Student Records Management: Preparing for the Upcoming School Year

As the new school year approaches, now is the time for school districts and BOCES to review policies and procedures related to the management of student records. In particular, administrators and staff should review compliance with the notice provisions of the Family Educational Rights and Privacy Act (“FERPA”), the federal law that protects the privacy of student education records.

FERPA requires public schools, including BOCES, to annually notify parents of students currently in attendance, and students in attendance who are over the age of 18 (“eligible students”), regarding their rights under FERPA, including the rights to inspect and review a student’s educational record, and to seek amendment of those records in certain circumstances, and the procedures for exercising these rights.

If the educational agency has a policy or practice of disclosing personally identifiable information (“PII”) from students’ education records to “school officials” without first obtaining written parental consent, then the notification must specify the criteria for determining those positions deemed to have a “legitimate educational interest.” Most school districts routinely permit those staff members with a “legitimate educational interest” to review students’ education records. At times, other third parties, including the school attorney, may be within this category. It is clear, however, that “legitimate educational interest” should be construed narrowly, and is not intended to allow all instructional staff, for example, to have access to a student’s education records.

The annual notice must be provided in a manner reasonably likely to inform parents and eligible students of their rights. These notices are often provided in the school calendar or other general mailing sent to parents, or via an electronic parent messaging system. The notice also must be provided in a manner that is effective. Where parents or eligible students are known to have communication needs due to disability or to primarily speak a language other than English, the school must consider whether an alternate or translated notice may be necessary to ensure effective notice.

FERPA permits educational agencies to disclose “directory information” without prior parent consent, provided the educational agency has given appropriate notice to parents and eligible students of their rights regarding directory information, including the right to prohibit such release.

Directory information is information contained in a student’s education record that generally would not be considered harmful or an invasion of privacy if disclosed. Educational agencies have discretion as to the categories of information that are designated as directory information, but directory information typically includes items such as a student’s name and address, grade level, dates of attendance, photographs and videos, participation in officially recognized activities and sports, and degrees, honors and awards received. The NYS Education Department recently released guidance advising educational agencies not to include a student’s place of birth, immigration status, country of origin, or English language learner status as directory information, as this information may be harmful if disclosed, potentially in the context of immigration enforcement efforts.

Before an educational agency may disclose directory information, public notice must be given to parents and eligible students regarding the types of personally identifiable information designated by the school district as directory information, the right to submit to the school a written “opt out” from such disclosure, and the reasonable period of time by which the parent or eligible student must notify the educational agency of the “opt out.” This notice can be combined with the annual notice to parents and eligible students of their FERPA rights.

The New York State Education Department advises that schools develop a standardized form for this purpose, although a standardized form is not strictly required by law. Any “opt out” form should identify the directory information to not be disclosed and, unless email notices are deemed by the school district to be sufficient, should be signed by the parent or eligible student. The school district should designate an individual to receive any directory information opt-outs, and inform parents of their contact information, so that the school has a central repository to maintain and track these students. If a parent opts out or otherwise states in writing that they do not want such directory information concerning their child to be made public, the school district may not share directory information about that student.

If you have any questions about your school district’s or BOCES’ annual FERPA and directory information disclosure notices, or related policies and procedures, please contact Lindsay Plantholt at laplantholt@ferrarafirm.com.