Question:

When may information from education records be disclosed?

Answer:  In general, information derived from a student’s education records may be disclosed only if: (1) it is “directory information;” (2) the student has consented to the disclosure; or (3) the law provides an exception that permits disclosure without the student’s consent.

Question:       What is "directory information"?

Answer:  FERPA allows institutions to designate certain classes of information as “directory information” that may be released to anyone without a student’s consent [14].  Directory information may (but is not required to) include such items as the student’s name, address (local, permanent, and e-mail), telephone number (local and permanent), photograph, dates of attendance at the institution, major, degrees and awards received, participation in officially recognized activities and sports, and date and place of birth, as well as other information “that would not generally be considered harmful or an invasion of privacy if disclosed [15].”  A student’s social security number or any student identification number that could be used by itself, without a password, PIN, or other authenticating factor, to access educational records may not be designated as directory information [16].  An institution that wishes to make directory information available must first give its students an opportunity to “opt out” and block the release of their own directory information, usually by making a formal request to the institution’s registrar’s office [17].  Even if a student has chosen to block the release of directory information, the institution may nevertheless continue to disclose that student’s directory information under any other exception that may be applicable or with the student’s case-by-case consent.

Question:

May information from student education records be shared with others on campus?

Answer:  Yes. Under one of FERPA’s many exceptions to the general prohibition against disclosure, campus personnel are free to share information from student education records with other “school officials” who have “legitimate educational interests” in the information [18]. Each institution must define for itself who qualifies as a “school official” and what is a “legitimate educational interest” and give annual notice of its definitions to its students [19]. These definitions can be quite broad – “school officials” need not be limited to “officers,” or even to employees [20], and “legitimate educational interests” (much like “education records”) need not be limited either to “academic” interests or to instances that are beneficial to the student. The Family Policy Compliance Office (“FPCO”) [21], the office within the U.S. Department of Education charged with overseeing and enforcing FERPA, offers the following model definitions:
A school official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted as its agent to provide a service instead of using University employees or officials (such as an attorney, auditor, or collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks.

A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibilities for the University [22].
At institutions that follow these or similar models, an employee concerned that a student’s statements or behavior evidence a potential threat could – and should – share relevant information with the dean of students, the judicial affairs office, the campus counseling center, the campus law enforcement unit, or other appropriate “school officials” whose job it is to deal with such issues.

Question:

May information from a student’s education records be disclosed to protect health or safety?

Answer:  Yes. FERPA permits the disclosure of information from student education records “to appropriate parties, including parents..., in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals [23].”  For example, if a student sends an e-mail to his resident assistant saying that he has just been diagnosed with a highly contagious disease such as measles, the institution could alert the student’s roommate, and perhaps others with whom the student has come in close contact, to urge them to seek appropriate testing and medical care [24].  Safety concerns warranting disclosure could include a student’s statements about suicide, unusually erratic and angry behaviors, or similar conduct that others would reasonably see as posing a risk of serious harm [25].

This exception does not authorize “knee-jerk” or (in most cases) “broadcast” disclosures [26], but an institution need not be absolutely certain that there is an imminent crisis before invoking the exception. Rather, it is enough that, based on the totality of circumstances and on the basis of the facts that are available at the time, there is a rational basis for concluding that there is a threat to health or safety. As long as an institution can meet this relatively minimal threshold, "the Department will not substitute its judgment for that of the....institution in evaluating the circumstances and making its determination." [27]

The institution has the same good faith discretion to determine to whom disclosure should be made. In general, and when reasonably possible, the initial disclosure should be made to professionals trained to evaluate and handle such emergencies, such as campus mental health or law enforcement personnel, who can then determine whether further and broader disclosures are appropriate. Depending on the particular circumstances, disclosure under this exception may be made to law enforcement, parents, threat assessment teams or professionals, individuals who may have information necessary to determine the extent of a potential threat (such as friends, roommates, and prior schools attended), and potential victims and their families. If the concerns are of a more urgent nature, school officials should immediately contact campus or local police. FERPA permits each of these communications.

An institution that makes a disclosure on the basis of this exception must keep a record of the nature of the perceived threat and the parties to whom the disclosure was made [28].

Question:

When may a college or university disclose information from a student’s education records to the student’s parent or legal guardian?

Answer:  Once a student is in attendance at a postsecondary institution, all rights provided by FERPA rest with the student, even if the student is younger than 18 years old [29]. Education record information may therefore be disclosed to the parent of a college or university student only with the student’s consent or in instances in which one of the exceptions to FERPA permits disclosure. In addition to the other exceptions discussed in this Note, two such exceptions specifically address communications to parents.

First, FERPA permits (but does not require) disclosures of any or all education record information to a student’s parents if the student is their dependent for federal tax purposes [30]. To rely on this exception, the institution must verify the student’s dependent status, normally either by asking the student for confirmation [31] or by asking the parents for a copy of the relevant portion of their most recent tax return [32].

Second, an institution may (but again is not required to) provide information to a parent or legal guardian regarding any violation of law or of an institutional rule or policy governing the use or possession of alcohol or a controlled substance, if the institution has determined that the student committed a disciplinary violation with respect to such use or possession and the student is under the age of 21 at the time of both the violation and the disclosure [33].

These exceptions, like the other FERPA exceptions, are independent of each other. Thus, an institution may notify parents about a 19-year-old student’s underage drinking violations even if the student is not their tax dependent, and may likewise notify the parents of a 22-year-old student’s drug violations if the student is their tax dependent. Similarly, the situation need not rise to the level of a health or safety emergency in order for either of these exceptions to apply.

Question:

What about disclosing information from the student discipline process, either to others on campus or to other institutions?

Answer:  FERPA expressly permits institutions to include in a student’s education records appropriate information concerning disciplinary action taken against the student for conduct that posed a significant risk to the safety or well being of that student, other students, or other members of the community [34].  Such information may be disclosed to any “school officials” who have “legitimate educational interests” in the behavior of the student, and it also may be disclosed as appropriate under the health and safety emergency exception. FERPA also expressly provides that, for purposes of the health and safety emergency exception, the “appropriate parties” to whom disclosure may be made include teachers and officials at other institutions who have legitimate educational interests in the behavior of the student [35].

In a separate (and again independent) exception, FERPA further permits institutions to disclose to anyone the final results of a disciplinary proceeding conducted against a student who is an alleged perpetrator of a crime of violence or a nonforcible sex offense [36], if the institution determines as a result of that disciplinary proceeding that the student committed a violation of the institution’s own rules or policies with respect to such crime or offense. Yet another exception permits institutions to disclose the final results of such a proceeding to the victim regardless of whether the alleged perpetrator was found to be in violation of the institution’s rules or policies [37].  For purposes of these two exceptions, “final results” is limited to the name of the student who is an alleged perpetrator of a crime of violence, the violation found to have been committed, and any sanction imposed against the student by the institution [38].

Question:

Are there other circumstances in which a college or university may disclose information from student education records to another institution without the student’s consent?

Answer:  In addition to the exceptions discussed above, FERPA expressly permits (but does not require) the disclosure of information from a student's education records to officials of other institutions at which the student seeks or intends to enroll or where the student is already enrolled, so long as the disclosure is related to the student’s enrollment or transfer [39].  To take advantage of this exception, the institution must either inform its students generally, in its annual FERPA notice, of its practice of doing so [40], or make a reasonable attempt to notify the individual student that it has done so [41]. In either case, upon request, the institution also must provide the student with a copy of the disclosed records and give the student an opportunity for a hearing to challenge the content of the disclosed records [42].

Question:

Can a college or university get information such as disciplinary or mental health records from a student’s high school records?

Answer:  Yes. Colleges and universities have several options for obtaining information from a student’s high school records. They can ask students to consent to the disclosure of those records. Consent by the student would permit the high school to disclose the information. In addition, the college or university may ask the high school to disclose the student’s records under an applicable FERPA exception, including the exception that expressly permits the disclosure of information from a student's education records to officials of other institutions at which the student seeks or intends to enroll or where the student is already enrolled, so long as the disclosure is related to the student’s enrollment or transfer. Again, the prior institution may, but is not required by FERPA to, disclose information. The requirements of this exception are discussed more fully in the preceding question. A prior institution may also rely on the current institution's determination that there is a health or safety emergency and may disclose relevant information to the current institution under that exception [43].  State law may provide additional options for access to these records. For example, under Virginia law (Virginia Code Annotated § 23-2.1:3), colleges and universities “…may require that any student accepted to and who has committed to attend, or is attending, such institution provide, to the extent available, from the originating school a complete student record, including any mental health records held by the school. These records shall be kept confidential as required by state and federal law…” Finally, in appropriate circumstances, high school records may be obtained by a subpoena or court order.

The disclosure and protection of mental health records may also be subject to medical record privacy laws. The institution seeking these records should ensure that the records will be maintained with an appropriate level of confidentially once received to avoid misuse of the record or stigmatization of the student. Before considering a blanket requirement for the high school mental health and disciplinary records of all accepted or attending students, the college or university should be confident that it has adequate resources for the review of all of those records, and an appropriate protocol for responding to their contents and, as appropriate, permitting the affected students to respond.

Question:

Is the disclosure of campus law enforcement unit records restricted by FERPA?

Answer:  No. Records that are created by the campus law enforcement unit (whether commissioned police or non-commissioned security) at least in part for a law enforcement purpose are not “education records” and, at least as far as FERPA is concerned, may be shared freely with anyone the institution, in its discretion, deems appropriate [44].  For example, FERPA would not prevent a campus law enforcement unit from disclosing to external law enforcement agencies an incident report concerning the unit’s response to a student’s threatening statements or behavior. However, any copies of that report that are shared with other campus offices would become subject to FERPA, though the original in the law enforcement unit would continue not to be [45].  Moreover, any student education records that other campus offices share with the campus law enforcement unit, as “school officials” with a “legitimate educational interest,” remain subject to FERPA even in the hands of that unit [46].

Question:

What if the institution receives a court order or subpoena requesting student records?

Answer:  The institution may disclose records in response to a judicial order or lawfully issued subpoena but generally must notify the student of the order or subpoena before complying [47].  An exception to this general rule is that a federal grand jury subpoena or other subpoena issued for a law enforcement purpose may instruct the institution not to notify the student [48].

Question:

May an employee disclose personal knowledge and impressions about a student, based on the employee’s personal interactions with the student?

Answer:  Yes. FERPA’s disclosure restrictions apply only to information derived from student education records, not to personal knowledge derived from direct, personal experience with a student [49].  For example, a faculty or staff member who personally observes a student engaging in erratic and threatening behavior is not prohibited by FERPA from disclosing that observation. (If at some point the employee describes the observation in a personally identifiable record, that record would be subject to FERPA protections. The employee would still be permitted to disclose the personal observation but would not be permitted to disclose the record of the observation unless one of the exceptions to FERPA applied or the student consented to the disclosure). Again, however, the employee generally should limit disclosure of such information to professionals trained to evaluate and manage it, as other privacy laws conceivably could apply and prohibit broader disclosures, depending upon the circumstances.

Question:       What other laws protect student privacy?

Answer:  Students may have additional privacy rights under state privacy and confidentiality laws and under federal laws. The Department of Health and Human Services and the Department of Education have issued joint guidance on the application of FERPA and the Health Insurance Portability and Accountability Act (“HIPAA”) [50] to student health records. This joint guidance confirms that the HIPAA privacy rule expressly excludes student health records maintained by colleges and universities [51].  Moreover, certain professionals on campus, such as medical and mental health care providers, may be bound by professional obligations of confidentiality that require a higher burden to be met (such as a significant threat of serious and imminent harm to a specifically foreseeable victim) before disclosure of information in their possession may be made. Even when this is the case, however, other personnel on campus (such as a faculty member, dean of students, or residential life employee) may disclose information about a student under the lower FERPA health and safety emergency standard if the circumstances warrant.

Question:       What happens if I violate FERPA?

Answer:  If an institution regularly violates FERPA, it runs the risk of losing its education-related federal funding. While thus far, the Family Policy Compliance Office (FPCO) has not revoked any institution’s funding, it works with these institutions to get them to comply with the statute voluntarily.

FERPA does not give individuals the right to sue non-compliant institutions. But sometimes the unauthorized disclosure of private information violates other laws, such as state medical confidentiality or privacy laws, which allow individuals to sue. Faculty and employees should consult campus counsel with questions about disclosing information in student records.

In the event of an emergency or serious concern about either campus safety or an individual’s welfare, FERPA permits campus personnel to consult appropriate persons, including parents, if the information conveyed is necessary to protect the health or safety of the student or others. Any ambiguity about FERPA should be resolved in favor of disclosure, limited as necessary, to protect the safety of individuals.

Question:

What should a faculty member or other college or university employee do if he or she is concerned about a student?

Answer:  If the concern is that a student may engage in violent behavior, toward self or others, and the threat appears to be imminent, the employee should contact the campus police or security office immediately. If the concern is of a less urgent nature, or the employee is not quite sure what to make of a student's comments or conduct, the employee should consult with professionals on campus or associated with the institution, such as the Dean of Students, a campus counseling center, or law enforcement, who may be able to assess the potential threat, identify resources for the student, and provide information that could assist in deciding on an appropriate course of action. In consultation with appropriate campus resources, a collective decision may then be made to contact a family member, an appropriate off-campus resource, or others.

FERPA would not present an obstacle to any of these disclosures. The worst response is to ignore troubling or threatening behavior. School officials should trust their instincts when a student appears to be in trouble and should consult with others on campus.