining to special education students are subject to the same FERPA requirements as all other student records. Education records include but are not limited to:

Family information, such as name and address of the student, parent or guardian, emergency contact information, date of birth, number of siblings, date and place of birth
Personal information, such as an identification code, social security number, picture, or list of personal characteristics that would make it easy to identify a student
Grades, test scores, courses taken, academic specializations and activities, and official letters about a student's status in school
Test records, answer sheets (including written responses to performance assessments and portfolios), and records of individualized education programs
Special education records
Disciplinary records established and maintained by school officials
Medical and health records that the school collects and maintains
Documentation of schools attended, courses taken, attendance, awards conferred, and degrees earned
Video tape recordings of individuals or groups of students

A school district may establish policies that list the types and locations of education records with a schedule of fees (which must be reasonable) that are charged for duplicating records. Agencies may not, however, charge a fee to search or to retrieve education records.

Some information about students is not considered an education record and is not subject to access or disclosure rules under FERPA:

Handwritten notes by teachers, supervisors, school counselors, and administrators, which may be used by substitute teachers or other replacement personnel
Records created by law enforcement units of schools or education agencies that are maintained separately from education records
Employment records about a student who is employed by a school, education agency or institution
Information obtained about individuals after they are no longer students

Another type of information is not subject to access or disclosure rules under FERPA. FERPA allows school systems to establish a policy that designates some types of information as directory information--the portion of the education record that would not generally be considered harmful or an invasion of privacy if disclosed. Local education agency definitions of directory information may vary, but they generally include a student's name and school activities, family members' names, addresses, and telephone numbers. Some school districts also include as directory information the biographical materials found in school yearbooks, such as video tapes and pictures of students, participation in various extracurricular activities, the degrees and awards received, and the names of previous schools attended. The height and weight of athletes may also be included as directory information. Once notice of directory information is given, school officials can distribute the information to anyone who requests it inside or outside the school.

If a school district has a policy for disclosing directory information, it must give public notice of what is considered in this category and indicate that parents may refuse to allow the agency to designate any or all of their child's record as directory information. The law requires the notification to specify the period of time in which parents must inform the school or district of any directory information whose release they disallow. Such notification can occur through a school newsletter, student handbook, or some other publication that parents reasonably can be expected to receive.

B2. Local Education Agencies--Not State Agencies--Must Give Public Notice of Rights under FERPA

FERPA regulations require school districts and institutions acting in their behalf to give annual notification to parents and eligible students of their rights to review education records and to request corrections of records they perceive to be inaccurate. Exhibit 2-3 presents a model privacy notification. These regulations apply to the education records maintained in any school, education agency, or institution representing an education agency. FERPA applies to all educational institutions, defined as agencies that provide:

Educational services or instruction, or both, to students
Administrative control or services to public elementary or secondary schools or postsecondary institutions

The U.S. Department of Education does not require local education agencies to notify parents or eligible students individually of their rights, but agencies must provide notice where it is likely to be seen. FERPA regulations regarding records access apply to state and local agencies, but only local agencies must give annual notification of rights under FERPA. The annual notification must inform parents they have the right to:

Inspect and review their child's record
Seek to amend the record if they believe the record to be inaccurate, misleading, or otherwise in violation of their child's rights
Consent to disclosures of personally identifiable information in the record, with certain exceptions authorized by FERPA
File a complaint with the U.S. Department of Education concerning the district's failures to comply with the requirements of FERPA

Parents' access to records is limited to information about their own child. In cases where an education record contains information about more than one child, the information must be separated so that parents do not have access to the records of any child other than their own.

FERPA requires local agencies to provide their annual notification in a manner that "effectively informs" those who have a disability or who speak a primary or home language other than English. Methods for notifying parents may include either providing notice in alternative formats such as audio tape, braille, computer diskette, or large print, or translating information into the native language of requesting parents.

State education agencies are not required by FERPA to have written policies about the rights afforded to the parents of eligible students; however, the law does require state education agencies to let parents and eligible students inspect and review records maintained by the state education agencies. Examples of records state education agencies may maintain are students' state test records, records of special education evaluation or treatment, or records of participation in schooltowork programs.

B3. Parents and Eligible Students May Inspect and Review Education Records

FERPA also grants records inspection and review rights to eligible students who are over eighteen or who have graduated from high school and are attending a postsecondary education institution. A student under eighteen who is still in high school but is also taking college courses has access to records held by the college, but access rights to records held by the high school stillbelong to the parents. Parents who claim students as dependents for income tax purposes may be given access to school records, even if the rights under FERPA have transferred to the student.

Parents and eligible students may request an explanation or interpretation of their education records, whether these records are held by schools, agencies, or representatives of educational institutions. The agency must respond to requests to review education records within forty-five days of the inquiry. If parents or eligible students believe a record is inaccurate or misleading, they may petition for the record to be amended or changed. The education agency must decide within a reasonable period of time if the request to change the record is consistent with the agency's own assessment of the record's accuracy. The agency cannot destroy records if there is an outstanding request to inspect or review them.

If a request to amend records is denied, the applicant can subsequently appeal the decision in a hearing conducted by the education agency. After the hearing, a parent or eligible student who continues to disagree with the contents of a record can insert an explanation of the objection into the official record, and that explanation must remain with the record as long as it is held by the agency.

FERPA gives either a parent or a legal guardian equal rights to review an education record unless there is evidence of a court order or a law revoking these rights. A parent refers to a natural or adoptive parent, including non-custodial or foster parents, a legal guardian, or an individual acting in the parent's absence. The law grants parent rights to foster parents acting on behalf of the child. Agencies or schools can require parents to verify their relationship with a child before providing access to records. Further specification of eligibility requirements is not stipulated in the federal law but can be detailed in state laws or local policies.

B4. FERPA Restricts Release of Information without Prior Consent

Certain additional restrictions apply to records disclosure procedures. Without consent of the parent or eligible student, education records can be disclosed only to school officials designated as having a "legitimate educational interest." The law leaves to the district the authority to define the criteria for determining the legitimacy of an educational interest, which generally includes situations where officials need to review education records to fulfill their professional responsibilities. This includes access to records by teachers, counselors, and administrators who routinely work with students. The following lists some example situations in which legitimate educational interest prevails:

To perform education- or discipline-related tasks in connection with a student
To provide services to a student or a student's family such as emergency health care, counseling, or school or job placement
To perform administrative or other educational responsibilities prescribed by the agency or school

If an educational agency or institution has a policy of disclosing education records to officials considered to have a legitimate educational interest, it must also give annual notification that explains the criteria for determining who constitutes a school official and what constitutes a legitimate educational interest. Depending on the policy defined locally, school officials might include any or all of the following:

A school administrator, supervisor, instructor, or support staff (including health or medical staff or law enforcement unit personnel)
A school board member with an authorized reason to review a record
A person or company with whom the district has contracted to perform a special task (e.g., an attorney, auditor, medical consultant, or therapist)
A parent or student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing required tasks

Because these officials, acting on behalf of students, have a need-to-know, they can usually access information without seeking consent.

Disclosure of information to an individual or agency outside the school, school district, or state education agency--a third party--generally is not allowed without prior consent of a parent. Under certain circumstances (e.g., governmentrequired audits, evaluations, or court orders), a district can release records without approval of the parent, but it must make clear the criteria for determining which institution or agency representatives may receive such information and under what conditions. FERPA stipulates that records disclosure without consent of the parent is permissible for the following individuals and organizations:

Officials in another school, school system, or postsecondary education institution where the student intends to enroll. Such releases must be reported to the parent or eligible student unless the release either is initiated by one of them or is specified by local policy.
The U.S. Secretary of Education, authorized representatives of the Comptroller General of the United States, and state and designated local education authorities.
Institutions to which students apply to receive financial aid to determine eligibility, amount of aid, conditions of aid award, and enforcement of award terms and conditions.
Accrediting organizations to carry out their functions. Release is allowed to accrediting organizations only if the resulting studies do not identify any particular student and if all personal identification is destroyed.
Organizations conducting studies on behalf of education agencies or institutions, including those that develop or administer tests, administer student aid programs, or evaluate programs for improving instruction.
Agencies in the state's juvenile justice system and in response to court orders or subpoenas, as specified in the state's laws.
Appropriate parties in a health or safety emergency.
State and local officials or authorities if specifically required by a state law that was adopted before November 19, 1974.

When a record is disclosed in the types of situations indicated above, the originating agency must note in the record the names of the parties who received the information and an explanation of the legitimate educational interest under which the record was disclosed. FERPA requires agencies or schools to account for all instances of education records release, indicating the reasons the information was provided and who received it. These explanations must be recorded in a student's record and maintained there until the agency destroys the record.

B5. Records Matching and Redisclosure to Third Parties

FERPA generally prohibits matches of computerized education records held by local or state education agencies with data from other agencies. These prohibitions apply broadly, to data sharing about special education programs, evaluating or monitoring the use of federal funds, or coordinating interagency social service assistance to students and families.

Beginning in 1994, the U.S. Congress established penalties for inappropriate release of personally identifiable information from education records by a third party. An agency or institution cannot allow that third party access to personally identifiable information from education records for at least five years.

However, cross-agency cooperative use of information from education records is an area of developing law and interpretation that experts are continually reexamining. States and local government agencies, along with schools, are seeking means to reduce fragmentation and duplication across service systems. Occasionally, interagency partnerships can be formed to exchange information about individual students in a manner that provides useful information but retains the anonymity of an individual student. Those who have experimented with such interagency partnerships are overcoming legal obstacles to collaboration without threatening the confidentiality of students who receive services. We address this topic in greater detail in Section 6.

B6. Implications of Other 1996 FERPA Regulations

In addition to reducing the requirements for local education agencies to have written FERPA policies, the 1996 regulations implementing the 1994 Improving America's Schools Act (IASA) clarified several other components of FERPA. The regulations:

Remove certain requirements about the annual notification of privacy rights, simplifying and making it easier to understand the central requirements of FERPA.
Establish a standard for giving annual notification to parents and eligible students that strikes a balance between placing a minimal requirement on education agencies and institutions and ensuring that parents and eligible students are effectively informed of their rights under FERPA.
Maintain the previously established forty-five day period for responding to requests to inspect records.
Require state education agencies to comply with the access provisions of FERPA, but not with the notification provisions. State education agencies are not required to give notice about their policies because the statute authorizing FERPA did not grant the U.S. Department of Education authority to establish regulations for states.
Clarify that nothing in FERPA, under certain circumstances, prevents schools from maintaining and disclosing specific information regarding disciplinary actions taken against students for conduct that poses a risk to the safety of the student, other students, or other members of the school community.
Give schools and education agencies the discretion to determine the circumstances under which it is appropriate to disclose information and what information will be releasedabout disciplinary actions taken against students whose behavior posed risks.
Grant schools and education agencies the flexibility to determine whether an education record of a juvenile may be released to authorities in the juvenile justice system without the prior written consent of the parent.
Allow officials to withhold information from parents if a court order or subpoena related to law enforcement specifically states that its existence should not be revealed to a parent or student.

These and other new provisions of the law should be closely reviewed by privacy experts within school districts and state education agencies for their specific applicability to individual cases.

C. U.S. Department of Education-Funded Surveys and Studies

PPRA, amended in 1994 by the Goals 2000: Educate America Act, specifies that information collected from students through surveys, research, analyses, or evaluations funded by the U.S. Department of Education must be available for parents to review. If parents ask, the surveys or evaluation materials must be made available for review. Surveys administered under the auspices of federally sponsored programs that are conducted in elementary or secondary schools fall within this law.

Like FERPA, PPRA applies to programs administered by the U.S. Department of Education. PPRA grants parents access to information that local or state education agencies collect from students under the auspices of federally funded activities. Agencies that collect information from students must explain to parents the rights that PPRA affords them. Information to parents must be readily understood by parents with disabilities or whose home language is not English.

PPRA protects the rights of students and their parents in two ways. First, it requires that parents have the opportunity to review certain federal surveys or instructional materials used in conjunction with surveys and to provide consent for their child's participation in them. Second, PPRA requires that state or local education agencies, and their contractors or representatives, obtain prior consent from the parent if they plan to collect information from students concerning:

Political affiliation
Mental and psychological problems
Sexual behavior and attitudes
Illegal or self-incriminating behavior
Critical assessments of other individuals or family members
Privileged information given to lawyers, physicians, or ministers
Income (other than what is required by law for program eligibility)

Although PPRA stipulates that education agencies must give parents the right to review and consent before their children participate in surveys, research, or evaluations, the law does not require that parents be given copies of the surveys or data collection documents. However, they must be able to inspect the actual survey and related instructional materials within forty-five days of requesting a review. Should there be an outstanding request for review, the school or agency may not destroy any materials used in connection with a survey. Also, agencies must make available copies of such surveys for inspection even if a student is not required to participate in them.

Parents may register complaints, if they believe their privacy rights under PPRA have been violated, by submitting their complaints directly to the appropriate local or state officials. Federal officials will review unresolved complaints and document local attempts to resolve the complaints.

The Family Policy Compliance Office (FPCO) of the U.S. Department of Education interprets FERPA and PPRA. The office also responds to complaints about interpreting or applying the laws. Any conflicts between PPRA and state laws or local policies should be forwarded for adjudication to the FPCO within forty-five days after the conflict was observed.

D. FERPA and Special Education Records

The Individuals with Disabilities Education Act (IDEA), Part B, provides grants to states to support the education of children with disabilities ages three to twentyone; Part H supports statesponsored early intervention programs for children from birth through age two. Confidentiality provisions in IDEA incorporate the provisions in FERPA and describe specific applications of the law to records of students with disabilities. The confidentiality regulations under IDEA that go beyond FERPA apply only to the records of children with disabilities who are eligible for special education services under IDEA. Parents of children with disabilities must have the opportunity to inspect all education records associated with the special services their children receive. In particular, they must have access to state or local records pertaining to the identification, evaluation, and education placement of their child and services their child receives.

IDEA confidentiality regulations apply to "participating agencies," defined by the law as any agency or institution that collects, maintains, or uses personally identifiable information. Records of teachers, counselors, and medical or psychological and counseling practitioners within participating agencies who work directly with children in schools fall within IDEA confidentiality provisions. Similarly, IDEA applies to the records of agencies and individuals who are contracted to assess students or render services on behalf of state or local education agencies. Thus, state or local records about the identification, evaluation, and educational placement of their children and the provision of free and appropriate education services may be reviewed by parents and eligible students. This includes cumulative files with any medical or psychological assessment records that are created by specialists outside the school but kept within the school files.

The rules governing the treatment of records of students with disabilities must be well understood both by educators who work directly with families and by administrators whocollect, maintain, and analyze those records. IDEA requires participating agencies to fully inform personnel who collect or use personally identifiable information about their responsibilities for implementing confidentiality provisions. Participating agencies must protect the confidentiality of information at collection, disclosure, and records destruction stages. To accomplish this oversight, one official at each participating agency must assume responsibility for ensuring the confidentiality of information.

The definition of parent under IDEA parallels the FERPA definition and also includes surrogate parents whom the state designates for students without parents. IDEA broadens slightly the definition of parent from FERPA, giving access rights to individuals acting in the place of a parent or legal guardian, such as a grandmother or stepparent with whom a child lives, a surrogate parent the state appoints, or others who might be legally responsible for a child's welfare.

As under FERPA, agencies must also afford privacy rights to eligible students who are over eighteen or attend postsecondary school, even if they are identified for special education services. If necessary, records must be interpreted for those who speak a language other than English or who have disabilities. The law obligates state and local education agencies to comply with requests for access to records within forty-five days after requests are received. In addition, parents have access to records before individualized education program (IEP) meetings or hearings are conducted.

Several other features of IDEA pertain to the confidentiality of records on children with disabilities and exceed FERPA's requirements:

Parents must be informed when records are no longer needed, and information must be destroyed at the parents' request.
Without parent consent, agencies or schools may maintain permanent records of limited identifying information, such as a student's name, address, and telephone number, his or her grades, attendance record, classes attended, grade level completed, and year completed.
State education agencies must establish policies and procedures, including sanctions, to ensure that IDEA requirements are met.

Exhibits 2-4 and 2-5 summarize the FERPA and IDEA requirements that apply to the education records of students with disabilities.

E. Other Federal Laws Affecting Information Privacy in Schools

Student records may be protected simultaneously by laws administered by the U.S. Department of Education as well as by other state and federal agencies. FERPA establishes a high level of privacy protection, but statutes administered by agencies within the U.S. Departments of Agriculture, Health and Human Services, and Justice also protect records privacy and may apply to the records of students in schools. Professional standards of ethical practice, under which school doctors and nurses, psychologists, and other professionals operate, may also establish privacy restrictions. Following are some examples:

Records of drug and alcohol prevention and treatment services for students are covered by confidentiality restrictions administered by the U.S. Department of Health and Human Services.
Some laws establish minors' rights to seek treatment for certain health and mental health conditions, including sexually transmitted diseases, HIV testing and treatment, pregnancy, and mental health counseling.
State laws protecting records pertaining to HIV confidentiality, medical records, child abuse, privileged communications, and state-specific records retention and destruction regulations.
Ethical standards of practice and licensure dictate the conduct of health and education professionals.

Confidentiality issues may arise in schools in cases where FERPA is not the broadest protection, or where the application of FERPA may be unclear. As a result, school personnel must develop an understanding of the principles underlying legal statutes and regulations and make every effort to maintain the privacy of any information they receive in the course of providing services. School officials increasingly have access to sensitive health and family information.

When uncertainty occurs about when and with whom information should be shared, individuals in schools should act with caution and understand that their fundamental obligation is to maintain confidentiality. School personnel should never share with another individual--even a professional--more than is necessary to benefit the student. Legal counsel and school officials are available to interpret matters where privacy issues are involved. Teachers, paraprofessionals, and principals should not hesitate to consult these individuals when they are uncertain about their obligations or their responsibilities. The references at the end of this section contain additional guidance related to the information presented here.

Individual student records held by schools or education agencies are primarily education records and are therefore subject to FERPA regulations, even when other statutes also may apply. If officials perceive a conflict between FERPA and any state or other federal statutes or regulations, they should seek counsel from appropriate legal authorities to identify the issues involved and to establish policies that accurately reflect applicable legal statutes.

E1. National School Lunch Program

The National School Lunch Act (NSLA), administered by the U.S. Department of Agriculture, provides free or reduced-price meals for eligible students. The NSLA governs the National School Lunch Program, the School Breakfast Program, and the Special Milk Program. It strictly limits how school districts may use individual student and household information obtained as part of the eligibility process or once students are identified to receive program services. The act ensures that neither eligibility nor program identification information may be incorporated into student's education record. Furthermore, the statute establishes criminal penalties for unauthorized disclosures and improper uses of individual school lunch eligibility orenrollment information.

Although the use of information collected under the auspices of the NSLA about individuals is restricted, in 1994 a modification of the law relaxed certain restrictions on how state and local education agencies may use information from NSLA records for legally specified program evaluations and audits. The amendment allowed limited disclosure of information to individuals or agencies that are "directly connected with the administration or enforcement" of the NSLA, as amended in Public Law 104-149, Section 9 (iii). Specifically, education agencies are now permitted to use data about free and reducedprice meal eligibility status for limited federal and state education purposes related to the implementation and evaluation of Title I programs under the Improving America's Schools Act.

In general, state and local education agencies can expect to continue restricting information about students receiving NSLA benefits. The key determinant for allowing disclosure will be a need-to-know, the conditions of which will be defined through future regulations. If an agency's database includes personally identifiable information about students, except where allowable by memoranda of agreement, database managers must impose controls on the disclosure of that information. Before these data can be released, agencies must require potential information users to specify the conditions of confidentiality under which such information will be disclosed. Information provided for one purpose may not be used for another purpose unless the reasons for releasing it again have been defined and approved according to the law.

Regulations restricting the use of information collected under the auspices of the NSLA were not available at the time these guidelines were published. However, a memorandum from the U.S. Department of Education dated March 18, 1996 confirmed that education agencies may use free and reducedprice meal eligibility data for allocating services and for evaluating and reporting of aggregate achievement data pertaining to Title I. See Exhibit 2-6 for a copy of the memorandum.

E2. Confidentiality of Drug Prevention and Treatment Records

Federal confidentiality laws and regulations prohibit the disclosure of information about students who apply for or receive alcohol or drug abuse treatment services. The Federal Drug and Alcohol Patient Records Confidentiality Law (42 CFR) is administered by the Substance Abuse and Mental Health Services Administration of the U.S. Department of Health and Human Services. The Department of Health and Human Services confidentiality regulations apply to records of any patient, even a minor student in school, who receives treatment from a federally assisted program. Under the law, patients include students who receive counseling because they are children of alcoholics or drug abusers.

The confidentiality rules, known as 42 CFR, apply to assessment, diagnosis, counseling, group counseling, treatment, or referral for treatment in most programs in which students participate, including programs sponsored by public and many private schools. They forbid the release of any information without a patient's consent, even when the patient is a student inschool and under eighteen years of age.

The 42 CFR restrictions may conflict with the obligations of school-based programs to provide parent access to education records of their student. However, the U.S. Department of Education and the Substance Abuse and Mental Health Services Administration issued a joint opinion in 1990 that suggests potential solutions to this conflict. One solution requires students to consent to parent access to records as a condition of receiving diagnostic, treatment, or referral services; a second solution limits the information kept in school records, recognizing that parents may have access to them. Both solutions are imperfect, however, and school officials are advised to seek information and advice about potential confidentiality conflicts from their state attorney general or from the Family Policy Compliance Office in the U.S. Department of Education. Exhibit 2-7 includes examples of forms pertaining to releasing confidential information and informing patients of their rights under FERPA.

E3. Forms Clearance Requirements of the Paperwork Reduction Acts of 1980 and 1995

The federal government monitors the paperwork burden of federal legislation through the Paper Reduction Acts of 1980 and 1995, which authorize the Office of Management and Budget (OMB) in the Executive Office of the President to restrict the information that agencies may collect from the public. Federal agencies and non-education agencies receiving federal funds must obtain OMB clearance authorizing each approved data collection instrument or form. An approved information collection form is assigned a clearance number and an expiration date to confirm that it is authorized. Approved federal data collections must explain the data collection purpose prominently on the form, whether the data collection is mandated or voluntary, and the benefit(s) to be obtained from the data collection.

The clearance process also requires that plans for data collection stipulate how the data are to be used, along with provisions for ensuring confidentiality of any personal data collected. OMB clearance is not required for the clearance of state or local forms, however. OMB clearance ensures that requests for information from student records meet the requirements of FERPA. It is unlikely than any records requiring release of personally identifiable information would be requested in OMB-approved data collections.

E4. Using Social Security Numbers as Student Identification Codes

Section 7(a) of the Privacy Act of 1974 addresses the use of social security numbers by federal, state, or local governments. It states that it is

...unlawful for any federal, state, or local government agency to deny to any individual any right, benefit or privilege provided by law because of such individual's refusal to disclose his social security account number

When government agencies collect social security numbers for reasons other than those allowed in the original law, they must specify how the numbers will be used and the limits of their use. Requests for social security numbers must be accompanied by the following notice:

Any federal, state, or local government agency which requests an individual to disclosehis social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.

State and local education agencies can minimize challenges to their use of social security numbers for student records identification by creating alternative identification numbers for students whose parents object to using social security numbers for identification.

F. Resources for Interpreting Federal Laws That Protect the Privacy of Education Records

A number of private and public agencies monitor federal activity on privacy and confidentiality issues. In the federal government, the Office of Information and Regulatory Affairs (OIRA) in OMB of the Executive Office of the President, oversees the implementation of major privacy laws. For each law, specific agency offices respond to questions and complaints from citizens. As new issues arise and the U.S. Congress passes new laws, these agencies develop regulations that define the regulations for applying the laws.

Two federal offices can respond to questions. First, the U.S. Department of Education can assist in interpreting FERPA and PPRA and respond to complaints about the interpretation or application of these laws through:

Family Policy Compliance Office

U.S. Department of Education

600 Independence Avenue, SW

Washington, DC 20202

(202) 260-3887

Second, the Information Resources Group can provide additional information about broad issues administered by OMB:

Information Resources Group

Office of Information and Regulatory Affairs

725 17th Street, NW

Washington, DC 20503

(202) 395-7316

The Council of Chief State School Officers (CCSSO), working with representatives of state education agencies, is also monitoring the evolution of privacy laws. As the need arises, CCSSO will develop public information to clarify the legal responsibilities and obligations of state and local school officials and concerned parents. Additional information can be obtained by contacting:

Council of Chief State School Officers

One Massachusetts Avenue, NW

Suite 700

Washington, DC 20001

(202) 408-5505

Other national groups have organized to monitor and interpret privacy implications of federal laws about the education, health, and social services for children. Among them are the following organizations that provide information and respond to questions:

Center for Law and Social Policy

1616 P Street, NW, Suite 150

Washington, DC 20036

(202) 328-5140

Education Commission of the States

707 Seventeenth Street, Suite 2700

Denver, CO 802023427

(303) 299-3600

National Association of State Directors for Special Education

1800 Diagonal Road, Suite 320

Alexandria, VA 22314

(703) 519-3800

Youth Law Center

111 Sansome Street, Suite 950

San Francisco, CA 94104

(415) 543-3379

References

American Association of Collegiate Registrars and Admission Officers. 1995. Guidelines for postsecondary institutions for implementation of the Family Educational Rights and Privacy Act of 1974 as amended. Washington, DC: American Association of Collegiate Registrars and Admission Officers.

Gelfman, M., and Schwab, N. 1991. School health services and educational records: Conflicts in the law. Education Law Reporter, 64: 319338.

Legal Action Center. 1996. Handbook: Legal issues for schoolbased programs, 2nd edition. New York: Author.

Panel on Confidentiality and Data Access [of the] Committee on National Statistics, Commission on Behavioral and Social Sciences and Education, National Research Council, and the Social Science Research Council. 1993. Private lives and public policies: Confidentiality and accessibility of government statistics. Washington, DC: National Academy Press.

Oakland (Michigan) Schools. 1992. Resource handbook for School administrators: Confidentiality requirements of general education and handicapped student education records. Waterford, MI: Department of Pupil Services, Oakland Schools.

Schwab, N., and Gelfman, M. 1991. School health records: Nursing practice and the law. School Nurse, 7(2), 1721.

Seigler, G. E. 1996. What should be the scope of privacy protection for student health records? A look at Massachusetts and federal law. Journal of Law and Education, 25 (2): 237269.

Soler, M.I., and Peters, C.M. 1993. Who should know what? Confidentiality and information sharing in service integration, Resource Brief 3. New York: National Center for Service Integration, Columbia University.

For questions about the content of this product, please contact Lee M. Hoffman.