This blog is the first in a series about how schools can practically apply FERPA.
The Family Educational Rights and Privacy Act (FERPA) grants parents and eligible students the right to inspect and review education records and to receive an explanation or interpretation of those records. To fulfill these rights, schools are obligated to follow a fair process. Specifically, schools must
- Give parents and eligible students the opportunity to inspect and review the students’ education records;
- Comply with requests for access to records not more than 45 days after receiving the request;
- Respond to reasonable requests for explanations and interpretations of education records.
Depending on the frequency and type of requests received, schools may not need to do anything further. After all, 45 days is sufficient to handle most requests. Still, that time period can create a false sense of security for schools given that simple, routine requests will not prove challenging, but more complicated requests may be time-consuming. The following 11 best practices can help schools prepare for even the most complex data access issues:
1. Know which records FERPA covers. FERPA covers education records that meet two criteria: they must relate directly to a student (which means that the student is the focus of the record) and be maintained by the school. This means that FERPA covers records that may not appear to be educational, such as student health or behavioral records, and parents have the right to inspect and review them. FERPA lists only a few types of records that are exceptions: records to be used as memory aids and kept in the sole possession of their maker, records created by the district’s designated law enforcement unit, some student-employee records, records created about students after they no longer attend the school, and peer-graded assignments before they are recorded by the teacher.
2. Be prepared to provide reasonable explanations. Even if schools provide access to a record, a parent may not understand every element of the record (such as a student growth percentile) or how the record will be used. Furthermore, student data has become increasingly complex. Consider the following examples:
- Data specifications may be complicated to read because they must account for numerous outcomes (e.g., see the many exit codes that a school may use to document students who no longer attend).
- Definitions in the data may not meet families’ expectations; for example, families that do not consider themselves homeless may nonetheless be defined as such given that the definition of “homeless” in the McKinney-Vento Homeless Assistance Act includes more situations than simply living on the street.
For these and other cases, parents may need help understanding and interpreting the record. FERPA specifies that schools are required to offer this service; it is not simply a courtesy. Therefore, schools should be prepared to respond to reasonable requests for explanations and interpretations of records.
3. Set reminders. Schools that do not handle a request immediately should create a reminder to ensure they do not miss the 45-day deadline (schools should also double-check their state laws since some states require a shorter time frame). This reminder could be scheduled in email, or if schools receive many requests, they could use a spreadsheet to track requests and their deadlines. Once the deadline has passed, parents have the right to file a complaint with the US Department of Education.
4. Know when schools can charge fees. Depending on the record request (some records may be hundreds or thousands of pages), allowing a parent access to or a copy of certain kinds of records may be both time- and cost-intensive. As the Nevada Department of Education learned when they attempted to charge a parent over $10,000 simply to see records, FERPA has specific rules regarding when schools may charge fees for access or copies. In general, schools may charge only for the costs of making a copy of the record and only if it would not prohibit the parent from obtaining access to the record. To determine this, the US Department of Education generally considers whether the requesting individual lives within commuting distance; if they do not live within commuting distance, then schools may not charge a fee for the copy. Furthermore, if schools are allowed to charge a fee, it must cover only the cost of the copy, not costs incurred as part of search and retrieval.
5. Know how to handle records that involve multiple students. Schools sometimes maintain records that directly relate to multiple students. In general, parents have the right to review only records of their own child, not others. This issue occurs particularly with surveillance video in which multiple students may be recorded.
- Does the video directly relate to a student? Just because a video or picture mentions or shows a student does not mean the record directly relates to them. Guidance from the US Department of Education states that the student must be the focus of the video, such as a video depicting the student committing a crime or a video that may be used for disciplinary action. If students are simply in the video incidentally (e.g., they’re in the audience of a recording of a band concert or happened to be in the hallway when a fight broke out), then the video likely is not part of their education record.
- Can information be redacted without changing the meaning? If a video record directly relates to more than one student, the school should attempt to redact or segregate portions of the video that contain images of the other student, before allowing a parent access; however, guidance from the US Department of Education states that if the redaction cannot be reasonably accomplished or if doing so would destroy the meaning of the record, then parents will have to be given access to the entire record even though other students are visible. For a more detailed analysis of this issue, see Letter to Wachter.
6. Inventory school locations where all education records are held. When FERPA was originally passed in 1974, student education records were generally kept in a folder in a filing cabinet. Recent technology has made it more likely that records are kept in multiple locations. Requests for access can be simplified if schools create a comprehensive list of where the records are and who manages them. For example, which records do teachers keep in classrooms? Which records does the registrar keep in the office? Which records are kept in student information systems? In the cloud? Many of these records will be easy to find (such as those kept in a student’s cumulative folder), but others may fall into a grey area (e.g., student emails, metadata). In these cases, schools should review their state’s record retention laws to see whether these materials are considered records, and consult with their legal counsel to make a determination.
7. Make as much information as possible available to parents. FERPA requires schools, at minimum, to annually notify parents of their right to inspect and review records, but the more information schools provide up front, the fewer record requests they will receive. For example, schools can use their district website to proactively inform parents about the school’s data usage policies (Denver Public Schools and Cambridge Public Schools provide excellent examples). Furthermore, if schools receive frequent requests for certain records that are not available to parents online, the schools can make those records readily available. For example, if schools can program their student information systems to allow parents access to grades and other data about their child, the schools can then direct parents to access the records there, saving the time it would otherwise take to find the records.
8. Have clear policies about who has the right to access records. FERPA defines “parent” as natural parents, a guardian, or an individual acting in the absence of a parent or guardian. In general, schools should ensure that any adult responsible for the daily care of students––such as stepparents, grandparents, and caregivers––has access to their child’s records. For parents who get divorced or lose custody, FERPA requires that schools allow both parents to have access unless there is a court order, state law, or other legally binding document that revokes a noncustodial parent’s FERPA rights.
9. Destroy records that are no longer needed. FERPA does not require schools to retain records that are no longer needed or to provide access to records that have been destroyed, except for records that are part of a pending request for access. Yet, before getting out the shredder, schools should note that their state laws may have record retention requirements, and other federal laws such as the Individuals with Disabilities Education Act (IDEA) require notification before certain records are destroyed. If schools no longer have an administrative need to keep a record and state law allows it to be destroyed, the schools should destroy the record. This can also save time since the school has no obligation to provide access to records that have been destroyed.
10. Make sure third-party contractors are on board. If schools use FERPA’s school official exception to share student data with contractors, those contractors must also comply with the right to review and inspect student records. A significant conflict arises when teachers share student data with educational websites or applications whose terms of service do not allow this right to review and inspection. If a website refuses to grant schools this access, then schools will be unable to allow parents to inspect and review the records. In this case, schools will need to ask vendors to comply or stop using their services.
11. Know the school’s responsibilities if a parent requests all of a student’s records. Privacy-minded parents may request that the school give them every record about a student. Schools should do their best to comply with such blanket requests. Parents sometimes follow this request with a complaint that the school did not give all the records, but parents do not always specify which ones are missing. In these cases, work with parents to try and identify which records they believe are missing. It helps to remember that FERPA does not require schools to create or maintain any records, and schools are allowed to destroy records in accordance with their state records laws as long as the records are not part of a pending records request.
Remember that behind any request to inspect and review records––even those that feel like a nuisance––is a parent who cares deeply about their child’s education and wants to know more. Schools should review their obligations under the law and do their best to view parents as partners in students’ success.
David Sallay is the Student Data Privacy Auditor for the Utah State Board of Education and a contractor with FPF. Amelia Vance is the Director of Education Privacy at FPF.
