Proposed Ferpa Regulations

The U. S. Department of Education (USDE) published new regulations on March 24, 2008 that make comprehensive changes to the rules for the Family Educational Rights and Privacy Act (FERPA). FERPA imposes restrictions on a local education agency’s (LEA) to disclose personally identifiable information from a students’ education record without the prior written and signed consent from the students’ parents (or from the students if over age 18 or attending an institution of postsecondary education).

Education agencies should carefully review the proposed rules with their respective legal counsels and submit comments to USDE as appropriate on or before May 8, 2008. 

Some of the proposed updates and clarifications are highlighted below.

1. An LEA is not permitted to disclose a student’s social security number or other student identification number without prior consent.

Currently, an LEA may disclose directory information from a student’s education record without prior consent. The proposed regulations clarify that an LEA cannot designate and disclose as directory information a student’s social security number or other student identification number. This restriction is intended to prevent the release of student identifiers that could be used to impersonate the student to fraudulently obtain information.

This proposed revision to the regulations reflects USDE’s current policy. LEAs should review their respective procedures to verify that students’ social security numbers or other student identification numbers are not inappropriately disclosed.

2. The definition of “school official” is extended to include contractors or consultants to whom the LEA outsources institutional services.

Under the proposed regulations, a contractor/consultant to whom the LEA outsources institutional services may be considered a school official with access to education records if the contractor/consultant

• performs a service or function that the LEA would otherwise use its employees to perform,
• is under the direct control of the LEA with respect to the maintenance and use of student information, and
• is subject to FERPA’s redisclosure limitations.

A school official, including an outside contractor/consultant, is permitted access to education records without prior consent only if the LEA has determined that the school official has a legitimate educational interest in the information. The proposed regulations require LEAs to use reasonable methods to ensure that a school official obtains access to only those education records in which the school official has a legitimate educational interest through the use of

• physical access controls,
• technological access controls, or
• an effective administrative policy for controlling access.

3. An LEA must comply with the FERPA requirements regarding annual parent notification prior to allowing school officials to have access to education records.

An LEA must provide parents and eligible students with annual notice of their rights under FERPA. The annual notice is typically provided to parents and eligible students at the beginning of the school year. Under the proposed regulations, the LEA cannot allow access to education records by school officials, including contractors/consultants, until the annual FERPA notice requirements are met. The annual notice must include specification of the contractors/consultants that have been retained by the LEA to provide institutional services and the legitimate educational interest in the information disclosed.

Since school officials may be retained by the LEA throughout the school year, the proposed restriction on the school official’s access to education records could interfere with the LEA’s ability to conduct school business. LEAs should ask USDE to clarify reasonable timing for allowing school officials to have access to education records as necessary to perform their respective functions.

The term “legitimate educational interest” is not defined in the regulations. Education agencies should seek clarification from USDE that a contractor/consultant to whom institutional services such as a Medicaid billing are outsourced has a legitimate educational interest in the student information necessary to provide the service.

4. A state education agency may redisclose student information it receives from a local education agency under specified circumstances.

FERPA allows an LEA, without prior consent, to disclose education records to specified federal and state authorities including a state education agency (SEA). Such disclosure must be (1) for the purpose of an audit or evaluation of federal and state supported programs or (2) in connection with the enforcement of federal legal requirements related to such programs.

Under the proposed regulations, an SEA and other authorities authorized to receive education records without prior consent may redisclose the records in strict accordance with FERPA disclosure rules. Permissible redisclosure includes

• to a school official, including a contractor/consultant to which the SEA outsources institutional services and which has legitimate educational interests and 
• to an authorized representative of an SEA or LEA in connection with an audit or evaluation of federal or state supported programs or for the enforcement of or compliance with federal legal requirements that relate to such programs.

The party receiving the education records from the SEA must also comply with FERPA disclosure rules. The SEA must maintain a record of its redisclosures consistent with the FERPA record-keeping requirements.

USDE indicates that its proposed changes regarding on the use of contractors/consultants by education agencies supersede its prior technical guidance. Education agencies should consult with their respective attorneys to assess the impact of the changes on their
current operations.

5. Student information may be disclosed without prior consent for the purpose of conducting a study on behalf of an education agency.

FERPA allows an education agency to disclose education records without prior consent to an organization conducting a study on behalf of the education agency if the study is to develop, validate or administer predictive tests, administer student aid programs, or improve instruction. The education agency must enter into a written agreement with the organization that

• specifies the purpose of the study,
• restricts use of the education records to the purpose of the study,
• precludes disclosure of personally identifiable information about students or parents to anyone other than representatives of the organization, and
• requires that the disclosed information be destroyed or returned to the agency when no longer needed for the purpose of the study.

A party that received information from education records must remove all personally identifiable information prior to disclosure without prior consent. 

For further information please contact your local Public Consulting Group representative or:

Patsy Crawford,
Director of Legal Services
Education Services Practice Area
Phone: (312) 425-0550
Email: pcrawford@pcgus.com

* Note: This document is not intended as legal advice and is for informational purposes only.