FERPA, RECORDS, & YOU

Presented by: Vasilis Hionis

 AGENDA
• Why FERPA Matters
• Key Regulations and Risks
• Student & Parental Rights
• Our Records Process
• Handling Requests & Corrections
• Audits & Violations
• Q&A
 WHY FERPA MATTERS
• The Family Educational Rights and Privacy Act governs how federally funded educational
institutions maintain, disclose, and correct educational records.1 As a public school, we
receive federal funds and must comply with FERPA and maintain a records process which:
• Protects and maintains confidential data
• Provides a process for students and parents to access and correct records
• Responsibly discloses records when necessary
• FERPA was originally enacted in 1974, with further amendments in recent years based on
legislation (ex: 2001 PATRIOT Act) and court rules (ex: Gonzaga v. Doe)
• FERPA regulations are enforced by the Department of Education’s Office of the Chief
Privacy Officer (“CPO”), formerly the Family Policy Compliance Office (“FPCO”). The
office regularly issues guidance and amendments, which we must comply with.2
1
https://security.harvard.edu/files/it-security-new/files/frequently_asked_questions_about_ferpa_.pdf
2
https://www.ctschoollaw.com/2017/01/u-s-department-of-education-changes-name-of-office-responsible-for-ferpa/#:~:text=On%20J
 KEY REGULATIONS UNDER FERPA
• Records Scope – FERPA applies to any educational records related to a specific
student maintained by our institution. This includes all identifiable records
regardless of format, including handwritten notes, emails, photos, and both physical
and digital copies of records.
• Everyone who accesses or uses a student’s educational records to perform their
duties is responsible for complying with FERPA and responsible for following
our records compliance process.
• Some records (such as the medical treatment history of a student within their
educational records) will be restricted to those with a valid need (such as
supporting the treatment).
 KEY REGULATIONS UNDER FERPA
• Records Maintenance & Disclosure – We are required to have a records
maintenance process that protects students’ confidential information. This includes
getting written consent from the student or parent before disclosing any records.
• Records Access & Correction – We are required to provide a process where
students and parents can request a copy of any educational records and make
corrections to any inaccurate or misleading information.
 HANDLING RECORDS
OVERVIEW
• Educational Records do not apply to all documentation related to a student. Some need to
be maintained under FERPA, while others do not.
• Records that need to be updated and maintained by FERPA include: Student health
information and transcripts, which need to be kept confidential. These records show current
academic standing and ensure the student is of no harm to themselves or others and is
provided with assistance if needed.
• Records that do not need to be updated nor are subjected to FERPA include: directory/public
information, e.g., name, DOB.
• Whenever a parent and/or eligible student gains access to treatment records that have been
created and maintained by a physician, psychologist, or psychiatrist, they will become
educational records in these circumstances.
• Our Records Management systems will always clarify which records are educational records
versus treatment records.
 FERPA RISKS & VIOLATIONS
• FERPA risks are ever-present, given the prevalence of a student’s educational records
and wide use of paper and digital copies, which may contain confidential information.
• Any records or communications containing records (ex: emails, photocopies) that are
shared without disclosure or not properly protected (ex: securely stored) can
constitute a violation.
• Violations and penalties can be extremely severe, including fines, civil litigations, and
up to the loss of our federal funding and/or certifications as an educational
institution.3
• It is, therefore, imperative that everyone follows our records processes and is vigilant
to any potential violations or misuse of educational records.

3
https://splc.org/ferpa-what-it-means-and-how-it-works/
 OUR RECORDS PROCESS:
SUMMARY
• To comply with FERPA, we require all staff to:
• Complete an annual FERPA training presentation.
• Complete a FERPA checklist, which includes notes on handling requests and
maintaining secure storage for any physical records or equipment containing
records (ex: your laptop).
• Limit copying records whenever possible. If a copy is necessary, ensure it is
deleted/destroyed when no longer needed.
• Use only approved tools to share records with staff and check for authorizations.
 PROTECTING OUR RECORDS
• We take the protection of our educational records very seriously.
• All physical records are always required to maintain in a secure location. This
includes any equipment which stores copies of such records.
• Records can be securely maintained in a locked cabinet where only you can
access them or in possession of our records office.
• For all digital records, please ensure you use our secure records management system,
which encrypts all records and provides logs to protect them from improper access.
• Limit discussions or sharing of any records outside of secure tools unless you have
received a request from the parent or student to share the records (ex: email).
• We regularly and randomly audit records access to ensure proper use by staff.
 OUR RECORDS PROCESS:
HANDLING REQUESTS
• Under FERPA, Parents and students are entitled to make requests to access or correct
their educational records. Parents and students can make requests for our institution
depending on the circumstances.
• Parents and/or guardians may make requests until the student turns 18.
• Once a student turns 18, they become an “eligible student” and all rights under
FERPA transfer to them instead of the parent.
• Waiver and records request templates can be provided by the records office.
• A signed copy must be returned to the records office and kept on file.
• Always ensure you have a waiver or written consent prior to disclosing educational
records, even with other departments, and authorize third parties.
 PARENTAL & STUDENT RIGHTS:
HANDLING REQUESTS
• Records may be provided using our internal tool to send a secure link to the parent
or student.
• We must complete a request within 45 days of receipt.
• If you are ever unsure – please contact our Records Office and we’re happy to assist
with the request.
• For any government or law enforcement requests to access educational records,
please contact our Records Office. Do not provide such records directly yourself.
 PARENTAL & STUDENT RIGHTS:
HANDLING CHANGES
• Correction requests should be forwarded to our Records Office. We will send a form
that will outline the change requests and rationale from the parent or student.
• We are required to consider the request and provide a decision in writing to the
parent or student within 45 days. If we choose not to change the educational records,
we will add a statement to the record in accordance with the parent or student’s
request.
• If necessary, a hearing will be held to discuss the correction request.
• Corrections are meant to challenge facts and records, not to challenge grades,
opinions, or other substantive decisions made about a student.
 HANDLING VIOLATIONS
• Everyone is responsible for the responsible access and use of educational records.
• Failing to act when you observe a violation can lead to individual fines,
termination, and even legal action against you, depending on the severity of the
violation.
• If you see or observe what appears to be a violation, please contact the Records
Office immediately.
• Anonymous violations can be reported in a drop box located outside our office.
• Audits will also regularly take place; you may receive a notification to justify or
explain records use during an audit.
 REFERENCES

• FERPA Primer: The Basics and Beyond

• Joint Guidance on FERPA and HIPAA
• FERPA Frequently Asked Questions
• 2017 Recent FERPA Changes
• DOE FERPA Parental Rights