Updated FERPA Regulations Expand Access
to Information
BY PETER KUSHIBAB
We still don’t know what to call it: an economic slowdown, slump, downturn, maybe even the Great Recession. Whatever its label, it has posed unprecedented challenges to higher education leaders.
Unfortunately, the myriad other issues that demand the
attention of the senior student affairs officer do not wait
patiently for the economy to improve. Amidst the economic
upheaval, major changes by the U.S. Department of Education
to regulations interpreting FERPA (the Family Educational
Rights and Privacy Act) in December 2008 may have
been overlooked.
FERPA protects the confidentiality of the records that
schools maintain about their students. It generally requires
that personally identifiable information about a student (such
as a name, student number, or other information that would
make the student’s identity easily traceable) be disclosed only
with a student’s prior permission. The law provides many
exceptions to that rule, however, and those exceptions are the
main focus of the department’s recent changes.
The revised regulations are detailed on the department’s
website ( www.ed.gov/policy/gen/guid/fpco), which is well
worth an hour or two of study. Revision highlights include the
following areas:
Health or Safety Emergency. A school may disclose personally identifiable information to appropriate parties (
including parents) “if knowledge of the information is necessary to
protect the health or safety of the student or other individuals.” While FERPA has afforded this exception for years, the
regulations have provided little guidance to school officials,
who must decide whether an emergency situation warrants
such an unauthorized disclosure.
Now FERPA regulations hold that officials “may take into
account the totality of the circumstances pertaining to a threat
to the health or safety of a student or other individuals.”
If that threat is “articulable and significant,” the information may be disclosed without a student’s prior permission.
Moreover, “[i]f, based on the information available at the time
of the determination, there is a rational basis for the determination, [DOE] will not substitute its judgment for that of the
educational agency or institution in evaluating the circumstances and making its determination.”
With this new guidance come added responsibilities.
Whenever a school discloses information under the health or
safety emergency exception, it must document in its records
the articulable and significant threat to the health or safety of
the student or third party, as well as the parties to whom the
disclosure of personally identifiable information was made.
Contractors as Other School Officials. FERPA has long
held that a school may disclose, without a student’s prior permission, personally identifiable information out of a student’s
records to “other school officials” with “legitimate educational
interests.” With the new regulations, the department has
announced (consistent with technical guidance it previously
issued) that a contractor, consultant, or other party to whom
the school “has outsourced institutional services or functions”
