On Dec. 9, 2008, the U.S. Department of Education published final regulations to amend its current rules implementing the Family Educational Rights and Privacy Act (FERPA). FERPA protects educational records held by public and private educational agencies and institutions ("Schools") receiving funds from the Department of Education. The new regulations clarify when, how and to whom a School may provide educational records and provide a path by which Schools and School service providers can safely and appropriately safeguard and disclose records directly related to students that are maintained by the School or its agents. The revised regulations go into effect on Jan. 8, 2009.
Largely inspired by the Virginia Tech shootings of April 2007, the regulations provide that a School may disclose the personally identifiable information of a student to any person whose knowledge is necessary to protect the health or safety of that student or others. Schools must determine whether, based on the totality of the circumstances, there is an "articulable and significant threat to the health or safety of a student or other individual." Under the previous regulations, disclosure was only authorized in a "health or safety emergency." The School was required to interpret narrowly what constituted a health or safety emergency, however. Under the new regulations, so long as the School has a rational basis for its decision, the Department of Education will not question the decision.
The new regulations specifically include the student's parents as parties whose knowledge of a particular situation may be necessary to protect the health or safety of the student or others, even if the student is over the age of 18. Additionally, the regulations clarify that even though all of the rights and permissions required under the statute transfer from the parent to the student when the student turns 18, a parent may still be permitted access to any and all of a student's educational records if the student is a dependent of the parent for tax purposes.
The new regulation states that a School may outsource services and provide accompanying educational records to the outside party where the School maintains direct control over the outside provider. The analysis of comments and changes issued with the final rule, while not requiring specific ways to maintain this control, suggests that Schools have the responsibility to ensure that outside providers "do not maintain, use, or redisclose education records except as directed by the agency or institution that disclosed the information." The comments continue to elaborate that although specific agreements are not required, "one way in which schools can ensure that parties understand their responsibilities under FERPA with respect to education records is to clearly describe those responsibilities in a written agreement or contract."
The new final rule is available at this link.
The former regulations are available at this link.
The text of FERPA is available at this link.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
