FERPA (the Family Educational Rights and Privacy Act) is the U.S. federal law that controls who can see a student's education records and what a school must do before sharing them. If your team handles transcripts, disciplinary files, financial aid paperwork, or special-education documentation, FERPA sets the rules for storage, disclosure, and consent — and the penalties for getting it wrong fall on the institution, not just the person who hit "send."
What counts as an education record under FERPA?
FERPA defines an education record broadly: any record directly related to a student and maintained by a school or a party acting for the school. That includes grade transcripts, enrollment forms, disciplinary files, special-education (IEP) documentation, financial aid records, and even email threads about a specific student if a school keeps them on file.
- Grades, transcripts, and class schedules
- Disciplinary records and incident reports
- Special education and accommodation files (IEPs, 504 plans)
- Financial aid applications and award letters
- Health records maintained by a school nurse's office (these can also overlap with HIPAA in limited cases)
Directory information — name, enrollment status, dates of attendance — is treated differently and can often be shared unless a parent or eligible student has opted out. Everything else needs consent or a specific legal exception before it leaves the building.
Who has the right to control these records?
Parents hold FERPA rights while a student is under 18 and enrolled below the postsecondary level. Once a student turns 18 or enrolls in a college or university, those rights transfer to the student directly — they become an "eligible student," and the school generally needs the student's own consent to share records with anyone, including a parent paying the tuition bill.
| Situation | Who controls access | Typical exception |
|---|---|---|
| K-12 student | Parent or legal guardian | School officials with "legitimate educational interest" |
| College student under 18 | The student (eligible student) | Health/safety emergency |
| College student 18+ | The student (eligible student) | Subpoena or court order, with notice where required |
| Any student, directory info only | School, unless opted out | Public directory listings |
When can a school share a record without consent?
FERPA lists specific exceptions rather than a general "reasonable business need" standard. The most commonly used ones are:
- School officials exception — staff, contractors, or vendors with a legitimate educational interest in the record, and only for that purpose
- Health or safety emergency — disclosure to protect the student or others from an immediate threat
- Judicial order or lawfully issued subpoena — usually with advance notice to the parent or eligible student unless a court specifically bars it
- Financial aid exception — disclosure needed to determine eligibility, amount, or conditions of aid
- Studies conducted for or on behalf of the school — under a written agreement that limits use and requires destruction of the data afterward
Outside of those, the default answer is: get written consent that specifies the record, the purpose, and the recipient before you share anything.
What happens if a school violates FERPA?
FERPA does not create a private right to sue the school directly. Instead, the U.S. Department of Education's Student Privacy Policy Office investigates complaints, and the real consequence is administrative: a school found in ongoing noncompliance can lose federal funding. In practice, most cases resolve through a corrective action plan rather than a funding cutoff, but the reputational and operational cost of an investigation is still significant — and it usually starts with a paper trail showing who accessed a record and why.
How should a records office actually manage this day to day?
The compliance requirement is simple to state and hard to execute manually across thousands of files a year. A workable process usually includes:
- Tagging every document with its source student and the legal basis for who can see it
- Logging every disclosure — who requested it, what was shared, and which exception applied
- Redacting third-party student information before responding to a records request that names one student but touches a shared document (a group project file, a shared disciplinary incident)
- Reviewing vendor contracts for the "school official" language that lets a SaaS tool touch student data under FERPA at all
Document analysis tools can help with the mechanical parts of this — flagging which fields in a scanned form look like protected identifiers, or surfacing every mention of a specific student across a folder of PDFs before a records request goes out — but the underlying access decision (who is legally allowed to see this) still has to be made by a person who understands the exception being applied. HiDocument's document analysis workspace can summarize and extract fields from PDFs and scanned forms, which shortens the "what does this file actually contain" step, but it does not make the disclosure decision for you.
How does FERPA compare to HIPAA and other privacy laws?
Registrar's offices sometimes get asked whether FERPA or HIPAA applies to a given health-related record, and the answer depends on who is holding the record and why. A school nurse's file on a K-12 student is typically a FERPA education record, not a HIPAA record, because HIPAA generally exempts records covered by FERPA. A university health clinic treating an adult patient outside the education context can be a different story. If your organization also handles patient records directly, see our breakdown of HIPAA compliance requirements for medical documents for the healthcare-specific version of this same "who can see this and why" problem. And if your student population includes California residents, the state-privacy-law overlap is worth checking against our CCPA vs. CPRA comparison.
People also ask
Does FERPA apply to private schools?
FERPA applies to any school that receives funding under a program administered by the U.S. Department of Education, which covers nearly all public schools and most private and religious schools that participate in federal programs. A private school receiving no such funding is generally not bound by FERPA, though state law may impose similar duties.
Can a teacher email a parent about a student's grade?
Generally yes, if the parent still holds FERPA rights (the student is under 18 and not in a postsecondary program) and the email goes to a verified parent address rather than a shared or public one. Once the student is an eligible adult student, the school needs the student's own consent even for a parent asking about grades.
Is a student's ID photo an education record?
It can be, if it's maintained in a system tied to the student's identity. Directory information rules often allow limited photo use (yearbooks, ID badges) unless a family has opted out of directory disclosure.
FERPA is not a checklist you finish once. It's a standing obligation every time a document with a student's name on it is about to leave your system — and the fastest way to get it wrong is treating every request the same way instead of matching it to the specific exception that actually applies.
Frequently Asked Questions
Does FERPA apply to private schools?
FERPA applies to any school that receives funding under a U.S. Department of Education program, which includes nearly all public schools and most private schools that accept federal funds. A private school with no such funding is generally outside FERPA's scope, though state law may impose similar rules.
Who controls a college student's education records?
Once a student turns 18 or enrolls in a postsecondary institution, FERPA rights transfer from the parent to the student directly. The school generally needs the student's own written consent to share records with anyone else, including a parent.
Can a school share student records without consent?
Yes, but only under specific FERPA exceptions: school officials with a legitimate educational interest, health or safety emergencies, a valid subpoena or court order, financial aid determinations, or an approved research study under a written data agreement.
What happens if a school violates FERPA?
The U.S. Department of Education's Student Privacy Policy Office investigates complaints. Most cases resolve through a corrective action plan; continued noncompliance can put a school's federal funding at risk.
Is FERPA the same as HIPAA for school health records?
No. A school nurse's record on a K-12 student is typically covered by FERPA, not HIPAA, because HIPAA generally exempts records already covered by FERPA. A university clinic treating patients outside the education context can fall under HIPAA instead.