FERPA AND CAMPUS SAFETY
Campus safety is a top priority for colleges and universities. Sometimes a student’s
statements or behaviors raise concerns about the safety of the student or others. To prevent
harm from occurring, college administrators, faculty, and staff who are aware of such statements
or behaviors may want to tell someone else – another campus employee, a parent, an outside
health care professional, or a law enforcement officer about their concern. But they do not
know exactly who to tell. And they often fear that the Family Educational Rights and Privacy
Act (“FERPA”) ,
the federal statute that governs disclosure of student records and information, limits those
with whom they may share information found in the student’s records. Therefore, they
unnecessarily and unwisely conclude that the safest course is simply telling no one or saying
Misunderstandings about FERPA generate a lot of concern about the propriety of communicating
critical information in an emergency. The information in this NACUANOTE demonstrates that FERPA
is not an obstacle to appropriate and desirable cautionary communications intended to protect
student, campus, or public safety. While emergency situations are not governed solely by FERPA,
and other state or federal laws beyond the scope of this NACUANOTE may impose additional legal
restrictions, preventing harm to individuals should take precedence.
Question: What does FERPA restrict?
Answer: FERPA limits the disclosure of information from student “education
records,” a term that the law defines quite broadly and that is not limited
to “academic” records.
“Education records” include virtually all records maintained by an educational
institution, in any format, that are “directly related” to one or more
of its past or present students . A
record is “directly related” to a student if it is “personally
identifiable” to the student . A
record is “personally identifiable” to a student if it expressly identifies
the student on its face by name, address, ID number, or other such common identifier.
A record is also personally identifiable if it includes “other information
that, alone or in combination, is linked or linkable to a specific student that would
allow a reasonable person in the school community, who does not have personal knowledge
of the relevant circumstances, to identify the student with reasonable certainty” – in
other words, if it contains enough demographic or other information that it points
to a single student . For
example, a disciplinary record about an unnamed male student likely would not, without
more, be personally identifiable, but a disciplinary record about an unnamed male
sophomore political science major who lives in Smith Hall, plays on the soccer team,
and is a resident of Wyoming likely would "name" the particular student.
A record may also be "personally identifiable" because of commonly known
information external to the record. For example, a request to provide information
about all university sanctions imposed for cheating in the past five years might
include a large enough number of instances not to identify any of the students. On
the other hand, a request to provide information about sanctions imposed against
student athletes for cheating in the past two weeks, at a time when a well-known
student athlete suddenly is not playing or practicing with the team, would be a request
seeking personally identifiable information in that context because it could be used
to confirm or deny rumors regarding the reason for the student’s absence.
Despite the name "education records," there is no requirement that a record
be "educational" or "academic" in nature to qualify. Moreover,
the defintition of “education records” does not give institutions
any discretion to determine for themselves what is or isn’t an “education
record” or to "treat" certain records as non-education records,
even though they meet the statutory definition. Thus, “education records” include
not only registrar’s office records, transcripts, papers, exams and the like,
but also non-academic student information database systems ,
class schedules ,
financial aid records ,
financial account records ,
disability accommodation records ,
disciplinary records ,
and even “unofficial” files, photographs, e-mail messages ,
hand-scrawled Post-it notes, and records that are publicly available elsewhere  or
that the student herself has publicly disclosed .
When may information from education records be disclosed?
Answer: In general, information derived from a student’s education
records may be disclosed only if: (1) it is “directory information;” (2)
the student has consented to the disclosure; or (3) the law provides an exception
that permits disclosure without the student’s consent.
Question: What is "directory
Answer: FERPA allows institutions to designate certain classes of information
as “directory information” that may be released to anyone without
a student’s consent . Directory
information may (but is not required to) include such items as the student’s
name, address (local, permanent, and e-mail), telephone number (local and permanent),
photograph, dates of attendance at the institution, major, degrees and awards
received, participation in officially recognized activities and sports, and date
and place of birth, as well as other information “that would not generally
be considered harmful or an invasion of privacy if disclosed .” A
student’s social security number or any student identification number that
could be used by itself, without a password, PIN, or other authenticating factor,
to access educational records may not be designated as directory information . An
institution that wishes to make directory information available must first give
its students an opportunity to “opt out” and block the release of
their own directory information, usually by making a formal request to the institution’s
registrar’s office . Even
if a student has chosen to block the release of directory information, the institution
may nevertheless continue to disclose that student’s directory information
under any other exception that may be applicable or with the student’s
May information from student education records be shared with others on campus?
Answer: Yes. Under one of FERPA’s many exceptions to the general
prohibition against disclosure, campus personnel are free to share information
from student education records with other “school officials” who
have “legitimate educational interests” in the information .
Each institution must define for itself who qualifies as a “school official” and
what is a “legitimate educational interest” and give annual notice
of its definitions to its students .
These definitions can be quite broad – “school officials” need
not be limited to “officers,” or even to employees ,
and “legitimate educational interests” (much like “education
records”) need not be limited either to “academic” interests
or to instances that are beneficial to the student. The Family Policy Compliance
Office (“FPCO”) ,
the office within the U.S. Department of Education charged with overseeing and
enforcing FERPA, offers the following model definitions:
A school official is a person employed by the University in an administrative,
supervisory, academic or research, or support staff position (including law enforcement
unit personnel and health staff); a person or company with whom the University
has contracted as its agent to provide a service instead of using University employees
or officials (such as an attorney, auditor, or collection agent); a person serving
on the Board of Trustees; or a student serving on an official committee, such as
a disciplinary or grievance committee, or assisting another school official in
performing his or her tasks.
A school official has a legitimate educational interest if the official needs to
review an education record in order to fulfill his or her professional responsibilities
for the University .
At institutions that follow these or similar models, an employee concerned that
a student’s statements or behavior evidence a potential threat could – and
should – share relevant information with the dean of students, the judicial
affairs office, the campus counseling center, the campus law enforcement unit,
or other appropriate “school officials” whose job it is to deal with
May information from a student’s education records be disclosed
to protect health or safety?
Answer: Yes. FERPA permits the disclosure of information from student
education records “to appropriate parties, including parents..., in connection
with an emergency if knowledge of the information is necessary to protect the
health or safety of the student or other individuals .” For
example, if a student sends an e-mail to his resident assistant saying that he
has just been diagnosed with a highly contagious disease such as measles, the
institution could alert the student’s roommate, and perhaps others with
whom the student has come in close contact, to urge them to seek appropriate
testing and medical care . Safety
concerns warranting disclosure could include a student’s statements about
suicide, unusually erratic and angry behaviors, or similar conduct that others
would reasonably see as posing a risk of serious harm .
This exception does not authorize “knee-jerk” or (in most cases) “broadcast” disclosures ,
but an institution need not be absolutely certain that there is an imminent crisis
before invoking the exception. Rather, it is enough that, based on the totality
of circumstances and on the basis of the facts that are available at the time,
there is a rational basis for concluding that there is a threat to health or safety.
As long as an institution can meet this relatively minimal threshold, "the
Department will not substitute its judgment for that of the....institution in evaluating
the circumstances and making its determination." 
The institution has the same good faith discretion to determine to whom disclosure
should be made. In general, and when reasonably possible, the initial disclosure
should be made to professionals trained to evaluate and handle such emergencies,
such as campus mental health or law enforcement personnel, who can then determine
whether further and broader disclosures are appropriate. Depending on the particular
circumstances, disclosure under this exception may be made to law enforcement,
parents, threat assessment teams or professionals, individuals who may have information
necessary to determine the extent of a potential threat (such as friends, roommates,
and prior schools attended), and potential victims and their families. If the concerns
are of a more urgent nature, school officials should immediately contact campus
or local police. FERPA permits each of these communications.
An institution that makes a disclosure on the basis of this exception must keep
a record of the nature of the perceived threat and the parties to whom the disclosure
was made .
When may a college or university disclose information from a student’s
education records to the student’s parent or legal guardian?
Answer: Once a student is in attendance at a postsecondary institution,
all rights provided by FERPA rest with the student, even if the student is younger
than 18 years old .
Education record information may therefore be disclosed to the parent of a college
or university student only with the student’s consent or in instances in
which one of the exceptions to FERPA permits disclosure. In addition to the other
exceptions discussed in this Note, two such exceptions specifically address communications
First, FERPA permits (but does not require) disclosures of any or all education
record information to a student’s parents if the student is their dependent
for federal tax purposes .
To rely on this exception, the institution must verify the student’s dependent
status, normally either by asking the student for confirmation  or
by asking the parents for a copy of the relevant portion of their most recent tax
Second, an institution may (but again is not required to) provide information to
a parent or legal guardian regarding any violation of law or of an institutional
rule or policy governing the use or possession of alcohol or a controlled substance,
if the institution has determined that the student committed a disciplinary violation
with respect to such use or possession and the student is under the age of 21 at
the time of both the violation and the disclosure .
These exceptions, like the other FERPA exceptions, are independent of each other.
Thus, an institution may notify parents about a 19-year-old student’s underage
drinking violations even if the student is not their tax dependent, and may likewise
notify the parents of a 22-year-old student’s drug violations if the student
is their tax dependent. Similarly, the situation need not rise to the level of
a health or safety emergency in order for either of these exceptions to apply.
What about disclosing information from the student discipline process, either
to others on campus or to other institutions?
Answer: FERPA expressly permits institutions to include in a student’s
education records appropriate information concerning disciplinary action taken
against the student for conduct that posed a significant risk to the safety or
well being of that student, other students, or other members of the community . Such
information may be disclosed to any “school officials” who have “legitimate
educational interests” in the behavior of the student, and it also may
be disclosed as appropriate under the health and safety emergency exception.
FERPA also expressly provides that, for purposes of the health and safety emergency
exception, the “appropriate parties” to whom disclosure may be made
include teachers and officials at other institutions who have legitimate educational
interests in the behavior of the student .
In a separate (and again independent) exception, FERPA further permits institutions
to disclose to anyone the final results of a disciplinary proceeding conducted
against a student who is an alleged perpetrator of a crime of violence or a nonforcible
sex offense ,
if the institution determines as a result of that disciplinary proceeding that
the student committed a violation of the institution’s own rules or policies
with respect to such crime or offense. Yet another exception permits institutions
to disclose the final results of such a proceeding to the victim regardless of
whether the alleged perpetrator was found to be in violation of the institution’s
rules or policies . For
purposes of these two exceptions, “final results” is limited to the
name of the student who is an alleged perpetrator of a crime of violence, the violation
found to have been committed, and any sanction imposed against the student by the
Are there other circumstances in which a college or university may
disclose information from student education records to another institution
without the student’s consent?
Answer: In addition to the exceptions discussed above, FERPA expressly
permits (but does not require) the disclosure of information from a student's
education records to officials of other institutions at which the student seeks
or intends to enroll or where the student is already enrolled, so long as the
disclosure is related to the student’s enrollment or transfer . To
take advantage of this exception, the institution must either inform its students
generally, in its annual FERPA notice, of its practice of doing so ,
or make a reasonable attempt to notify the individual student that it has done
In either case, upon request, the institution also must provide the student with
a copy of the disclosed records and give the student an opportunity for a hearing
to challenge the content of the disclosed records .
Can a college or university get information such as disciplinary or
mental health records from a student’s high school records?
Answer: Yes. Colleges and universities have several options for obtaining
information from a student’s high school records. They can ask students
to consent to the disclosure of those records. Consent by the student would permit
the high school to disclose the information. In addition, the college or university
may ask the high school to disclose the student’s records under an applicable
FERPA exception, including the exception that expressly permits the disclosure
of information from a student's education records to officials of other institutions
at which the student seeks or intends to enroll or where the student is already
enrolled, so long as the disclosure is related to the student’s enrollment
or transfer. Again, the prior institution may, but is not required by FERPA to,
disclose information. The requirements of this exception are discussed more fully
in the preceding question. A prior institution may also rely on the current institution's
determination that there is a health or safety emergency and may disclose relevant
information to the current institution under that exception . State
law may provide additional options for access to these records. For example,
under Virginia law (Virginia Code Annotated § 23-2.1:3), colleges and universities “…may
require that any student accepted to and who has committed to attend, or is attending,
such institution provide, to the extent available, from the originating school
a complete student record, including any mental health records held by the school.
These records shall be kept confidential as required by state and federal law…” Finally,
in appropriate circumstances, high school records may be obtained by a subpoena
or court order.
The disclosure and protection of mental health records may also be subject to medical
record privacy laws. The institution seeking these records should ensure that the
records will be maintained with an appropriate level of confidentially once received
to avoid misuse of the record or stigmatization of the student. Before considering
a blanket requirement for the high school mental health and disciplinary records
of all accepted or attending students, the college or university should be confident
that it has adequate resources for the review of all of those records, and an appropriate
protocol for responding to their contents and, as appropriate, permitting the affected
students to respond.
Is the disclosure of campus law enforcement unit records restricted by FERPA?
Answer: No. Records that are created by the campus law enforcement unit
(whether commissioned police or non-commissioned security) at least in part for
a law enforcement purpose are not “education records” and, at least
as far as FERPA is concerned, may be shared freely with anyone the institution,
in its discretion, deems appropriate . For
example, FERPA would not prevent a campus law enforcement unit from disclosing
to external law enforcement agencies an incident report concerning the unit’s
response to a student’s threatening statements or behavior. However, any
copies of that report that are shared with other campus offices would become
subject to FERPA, though the original in the law enforcement unit would continue
not to be . Moreover,
any student education records that other campus offices share with the campus
law enforcement unit, as “school officials” with a “legitimate
educational interest,” remain subject to FERPA even in the hands of that
What if the institution receives a court order or subpoena requesting student
Answer: The institution may disclose records in response to a judicial
order or lawfully issued subpoena but generally must notify the student of the
order or subpoena before complying . An
exception to this general rule is that a federal grand jury subpoena or other
subpoena issued for a law enforcement purpose may instruct the institution not
to notify the student .
May an employee disclose personal knowledge and impressions about
a student, based on the employee’s personal interactions with the student?
Answer: Yes. FERPA’s disclosure restrictions apply only to information
derived from student education records, not to personal knowledge derived from
direct, personal experience with a student . For
example, a faculty or staff member who personally observes a student engaging
in erratic and threatening behavior is not prohibited by FERPA from disclosing
that observation. (If at some point the employee describes the observation in
a personally identifiable record, that record would be subject to FERPA protections.
The employee would still be permitted to disclose the personal observation but
would not be permitted to disclose the record of the observation unless one of
the exceptions to FERPA applied or the student consented to the disclosure).
Again, however, the employee generally should limit disclosure of such information
to professionals trained to evaluate and manage it, as other privacy laws conceivably
could apply and prohibit broader disclosures, depending upon the circumstances.
Question: What other laws
protect student privacy?
Answer: Students may have additional privacy rights under state privacy
and confidentiality laws and under federal laws. The Department of Health and
Human Services and the Department of Education have issued joint guidance on
the application of FERPA and the Health Insurance Portability and Accountability
Act (“HIPAA”)  to
student health records. This joint guidance confirms that the HIPAA privacy rule
expressly excludes student health records maintained by colleges and universities . Moreover,
certain professionals on campus, such as medical and mental health care providers,
may be bound by professional obligations of confidentiality that require a higher
burden to be met (such as a significant threat of serious and imminent harm to
a specifically foreseeable victim) before disclosure of information in their
possession may be made. Even when this is the case, however, other personnel
on campus (such as a faculty member, dean of students, or residential life employee)
may disclose information about a student under the lower FERPA health and safety
emergency standard if the circumstances warrant.
Question: What happens if
I violate FERPA?
Answer: If an institution regularly violates FERPA, it runs the risk
of losing its education-related federal funding. While thus far, the Family Policy
Compliance Office (FPCO) has not revoked any institution’s funding, it
works with these institutions to get them to comply with the statute voluntarily.
FERPA does not give individuals the right to sue non-compliant institutions. But
sometimes the unauthorized disclosure of private information violates other laws,
such as state medical confidentiality or privacy laws, which allow individuals
to sue. Faculty and employees should consult campus counsel with questions about
disclosing information in student records.
In the event of an emergency or serious concern about either campus safety or an
individual’s welfare, FERPA permits campus personnel to consult appropriate
persons, including parents, if the information conveyed is necessary to protect
the health or safety of the student or others. Any ambiguity about FERPA should
be resolved in favor of disclosure, limited as necessary, to protect the safety
What should a faculty member or other college or university employee do if
he or she is concerned about a student?
Answer: If the concern is that a student may engage
in violent behavior, toward self or others, and the threat appears to be imminent,
the employee should contact the campus police or security office immediately.
If the concern is of a less urgent nature, or the employee is not quite sure
what to make of a student's comments or conduct, the employee should consult
with professionals on campus or associated with the institution, such as the
Dean of Students, a campus counseling center, or law enforcement, who may be
able to assess the potential threat, identify resources for the student, and
provide information that could assist in deciding on an appropriate course of
action. In consultation with appropriate campus resources, a collective decision
may then be made to contact a family member, an appropriate off-campus resource,
FERPA would not present an obstacle to any of these disclosures. The worst response
is to ignore troubling or threatening behavior. School officials should trust their
instincts when a student appears to be in trouble and should consult with others
FERPA is not a serious impediment to the sharing of student information among campus officials or appropriate third parties when there is a legitimate concern relating to campus safety. Institutions may wish to review certain aspects of their current FERPA policies (such as what they include within the scope of “directory information,” who they include as “school officials,” and what they consider “legitimate educational interests”) in order to gain maximum flexibility and discretion for information sharing. As important as maintaining current policies is the need to educate those on campus about the true limits and applications of FERPA. Finally, in the case of an emergency or serious threat to personal safety, any ambiguity about FERPA can – and should – be resolved in favor of protecting the safety of individuals.
Nancy E. Tribbensee
Steven J. McDonald
Journal of College and University Law Articles
Fundamentals of Fundamental FERPA,” by Steven J. McDonald. 2009 NACUA Annual
Privacy: From Facebook to FERPA,” by Phyllis Karasov, Steven J. McDonald, and
Margaret L. O'Donnell. 2006 NACUA Annual Conference Outline.
Discipline: FERPA, Mental Health, Computers and Civility,” by Nancy E. Tribbensee.
2006 NACUA Annual Conference Outline.
Family Educational Rights and Privacy Act,” by Nancy S. Footer. 2004 NACUA Annual
Enforcement and College and University Computers,” by Stephanie J. Gold. 2003
NACUA November CLE Workshop Outline.
to Students in Crisis: Duty to Warn of Potential Harm to Others, Duty to Protect Against
Harm to Self, Duty to Prevent Suicide: Counseling Records – FERPA, HIPAA,
Confidentiality,” by Nancy J. Joyer and Kris Kaplan. 2003 NACUA Annual Conference
Records in the Digital Age: Issues of Security, Privacy, and Maintenance,” by
Susan McKinney and Tina M.R. Falkner. 2003 NACUA Annual Conference Outline.
New Issues for Our Old Friend,” by Steven J. McDonald and Barbara L. Shiels. 2002
NACUA Annual Conference Outline.
Statutes and Regulations:
U.S. Department of Education Resources:
- Family Policy Compliance Office (FPCO)
- Letter to Richard
J. Gaumer, Webber, Gaumer & Emanuel, P.C., January 31, 2007.
- Disclosure of
Anonymous Data Under FERPA, (letter to Matthew J. Pepper, Tennessee Department of Education,
November 18, 2004).
- Disclosure of
Information Making Student’s Identity Easily Traceable (letter to Robin Parker,
Miami University, October 19, 2004).
- Disclosure of
Education Records to Texas Office of Attorney General (letter to School District in Texas,
April 6, 2006).
Access to Education Record Systems (letter to B. Alan McGraw, Altizer, Walk & White,
October 7, 2005).
- Letter to Diane
Layton, Shelton State Community College, August 7, 1998.
- Open Records
Request (letter to Corlis P. Cummings, Board of Regents of the University System of Georgia,
- Disclosure of
Education Records to Legislative Audit Division (letter to Ardith Lynch, University of
Alaska, May 23, 2005).
- Disability Office
Records (letter to David Cope, University of North Alabama, November 2, 2004).
to Attorney for School District, October 31, 2003.
- Disclosure of
Information About Juvenile Registered Sex Offenders (letter to W. Joseph Hatley, Lathrop & Gage,
March 8, 2005).
- Letter to Dr.
Hunter Rawlings III, Cornell University, February 28, 2000.
- Status of education
records and transcripts from public due process hearings (letter to Jerome D. Schad,
Hudgson Russ, LLP, December 23, 2004).
- Disclosure of
Education Records to Outside Service Providers (letter to Jeanne-Marie Pochert, Clark
County School District Legal Department, June 28, 2006).
of Immunization Records (letter to Martha Holloway, Department of Education, February
of FERPA to Health and Other State Reporting Requirements (letter to Melanie P. Baise,
University of New Mexico, November 29, 2004).
- School Official
Using Access to Education Records without Legitimate Educational Interest; Limits of
Health or Safety Emergency Exception (letter to J. Chris Toe, Strayer University, March
- Potential Conflict
with State Law (letter to Omero Suarez, Grossmont-Cuyamaca Community College District,
January 16, 2004).
of dependent students, disclosure to (letter to Robert E. Bienstock, University of New
Mexico, October 29, 1993).
- Law Enforcement
Unit Records (letter to Judith S. Bresler and Michael S. Molinaro, Reese & Carney,
LLP, February 15, 2006).
- Blanket Court Orders
(letter to Monique C. Shay, Los Angeles County Office of Education, and Kelly Rozmus
Barnes, Los Angeles Unified School District, March 28, 2006).
to Elvira Strehle-Henson, University of Colorado at Boulder, February 11, 2005.
- Jain v. State of Iowa, 617 N.W.2d 293 (Iowa 2000).
- Brown v. City of Oneonta, 106 F.3d 1125 (2d Cir. 1997).
- Trustees of Bates College v. Congregation Beth Abraham, 2001 WL 1671588 (Me. Super.
Ct. Feb. 13, 2001).
Sample Institutional Training Resources:
Permitted Uses of NACUANOTES Copyright and Disclaimer
this document in PDF or Word
NACUANOTES Homepage| NACUANOTES
Contact Us | NACUA Home
"To advance the
effective practice of higher education attorneys for the benefit of the
colleges and universities they serve."