This concise summary was written by Jennifer Watson, Assistant University Counsel and Chief Privacy Officer, University of Colorado System.

The Family Educational Rights and Privacy Act (“FERPA”) is a federal law that applies to educational agencies and institutions that receive federal funds under any program administered by the Secretary of Education.  FERPA generally requires prior written consent from the student before an educational agency or institution may disclose personally identifiable information from the student’s education records to a third party.

On October 30th, 2007, the U.S. Department of Education (“DOE”) released guidance addressing the balance between protecting students’ privacy rights and the need to disclose information in order to maintain campus safety and security.  The DOE issued this guidance in response to concerns raised by colleges and universities in the aftermath of the Virginia Tech tragedy.

The DOE’s guidance does not reflect a change of position regarding when protected information may be disclosed, but instead reinforces the exceptions to FERPA which allow disclosure without student consent.  In its guidance, the DOE notes that while FERPA “generally requires institutions to ask for written consent before disclosing a student’s personally identifiable information, it also allows colleges and universities to take key steps to maintain campus safety.”

This article summarizes DOE’s guidance and the pertinent exceptions that would allow institutional officials to disclose personally identifiable information from student education records when campus safety or security is at issue. 

Disclosure During a Health or Safety Emergency

The health or safety emergency exception permits school officials to share relevant information with those parties whose knowledge of the information is necessary to provide immediate protection of the health or safety of the student or other individuals.

Typically, law enforcement officials, public health officials, and medical personnel are the types of parties to whom information may be disclosed to under this FERPA exception.  This exception does not allow for a blanket release of protected information; rather the release must be limited to the period of the emergency and to those individuals who have a need to know.  This exception also allows school officials to disclose protected information to parents if a health or safety emergency involves their child. 

Disclosure of Disciplinary Records

Generally, student disciplinary records are protected as education records under FERPA.  However, in certain circumstances, student disciplinary records may be disclosed without the student’s consent.

An institution may disclose to the victim of an alleged crime of violence or non-forcible sex offense the results of a disciplinary proceeding brought against the alleged perpetrator of that crime, regardless of whether the institution concludes a violation occurred.

An institution may disclose to anyone – not just the alleged victim – the final results of a disciplinary proceeding, if it determines “the student is an alleged perpetrator of a crime of violence or non-forcible sex offense, and with respect to the allegation made against him or her, the student has committed a violation of the institution’s rules or policies.”

Campus Crime Disclosures

The Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act (“Clery Act”) requires institutions to provide timely warning reports to the campus community of certain crimes that represent a continuing threat to students and employees.  The Clery Act also requires institutions to collect, report, and disseminate campus crime data to the campus community.  Such disclosures are permitted under FERPA.

Disclosure of Law Enforcement Unit Records

FERPA excludes from its definition of “education records” records created and maintained by a campus law enforcement unit for a law enforcement purpose.  Accordingly, investigative reports, security incident reports, and other records created and maintained by campus law enforcement units may be disclosed to anyone, including outside law enforcement, without student consent.

Disclosure to Parents

FERPA rights transfer from parents to student when the student turns 18 years of age, or enters a postsecondary institution.  However, the institution may share information with parents without the student’s consent in the following circumstances:

• If the student is a dependent of the parent for income tax purposes.
  
  
• If a health or safety emergency involves the child of a parent.
  
  
• If the student is under the age of 21 and has violated an institutional law or policy concerning the use or possession of alcohol or a controlled substance.

In addition, a school official may share information with a parent that is based on that official’s personal knowledge or observation of the student.

Disclosure of Student Health Information

Campus health center records, counseling records and other student health records are subject to the privacy provisions of FERPA.  Such records are specifically exempt from the Health Insurance Portability and Accountability Act’s (“HIPAA”) Privacy Regulations.  Accordingly, student health records maintained by the institution may be disclosed in health or safety emergencies to those officials who have a need to know and/or parents as discussed above.

Disclosure of Student and Exchange Visitor Information System (“SEVIS”) Records

FERPA allows institutions to comply with information requests from the Department of Homeland Security (“DHS”) and its Immigration and Customs Enforcement Bureau (“ICE”) in order to comply with the requirements of SEVIS.  Other requests for records or information concerning international students must be assessed on a case-by-case basis to determine whether FERPA permits disclosure.

University officials who have questions concerning the disclosure of student records should contact their campus office of University Counsel.  DOE’s guidance, as well as other security related resources, may be accessed at www.ed.gov/policy/gen/guid/fpco/ferpa/safeschools/index.html.