Checklist · Education

FERPA Compliance: A Practical Checklist

20 U.S.C. § 1232

Type
Checklist
Jurisdiction
National
Date
2024-09-25
Topic
Education

The Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations at 34 C.F.R. Part 99 govern how schools that receive U.S. Department of Education funding handle student records. This checklist walks a school or its counsel through FERPA compliance in fifteen operational phases: confirming coverage, classifying what is and is not an "education record," issuing the annual notification, designating directory information and honoring opt-outs, managing the transfer of rights to eligible students, obtaining valid consent, and applying the consent exceptions — above all the school-official exception as it applies to edtech vendors and cloud services, where "direct control" is the hinge and most districts fail. It also covers the health-and-safety-emergency exception, subpoena response, access and amendment rights and the hearing, the record-of-disclosures requirement, and the enforcement reality after *Gonzaga University v. Doe*, 536 U.S. 273 (2002), which held FERPA creates no private right of action. Because state student-privacy and edtech statutes now layer stricter duties on top of FERPA, and because they vary substantially, this checklist teaches the federal floor and flags where you must confirm your own state's rule.

FERPA Compliance: A Practical Checklist

Education > Student Privacy | Published 25 September 2024 - Updated 6 March 2026 | UpLaw - uplaw.us

FERPA is not a privacy statute in the modern sense. It is a funding condition with a records-management regime bolted on — no private right of action, one nuclear remedy nobody has ever fired, and a set of exceptions so load-bearing that the exceptions are the statute. Compliance is therefore an operational discipline, not a litigation posture.

Keywords: FERPA, education records, student privacy, directory information, eligible student, school official exception, legitimate educational interest, edtech vendor contracts, annual notification, health and safety emergency, subpoena response, record of disclosures, Gonzaga v. Doe, PPRA, IDEA confidentiality

How to use this checklist

FERPA compliance fails in predictable places: a district that never designated directory information but publishes an honor roll; a registrar who treats a subpoena as an order; a principal who forwards a counselor's "personal notes" to a colleague and thereby converts them into an education record; and — most commonly, and most expensively — a technology director who clicks through a free app's terms of service and assumes the school-official exception covers it. It does not.

The fifteen phases below track the actual order of operations. Work them in sequence the first time, then treat Phases 4, 7, 8, 10, 11, and 13 as recurring operational controls. Throughout, follow Cedar Hollow Unified School District, a fictional K-12 district of 9,000 students that is about to sign a contract with Lanternfish Learning, an adaptive-reading platform. Cedar Hollow will get several things wrong so you do not have to.

For the doctrinal foundation beneath this operational document, see Education Law: A Comprehensive Guide to Title IX, FERPA, and the IDEA. For the full map of education-law resources, see The Education Law Toolkit.

Scope, and what this checklist does not decide

FERPA is federal; almost everything around it is not. FERPA, the PPRA, the IDEA, and Title IX are federal statutes that apply to covered institutions nationwide. But education governance — how schools are chartered, funded, and run; who owns student records as a matter of property and public-records law; what a district may put in a vendor contract; what a school board must disclose in an open meeting — is overwhelmingly state law, and it varies substantially from state to state. There is no nationwide rule of student-records governance outside the federal floor described here. Every phase below therefore ends at the same place: confirm your own state's statute, your state education agency's guidance, and your district's or system's own policy.

Verify before relying. Several of the regimes touched here move quickly and should be confirmed against the current text before you act on them:

  • [ ] Title IX regulations. The Title IX implementing regulations at 34 C.F.R. Part 106 have been amended, litigated, enjoined, and rewritten repeatedly in recent years. Where a FERPA question is embedded in a Title IX grievance (Phase 11), confirm which version of the regulation currently governs your institution before designing the process.
  • [ ] The COPPA Rule. 16 C.F.R. Part 312 has been amended; the school-authorization pathway, retention limits, and consent mechanics are all live issues. Read the current Rule.
  • [ ] State student-privacy and edtech statutes. These are the fastest-moving layer in this area (Phase 15). Assume yours has changed since you last looked.
  • [ ] Department of Education guidance. Student Privacy Policy Office guidance is interpretive, not binding, and is revised. Treat it as persuasive, and cite the regulation.

Phase 1 — Are you subject to FERPA?

  • [ ] Confirm the institution is an "educational agency or institution" — one that provides education services or instruction, or is authorized to direct and control such institutions — and receives funds under any program administered by the U.S. Department of Education. 34 C.F.R. § 99.1(a).
  • [ ] For postsecondary institutions, check the Title IV pathway: if your students receive Pell Grants or Direct Loans, you are FERPA-covered, even if you take no other federal money.
  • [ ] For private K-12 schools, confirm honestly whether you take any ED funds. Most independent day schools do not — and are therefore not subject to FERPA at all.
  • [ ] If you are not FERPA-covered, do not stop: identify the state student-privacy statute, contractual promises, and common-law duties that do bind you.
  • [ ] For a tribally controlled school or a tribal college, do not assume the state framework applies. Tribes are separate sovereigns, not subdivisions of a state, and tribal law is not a subset of state law. A tribally controlled school that receives ED funds is FERPA-covered like any other recipient, but the surrounding governance and records law is the tribe's own, and Bureau of Indian Education schools sit in a distinct federal posture. Identify the governing sovereign before you identify the rule.
  • [ ] Identify every unit within the institution that touches student data: registrar, counseling, health services, athletics, school resource officers, transportation, food service, IT, and the foundation or alumni office.
  • [ ] Name a responsible official — a registrar, general counsel, or chief privacy officer — who owns FERPA. Diffuse ownership is the root cause of most findings.

Why it matters, and the traps. FERPA is a spending-clause statute. Its entire operative force comes from 20 U.S.C. § 1232g(b)(1), which says no funds "shall be made available" to a school with a policy or practice of releasing education records without consent. That framing has two consequences people miss. First, FERPA regulates institutions, not vendors, not teachers personally, and not parents — a point that governs everything in Phase 8. Second, a school that takes no ED funds is outside FERPA entirely, which surprises private-school administrators who have spent years reciting FERPA at parents. Conversely, administrators at private colleges often assume they are exempt; they are not, because Title IV aid flows to their students.

The other trap is scope creep in the other direction: schools invoking "FERPA" as a reason to refuse anything inconvenient. FERPA does not prohibit a teacher from discussing a student with the student's parent, does not bar a school from telling a parent their child was in a fight, and is not a privilege. Treating it as an all-purpose shield produces both bad service and bad law.

Phase 2 — What is an "education record" — and what is not

  • [ ] Apply the two-part test from 20 U.S.C. § 1232g(a)(4)(A) and 34 C.F.R. § 99.3: a record is an education record if it is (1) directly related to a student and (2) maintained by the school or by a party acting for the school.
  • [ ] Remember that medium is irrelevant: paper, email, database rows, handwriting, film, video, and audio all count.
  • [ ] Test each candidate against the exclusions:
    • [ ] Sole possession records — kept in the sole possession of the maker, used only as a personal memory aid, and never accessible or revealed to anyone except a temporary substitute.
    • [ ] Law enforcement unit records — created by and maintained by a law enforcement unit for a law enforcement purpose. 34 C.F.R. § 99.8.
    • [ ] Employment records — relating exclusively to the individual as an employee, made and maintained in the normal course of business, and not available for any other purpose. Not excluded if the person is employed because of student status (work-study, resident advisor, teaching assistant).
    • [ ] Treatment records — records on an eligible student made by a physician, psychiatrist, psychologist, or other recognized professional in connection with treatment, disclosed only to those providing treatment.
    • [ ] Alumni records — created after the individual is no longer a student and unrelated to their attendance.
  • [ ] Do not treat surveillance video as automatically outside FERPA. Video maintained by the school that is directly related to an identifiable student can be an education record, and video showing multiple students triggers the redaction analysis in Phase 12.
  • [ ] Build a data map: for each system, record what student data it holds, who can see it, where it lives, and how long it is kept.

Why it matters, and the traps. The exclusions are narrower than they sound, and every one of them is a one-way door. A counselor's private notes are sole-possession records right up to the moment she reads them aloud in a student-support meeting; then they are education records, subject to inspection by the parent, forever. A school resource officer's incident report is a law enforcement unit record — but if the assistant principal photocopies a disciplinary file and hands it to the officer, the copy in the officer's drawer is still an education record. You cannot launder an education record by routing it through the law enforcement unit.

The Supreme Court drew the boundary of "maintained" in Owasso Independent School District No. I-011 v. Falvo, 534 U.S. 426 (2002), holding that peer-graded papers called out in class are not education records: student graders are not acting for the institution, and a paper on a classmate's desk is not "maintained" in the way a filing cabinet or database is. Falvo is the standard authority for the proposition that FERPA attaches to institutional records systems, not to every scrap of paper in a classroom.

The data map is the unglamorous prerequisite to everything else. The methodology is the same one used in commercial privacy programs — see Building a Privacy Compliance Program: Governance, Data Mapping, and the Legal Patchwork and the operational sequence in Standing Up a Privacy Compliance Program: A Practical Checklist.

Phase 3 — The annual notification of rights

  • [ ] Issue the notification annually to parents of current students and to eligible students. 34 C.F.R. § 99.7.
  • [ ] Confirm it states all four rights: (1) inspect and review; (2) seek amendment; (3) consent to disclosures except where FERPA authorizes disclosure without consent; (4) file a complaint with the U.S. Department of Education.
  • [ ] Confirm it describes the procedure for exercising the inspection and amendment rights.
  • [ ] If — and you will — you disclose under the school-official exception, confirm the notice states your criteria for who is a "school official" and what constitutes a "legitimate educational interest." 34 C.F.R. § 99.7(a)(3)(iii). This is the single most frequently omitted element.
  • [ ] Confirm the criteria expressly include contractors, consultants, volunteers, and other outsourced parties, if you intend to rely on Phase 8.
  • [ ] Use a means "reasonably likely to inform," and make effective notice to parents with disabilities and parents with limited English proficiency.
  • [ ] Archive each year's notice with a date-stamped record of how it was distributed.

Why it matters, and the traps. The annual notification is a jurisdictional prerequisite dressed up as boilerplate. You cannot use the school-official exception unless your notice defines school official and legitimate educational interest. Cedar Hollow's handbook recites the four rights beautifully and says nothing about criteria — which means every disclosure it has ever made to a vendor under the school-official exception rests on nothing.

Note what the regulation does not require: individual mailing. A handbook, a website posting, or a newspaper notice can satisfy § 99.7 if it is reasonably likely to inform. But "we posted a PDF on a page nobody visits, in English only, in a district where 30% of families speak Spanish at home" is not reasonably likely to inform. The drafting discipline is the same as any consumer-facing notice — see Drafting a Privacy Policy: A Practical Checklist.

Phase 4 — Directory information: designation, notice, and the opt-out

  • [ ] Decide, deliberately, whether to designate directory information at all. It is optional.
  • [ ] If you designate it, list the categories precisely — name, address, telephone listing, email, photograph, date and place of birth, major, grade level, enrollment status, participation in activities and sports, weight and height of athletes, dates of attendance, degrees and honors, most recent school attended. 34 C.F.R. § 99.3.
  • [ ] Never designate the Social Security number.
  • [ ] Designate a student ID number or user ID only if it cannot be used alone to gain access to education records — i.e., it requires a PIN, password, or other factor.
  • [ ] Give public notice of (a) the categories designated, (b) the right to refuse designation of any or all categories, and (c) the deadline for opting out. 34 C.F.R. § 99.37(a).
  • [ ] Honor opt-outs across every publication channel: yearbook, athletic program, honor roll, graduation program, press release, website, social media, and the school directory app.
  • [ ] Continue to honor an opt-out after the student leaves. A school may not disclose directory information about a former student who opted out while in attendance. § 99.37(b).
  • [ ] Consider limiting directory disclosures to specific parties or purposes, which the regulation permits.
  • [ ] Handle the separate ESEA/military-recruiter access requirement, which carries its own opt-out and is not the FERPA opt-out.

Why it matters, and the traps. Directory information is where good schools get caught, because the disclosures are cheerful. A district posts the varsity roster; a family in a domestic-violence relocation had opted out; the address of a sheltered child is now indexed by search engines. That is a FERPA violation and, far worse, a safety failure.

Two mechanical traps. First, you must actually designate — a school that never issued a directory-information notice has no directory-information exception, and every honor-roll press release is an unconsented disclosure. Second, the opt-out is category-by-category if you offer it that way; build the roster system so that a "photo" opt-out and a "name" opt-out are separately enforceable flags that propagate to the yearbook vendor, not a note in a paper file.

Phase 5 — Eligible students: the transfer of rights

  • [ ] Identify the trigger: FERPA rights transfer from parent to student when the student turns 18 or enrolls in a postsecondary institution at any age — whichever comes first. 34 C.F.R. §§ 99.3, 99.5(a).
  • [ ] Configure the student information system to flip the flag automatically on the 18th birthday.
  • [ ] At postsecondary institutions, treat every enrolled student as an eligible student — including the 16-year-old dual-enrollment student, whose parents have no automatic FERPA right of access to college records.
  • [ ] Know the two parent-access exceptions and decide whether to use them. They are permissive, not mandatory:
    • [ ] Disclosure to parents of a dependent student as defined in 26 U.S.C. § 152. 34 C.F.R. § 99.31(a)(8). Decide what proof you will require.
    • [ ] Disclosure to a parent of a student under 21 regarding a violation of law or institutional rule governing alcohol or a controlled substance, where the school has determined the student committed a disciplinary violation. § 99.31(a)(15).
  • [ ] For K-12: give both parents access — custodial and noncustodial alike — unless you hold a court order, state statute, or legally binding document that specifically revokes those rights. 34 C.F.R. § 99.4.
  • [ ] Train front-office staff on that last item. It is the source of an enormous share of FERPA complaints.

Why it matters, and the traps. Section 99.4 is counterintuitive and constantly violated. A parent shows up with a custody decree granting the other parent "sole legal custody," and the school refuses records. Unless that decree specifically revokes FERPA rights, the school just violated FERPA. The default is access for both parents; revocation must be explicit.

On the other side, postsecondary registrars over-disclose to anxious tuition-paying parents. The dependent-student exception is real, but it requires an actual § 152 determination, and it is discretionary — a school may decline to use it and many do, as a matter of policy, telling parents to get the student's written consent instead. That is the cleaner path.

Phase 6 — The default rule: written consent before disclosure

  • [ ] Start from the premise that disclosure of personally identifiable information from education records requires prior written consent. 34 C.F.R. § 99.30(a).
  • [ ] Confirm every consent form contains all four required elements. It must:
    • [ ] Be signed and dated;
    • [ ] Specify the records that may be disclosed;
    • [ ] State the purpose of the disclosure;
    • [ ] Identify the party or class of parties to whom disclosure may be made. § 99.30(b).
  • [ ] If you accept electronic consent, ensure the method identifies and authenticates the signer and indicates approval. § 99.30(d).
  • [ ] Reject blanket, open-ended, or perpetual consents. "I authorize the district to share my child's records as needed" is not a valid FERPA consent.
  • [ ] Log the consent with the record set it authorized.
  • [ ] Before invoking any exception in Phases 7-11, confirm in writing which subsection of § 99.31 you are relying on. If nobody can name the subsection, get consent.

Why it matters, and the traps. The four elements are not a formality — they are the boundary of the authorization. A consent that specifies "transcript" does not authorize release of the discipline file. A consent that names "prospective employers" does not authorize release to a journalist. And a consent with no stated purpose is void, which means the disclosure was unconsented.

The discipline of naming the subsection before disclosing is the single highest-value habit in FERPA practice. It converts a vague feeling that "we're allowed to do this" into a citation that can be logged, audited, and defended.

Phase 7 — The school-official exception and "legitimate educational interest"

  • [ ] Confirm the disclosure is to a school official your annual notice defines as such. 34 C.F.R. § 99.31(a)(1)(i)(A).
  • [ ] Confirm the official has a legitimate educational interest — a need to review the record in order to fulfill a professional responsibility. Curiosity is not an interest. Concern is not an interest.
  • [ ] Implement reasonable methods to ensure school officials access only the records in which they have a legitimate educational interest. § 99.31(a)(1)(ii).
  • [ ] Prefer physical or technological access controls: role-based permissions in the SIS, field-level restrictions on health and discipline data, and no shared logins.
  • [ ] If you rely on administrative policy instead of technical controls, document why the policy is effective — the regulation puts the burden on you.
  • [ ] Turn on audit logging in the SIS and actually review it. Sample records of high-profile students and staff children quarterly.
  • [ ] Train annually, and require an acknowledgment of the access policy as a condition of SIS credentials.

Why it matters, and the traps. The school-official exception is the workhorse — the overwhelming majority of lawful in-school data movement rides on it. It is also the exception most often stretched past breaking. A teacher who is not the student's teacher browsing that student's discipline history has no legitimate educational interest. A board member reading a constituent's child's file has none. A staff member looking up a neighbor's grades has none, and audit logs will show it.

The "reasonable methods" clause added in the 2008 amendments is where enforcement bites. A district with a single "teacher" role that can read every record for every student in the district is not using reasonable methods, and it cannot cure that with a policy memo. Least-privilege access control is an access-governance problem identical to the one in any enterprise; the analytical approach in Deploying an AI System: An AI Governance and Risk Checklist and AI Governance and Compliance: A Comprehensive Guide maps directly onto SIS role design.

Phase 8 — The school-official exception applied to vendors and cloud services

This is the phase that matters most, and the one Cedar Hollow is about to fail.

  • [ ] Confirm the vendor satisfies all three conditions of 34 C.F.R. § 99.31(a)(1)(i)(B). The vendor must:
    • [ ] Perform an institutional service or function for which the school would otherwise use its own employees;
    • [ ] Be under the direct control of the school with respect to the use and maintenance of education records;
    • [ ] Be subject to § 99.33(a) — using the information only for the purpose for which the disclosure was made, and making no redisclosure without authorization.
  • [ ] Confirm your annual notification's "school official" criteria expressly cover contractors and vendors (Phase 3).
  • [ ] Get "direct control" into the contract, not the marketing deck. The contract must:
    • [ ] Limit use of student data to the contracted educational purpose;
    • [ ] Prohibit secondary use — targeted advertising, profiling, resale, and training of general-purpose models on student data;
    • [ ] Prohibit redisclosure except as the district directs, and flow the same terms to subprocessors;
    • [ ] Specify data ownership and require return or deletion on termination, with certification;
    • [ ] Impose concrete security safeguards (encryption at rest and in transit, access controls, penetration testing, personnel screening);
    • [ ] Require prompt notice of any security incident to the district, with cooperation duties;
    • [ ] Grant the district audit or assessment rights;
    • [ ] Bar unilateral amendment of the terms — no "we may update this policy at any time";
    • [ ] Survive: confidentiality obligations must outlast the term.
  • [ ] Refuse clickwrap. A free app whose terms of service the teacher accepted is, by definition, not under the district's direct control.
  • [ ] Route every edtech acquisition — including free tools — through a single approval gate. Shadow IT is the dominant FERPA exposure in modern districts.
  • [ ] Layer state law on top: many states directly regulate edtech operators and district-vendor contracts, and they are stricter than FERPA.

Why it matters, and the traps. Here is the structural point everyone misses: FERPA does not regulate the vendor. It regulates the school. The vendor has no federal FERPA duty to you; your only leverage is contract. That is why "direct control" must be a set of enforceable covenants, not an assurance.

Worked example. Cedar Hollow's technology director signs Lanternfish Learning's standard order form. The linked terms of service permit Lanternfish to "use aggregated and de-identified data, and Customer Data, to develop, improve, and market our products and services," permit unilateral amendment on 30 days' notice, and are silent on deletion. The district's annual notice never mentions contractors.

Three independent failures. (1) The annual notice does not designate contractors as school officials, so the exception is unavailable on its face. (2) Lanternfish is not under direct control: it reserves the right to use student data for its own product development and marketing, and to change the deal at will. (3) The redisclosure and secondary-use limits of § 99.33(a) are contradicted by the very terms Cedar Hollow signed. The result is that every roster sync is an unconsented disclosure of personally identifiable information from education records.

The fix is unremarkable and takes a week: amend the annual notice; execute a data-protection addendum that overrides the ToS, forbids secondary use and unilateral amendment, and requires deletion on termination; and log the disclosure. The vendor-diligence method is the same as for any software purchase — see Reviewing a Software License Agreement: A Practical Checklist and Anatomy of a Software License Agreement: A Comprehensive Guide. The structural analogy is exact to the HIPAA business-associate problem, treated in HIPAA in the Cloud: Business Associates, BAAs, and Protecting ePHI.

One more consequence with teeth: under 34 C.F.R. § 99.33(e), if the Department finds that a third party improperly redisclosed personally identifiable information, the school may not permit that party access to education records for at least five years. That is the sharpest edge in the entire FERPA toolbox, and it is aimed at the vendor.

Phase 9 — Other key exceptions

  • [ ] Other schools — disclosure to a school where the student seeks or intends to enroll, or is already enrolled, for purposes related to enrollment or transfer. § 99.31(a)(2); § 99.34. State in your annual notice that you forward records on request, or make a reasonable attempt to notify the parent.
  • [ ] Audit and evaluation — disclosure to authorized representatives of the Comptroller General, the Attorney General, the Secretary of Education, or state and local educational authorities, for audit or evaluation of federal- or state-supported education programs, or enforcement of federal legal requirements. § 99.31(a)(3); § 99.35. Requires a written agreement designating the authorized representative, specifying the purpose and the data, restricting use, and requiring destruction when no longer needed.
  • [ ] Financial aid — disclosure in connection with aid the student has applied for or received, to determine eligibility, amount, or conditions, or to enforce the terms. § 99.31(a)(4).
  • [ ] Studies — disclosure to organizations conducting studies for, or on behalf of, the school to develop or validate predictive tests, administer student aid, or improve instruction. § 99.31(a)(6). Requires a written agreement; PII may not be disclosed outside the organization's representatives; data must be destroyed when no longer needed.
  • [ ] Accrediting organizations carrying out accrediting functions. § 99.31(a)(7).
  • [ ] De-identified data — permitted after removal of all PII, with a reasonable determination that identity is not personally identifiable considering other reasonably available information. § 99.31(b). Apply small-cell suppression.
  • [ ] For each exception used, confirm you can name the subsection and produce the written agreement it requires.

Why it matters, and the traps. The studies exception is the one that gets abused. It authorizes a study conducted for or on behalf of the school, aimed at that school's instruction, aid administration, or test validation. It does not authorize a vendor to use a district's student data to train a general-purpose model it will sell to other districts, and calling that "improving instruction" does not make it so. If a vendor's research request would benefit the vendor's product line rather than your students, you are outside § 99.31(a)(6) and you need consent.

De-identification is likewise harder than it looks. A "de-identified" dataset with district, grade, race, and disability status can re-identify a single student in a small school. The § 99.31(b) standard is contextual — it asks what other information is reasonably available — which is the same re-identification analysis that governs commercial data releases. See The Privacy and Data Protection Toolkit: Building and Operating a Compliance Program.

Phase 10 — Health and safety emergencies

  • [ ] Confirm there is an articulable and significant threat to the health or safety of a student or other individuals. 34 C.F.R. § 99.36; 20 U.S.C. § 1232g(b)(1)(I).
  • [ ] Disclose only to appropriate parties, including parents, whose knowledge is actually necessary to protect against the threat.
  • [ ] Limit the disclosure to the period of the emergency. This is not a standing authorization.
  • [ ] Limit the content to what those parties need. A threat assessment does not open the whole file.
  • [ ] Record it. Under § 99.32(a)(5), you must record the articulable and significant threat that formed the basis of the disclosure and the parties to whom it was made.
  • [ ] Write the memo contemporaneously, in the fog, not three weeks later in the calm.

Why it matters, and the traps. The regulation was rewritten after Virginia Tech to stop schools from freezing. Section 99.36(c) tells you that the school may take the totality of the circumstances into account, and that if it makes a rational determination that an articulable and significant threat exists, the Department will not second-guess it based on information available at the time. That is real protection — but only if you documented the determination. An undocumented emergency disclosure is indistinguishable, on audit, from an unlawful one.

The failure mode runs both ways. Schools invoke the exception for "generalized concern" (a student seems sad) — that is not an articulable threat. And schools withhold in genuine emergencies because "FERPA won't let us," which is exactly the paralysis § 99.36 exists to prevent.

Phase 11 — Judicial orders and subpoenas

  • [ ] Distinguish a court order from a subpoena. Both are covered by § 99.31(a)(9), but they arrive with different pressure and different scope.
  • [ ] Before complying, make a reasonable effort to notify the parent or eligible student in advance, so they may seek protective action. § 99.31(a)(9)(ii).
  • [ ] Know the exceptions to the notice duty:
    • [ ] A federal grand jury subpoena, or any other subpoena issued for a law enforcement purpose, where the court or issuing agency has ordered that its existence or contents not be disclosed;
    • [ ] An ex parte order obtained under the counterterrorism provisions referenced in § 99.31(a)(9)(ii)(C), for which no notice — and no disclosure record — is required;
    • [ ] Proceedings in which the parent is a party to a child-abuse, neglect, or dependency matter and the order issued in that proceeding.
  • [ ] Where the school initiates legal action against a parent or student, or defends an action they initiated, it may disclose relevant records to the court without an order or subpoena. § 99.31(a)(9)(iii).
  • [ ] Object, narrow, and seek a protective order. Produce with redactions of other students' PII.
  • [ ] Log every disclosure made under this exception.
  • [ ] Preserve. A subpoena or a credible threat of litigation triggers a preservation duty independent of FERPA.

Why it matters, and the traps. FERPA is not a privilege, and saying "FERPA" to a court will not defeat a subpoena. What FERPA gives you is a procedure: notice to the family, an opportunity for them to move to quash, and a redaction obligation as to other students. Courts routinely order production of education records subject to a protective order, and a school that stonewalls on FERPA grounds alone can find itself sanctioned.

The reciprocal trap is over-compliance. A civil subpoena is not an order; it is a request backed by process, and the correct first move is to notify the family and evaluate objections — not to fax the file. Run the response through the general framework in Responding to a Government Subpoena or Investigation: A Practical Checklist, and stand up preservation immediately using Issuing a Litigation Hold and Preserving ESI: A Practical Checklist. Where the underlying dispute is a sexual-harassment matter, the FERPA analysis interlocks with the grievance process described in Responding to a Title IX Complaint: A Practical Checklist — bearing in mind that the Title IX regulations have been amended and re-litigated repeatedly and must be checked against their current text before you rely on any particular procedural requirement.

Phase 12 — Access and amendment rights, and the hearing

  • [ ] Provide access to inspect and review within a reasonable period, and in no case more than 45 days after the request. 34 C.F.R. § 99.10(b).
  • [ ] For students with disabilities, apply the shorter IDEA timelines: access before any IEP meeting or due process hearing, and never more than 45 days. 34 C.F.R. § 300.613.
  • [ ] Provide copies only where failure to do so would effectively prevent inspection — but you may always choose to provide them, and often should.
  • [ ] Charge no fee for search and retrieval, and no copying fee that would effectively prevent access. § 99.11.
  • [ ] Where a record contains information on more than one student, provide access only to the portion relating to the requesting student. Redact. § 99.12(a).
  • [ ] At postsecondary institutions, apply the § 99.12(b)-(c) limits: no right to parents' financial records; no right to confidential recommendations the student validly waived access to (the waiver must be voluntary and may not be required as a condition of admission or aid).
  • [ ] On an amendment request, decide within a reasonable time whether the record is inaccurate, misleading, or in violation of the student's privacy rights. § 99.20.
  • [ ] If you refuse, notify the family in writing of the refusal and of the right to a hearing. § 99.21(b).
  • [ ] Run the hearing to spec, § 99.22: reasonable advance notice of date, time, and place; a decisionmaker with no direct interest in the outcome; a full and fair opportunity to present evidence; the right to be assisted by a person of the family's choosing, including an attorney; and a written decision based solely on the evidence presented, with a summary of the evidence and the reasons.
  • [ ] If you still refuse to amend, inform the family of the right to place a statement in the record. Maintain that statement with the contested portion for as long as the record is kept, and disclose it whenever the contested portion is disclosed. § 99.21(b)(2), (c).

Why it matters, and the traps. The amendment right is about the accuracy of the record, not about the substantive correctness of the underlying decision. Courts have consistently held that FERPA's amendment procedure cannot be used to relitigate a grade or a disciplinary outcome. "You marked me down unfairly" is not a FERPA amendment claim; "the transcript says I received a D in a course I never took" is. Say this clearly and early, or you will hold hearings you should never have convened.

Two operational traps. First, the 45 days is an outer limit, not a target; a district that treats it as a target will be late the one time it matters. Second, the "no direct interest" requirement in § 99.22(c) disqualifies the person who made the contested entry and, usually, that person's direct supervisor. The mechanics of intaking, scoping, and logging a records request are near-identical to a consumer access request; the workflow in Responding to a Data Subject Access Request: A Practical Checklist transfers cleanly.

Phase 13 — Recordkeeping of disclosures

  • [ ] Maintain, with each student's education records, a record of each request for access and each disclosure of personally identifiable information. 34 C.F.R. § 99.32(a).
  • [ ] For each entry, capture the parties who requested or received the information and the legitimate interests they had in it.
  • [ ] Keep the disclosure record for as long as the education record itself is maintained.
  • [ ] Make the disclosure record available for inspection by the parent or eligible student — it is itself subject to the access right.
  • [ ] Know the exemptions. No record is required for disclosures: to the parent or eligible student; made with written consent; to a school official under § 99.31(a)(1); of directory information; or under a qualifying ex parte counterterrorism order. § 99.32(d).
  • [ ] Record the articulable and significant threat for every health-and-safety disclosure. § 99.32(a)(5).
  • [ ] Where you disclose on the understanding that the recipient may redisclose on your behalf, record the additional parties and their legitimate interests. § 99.32(b).
  • [ ] Audit the log annually against actual data flows. A log with no entries in a 9,000-student district is evidence of a broken process, not a clean one.

Why it matters, and the traps. The school-official exemption from logging is a genuine relief — you do not log every teacher's gradebook access — but it lulls districts into logging nothing at all. Subpoenas, transfers to other schools, health-and-safety disclosures, audit-and-evaluation releases, and studies-exception releases all require entries. When the Student Privacy Policy Office opens a complaint file, the disclosure log is the first thing it asks for, and its absence frames the entire investigation.

Phase 14 — Enforcement reality: no private right of action

  • [ ] Understand that FERPA confers no private right of action and creates no personal rights enforceable through 42 U.S.C. § 1983. Gonzaga University v. Doe, 536 U.S. 273 (2002).
  • [ ] Understand that the sole statutory remedy is administrative: the Secretary of Education may withhold federal funds. 20 U.S.C. § 1232g(f).
  • [ ] Route complaints to the Student Privacy Policy Office at the U.S. Department of Education, and know the timeliness rule: a complaint must generally be filed within 180 days of the violation, or of the date the complainant knew or reasonably should have known of it, subject to extension. 34 C.F.R. § 99.64(c).
  • [ ] Expect the realistic outcome: investigation, findings, a corrective action plan, and monitoring. Funding has never actually been terminated.
  • [ ] Do not conclude that FERPA is toothless. Plan for the real exposures:
    • [ ] The five-year redisclosure bar against an offending third party. § 99.33(e).
    • [ ] State student-privacy statutes, several of which carry attorney-general enforcement or private remedies.
    • [ ] Repackaged claims — negligence, breach of contract, invasion of privacy, and constitutional privacy claims.
    • [ ] Reputational and political consequences, which in a school district are the ones that actually bite.

Why it matters, and the traps. Gonzaga is the most consequential FERPA case ever decided, and it is widely misread. The Court held that FERPA's nondisclosure provisions are framed as directives to the Secretary about funding, phrased in aggregate terms ("policy or practice"), and therefore lack the individually focused, rights-creating language § 1983 requires. Doe — a former student whose teacher-certification affidavit was scuttled by an unconsented disclosure — won a substantial jury verdict and lost it on that ground.

The lesson for counsel is not "relax." It is that the compliance driver has shifted. FERPA sets a federal floor with weak enforcement; the sharp instruments are elsewhere — state edtech statutes, contract, and the breach-response regime. When student data is exposed, FERPA imposes no notification duty of its own; state breach-notification statutes and your vendor contract do. Build the incident plan on that footing: see Responding to a Data Breach: A Notification and Incident Response Checklist and Data Breach Notification Law: A Comprehensive Guide.

Phase 15 — Overlaps: IDEA, HIPAA, PPRA, COPPA, and state law

  • [ ] IDEA. For students with disabilities, apply the confidentiality regulations at 34 C.F.R. §§ 300.610-300.627, which incorporate FERPA and add to it: parental consent before disclosure to parties other than officials of participating agencies (§ 300.622), a list of the types and locations of records collected (§ 300.616), records of access (§ 300.614), and destruction of personally identifiable information when it is no longer needed, on notice to the parent (§ 300.624).
  • [ ] HIPAA. For most school health records at a FERPA-covered school, FERPA governs, not HIPAA — the HIPAA definition of protected health information at 45 C.F.R. § 160.103 expressly excludes FERPA education records and § 1232g(a)(4)(B)(iv) treatment records. Do not apply a business-associate framework to a school nurse's file. But confirm your own status: a school that is a HIPAA covered entity for some function (e.g., electronic Medicaid billing) may have HIPAA obligations elsewhere, and a private school outside FERPA has no FERPA exclusion to rely on. Compare HIPAA Compliance: A Practical Checklist.
  • [ ] PPRA. Under 20 U.S.C. § 1232h, obtain prior written parental consent before requiring a student to participate in an ED-funded survey revealing any of the eight protected areas (political beliefs; mental or psychological problems; sex behavior or attitudes; illegal, antisocial, self-incriminating, or demeaning behavior; critical appraisals of close family; privileged relationships with lawyers, physicians, or ministers; religious beliefs; and income). Separately, provide notice and opt-out rights for such surveys regardless of funding source, for collection or use of personal information for marketing, and for non-emergency invasive physical examinations. Adopt the policies in consultation with parents and notify annually.
  • [ ] COPPA. For online services directed to children under 13, the FTC's COPPA Rule (15 U.S.C. §§ 6501-6506; 16 C.F.R. Part 312) applies to the operator, independently of FERPA. The Rule has been amended in recent years — verify the current text before relying on the school-authorization pathway, the retention limits, or the separate-consent requirements. The FTC has brought enforcement actions against edtech providers.
  • [ ] State law — check yours. Many states now regulate student data far more aggressively than FERPA does, and they vary substantially. Representative examples: California's Student Online Personal Information Protection Act (Cal. Bus. & Prof. Code § 22584), which directly binds K-12 online operators and bans targeted advertising and sale of student data, and Cal. Educ. Code § 49073.1, which dictates required terms in district-vendor contracts; New York Education Law § 2-d and its implementing regulations, which impose a parents' bill of rights and vendor data-security requirements; and Illinois' Student Online Personal Protection Act, 105 ILCS 85. Do not assume any of these applies to you — confirm your own state's statute.

Why it matters, and the traps. The dominant error is treating FERPA as the ceiling. It is the floor, and in several states it is a low one. A district in California or New York that has satisfied FERPA may still be years out of compliance with its state edtech statute — which, unlike FERPA, may reach the vendor directly and may carry an enforcement mechanism that actually functions.

The second error is applying the wrong statute to school health data. The instinct to reach for HIPAA is strong and usually wrong. Get the FERPA/HIPAA boundary right once, in writing, and hand it to the nursing staff.

Common mistakes to avoid

  1. Relying on the school-official exception without the annual-notice criteria. If your notice does not define "school official" and "legitimate educational interest," § 99.31(a)(1) is not available to you — full stop. § 99.7(a)(3)(iii).
  2. Clickwrap edtech. A teacher accepting a free app's terms of service has not established direct control, and the app is not a school official.
  3. Assuming the vendor owes you a FERPA duty. It does not. FERPA regulates the school. Your only lever is the contract.
  4. Publishing directory information you never designated, or publishing it about a family that opted out — including on the yearbook vendor's platform.
  5. Denying a noncustodial parent access without a court order specifically revoking FERPA rights. § 99.4.
  6. Treating a subpoena as an order. Notify the family first; object, narrow, and seek protection. § 99.31(a)(9)(ii).
  7. Using FERPA as a privilege. It is a procedure, not a shield, and courts know it.
  8. Undocumented health-and-safety disclosures. § 99.36 protects a rational determination — but only one you recorded. § 99.32(a)(5).
  9. Believing "sole possession" covers a counselor's notes after she shares them with anyone.
  10. Laundering education records through the school resource officer. The law-enforcement-unit exclusion covers records the unit created, not copies it received.
  11. Convening an amendment hearing to relitigate a grade. The right goes to the accuracy of the record, not the merits of the decision.
  12. Stretching the studies exception to cover a vendor's product development or model training. § 99.31(a)(6) requires a study for or on behalf of your school.
  13. Assuming FERPA requires breach notification. It does not. State law and your contract do.
  14. Treating FERPA as the ceiling rather than the floor beneath your state's student-privacy statute.
  15. An empty disclosure log. In a real district, that is evidence of a broken process, not a clean one.

The consolidated FERPA checklist

Foundations

  • [ ] Coverage confirmed (ED funds / Title IV) and a named FERPA owner.
  • [ ] Data map complete across SIS, LMS, health, discipline, athletics, transportation, and IT.
  • [ ] Education-record classification applied, with the sole-possession, law-enforcement-unit, employment, and treatment exclusions correctly scoped.

Notices

  • [ ] Annual notification issued, covering all four rights plus the procedures plus the school-official and legitimate-educational-interest criteria, expressly including contractors.
  • [ ] Directory-information categories designated, public notice given, opt-out mechanism live and propagating to every publication channel.
  • [ ] Separate military-recruiter opt-out handled.

Rights

  • [ ] Eligible-student flag flips at 18 or postsecondary enrollment.
  • [ ] Both parents given access absent a specific revoking order.
  • [ ] Access provided within 45 days (sooner under IDEA), with multi-student redaction.
  • [ ] Amendment procedure, § 99.22-compliant hearing, and right-to-statement all documented.

Disclosure control

  • [ ] Consent form contains all four § 99.30(b) elements; no blanket consents.
  • [ ] Role-based access controls in the SIS; audit logging on and reviewed.
  • [ ] Every vendor under a data-protection addendum: purpose limitation, no secondary use or model training, no redisclosure, deletion on termination, security, incident notice, audit rights, no unilateral amendment.
  • [ ] Single approval gate for all edtech, including free tools.
  • [ ] Written agreements in place for audit/evaluation (§ 99.35) and studies (§ 99.31(a)(6)) disclosures.
  • [ ] Subpoena protocol: notify, object, narrow, redact, protective order, log.
  • [ ] Health-and-safety protocol: articulable threat, need-to-know recipients, contemporaneous memo.

Records and program

  • [ ] Disclosure log maintained, populated, and inspectable.
  • [ ] Annual training for staff, and role-specific training for registrar, counseling, and IT.
  • [ ] Incident-response plan built on state breach law and contract, not on FERPA.
  • [ ] State student-privacy statute identified and mapped against the federal floor — and re-checked, because it has probably changed.
  • [ ] Annual program review; findings tracked to closure.

Primary authority

Statutes

Regulations

  • 34 C.F.R. Part 99 (FERPA regulations), including: § 99.1 (applicability); § 99.3 (definitions — "education record," "directory information," "eligible student," "personally identifiable information"); § 99.4 (rights of parents); § 99.5 (transfer of rights); §§ 99.7 (annual notification); 99.8 (law enforcement unit records); 99.10-99.12 (inspection and review); 99.20-99.22 (amendment and hearing); 99.30 (consent); 99.31 (exceptions to consent); 99.32 (record of disclosures); 99.33 (limits on redisclosure); 99.34 (other schools); 99.35 (audit and evaluation); 99.36 (health or safety emergency); 99.37 (directory information); 99.60-99.67 (enforcement)
  • IDEA confidentiality regulations, 34 C.F.R. §§ 300.610-300.627
  • HIPAA definitions, 45 C.F.R. § 160.103 (excluding FERPA education records and treatment records from "protected health information")
  • COPPA Rule, 16 C.F.R. Part 312

Cases

Representative state statutes — illustrative only; these do not state a national rule, and you must confirm your own state's law

  • Cal. Bus. & Prof. Code § 22584 (Student Online Personal Information Protection Act)
  • Cal. Educ. Code § 49073.1 (required terms in district-vendor contracts)
  • N.Y. Educ. Law § 2-d (student data privacy and security)
  • 105 ILCS 85 (Illinois Student Online Personal Protection Act)

Secondary and interpretive sources

  • U.S. Department of Education, Student Privacy Policy Office — FERPA guidance and technical assistance for schools and districts. This material is interpretive and persuasive, not binding, and it is revised; cite the statute and the regulation, and use the guidance to understand how the Department reads them.
  • Title IX implementing regulations, 34 C.F.R. Part 106 — relevant where a records question arises inside a grievance process. Amended and litigated repeatedly; confirm the currently operative text before relying on it.

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This checklist is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Laws vary by state and change over time; verify current requirements and consult qualified counsel before acting.