What is FERPA?
The Family Educational Rights and Privacy Act (FERPA) requires a local education agency (LEA) to obtain from a student’s parent (or the student, if eligible) a written, dated and signed consent before disclosing personally identifiable information from the student’s education record. There are specific limited exceptions to this requirement as specified in the FERPA rules at 34 CFR Part 99.
Education records are records, including health and mental health records that directly relate to a student and are maintained by the LEA.
FERPA governs the access to and disclosure of education records. Among other exceptions, “education records” do not include:
- Records that are kept in the sole possession of the maker, used as personal memory aids, and are not revealed to other persons except a temporary substitute for the maker of the record;
- Records of a student who is 18 years of age or older or who is attending a postsecondary education agency when such records are:
- made or maintained by a health or mental health care provider in connection with the treatment of the student; and
- disclosed only to individuals providing the health or mental health treatment.
FERPA allows LEAs to disclose “directory information” from a student’s education record. This is information that would not, generally, be considered harmful or an invasion of privacy if disclosed. Directory information may include the student’s name, address, telephone listing, email address, date and place of birth, etc. A student’s social security number is not disclosable as directory information. The LEA must provide notice to parents and students of the directory information that it intends disclose. Parents or eligible students have the right to refuse to allow the LEA to disclose such information.
FERPA is administered by the U. S. Department of Education, which has advised that an LEA may disclose information from a student’s education record, including health and mental health treatment information, to the LEA’s billing agent for the purpose of billing Medicaid on behalf of the LEA. However, parental consent is required before claims for reimbursement may be submitted or disclosed to the Medicaid agency.