Protecting Student Information
FERPA guidelines protect the privacy of students and their parents as well as the confidentiality of records maintained by certain school systems. FERPA, or the Family Educational Rights and Privacy Act, only applies to education programs that are funded federally and administered by the US Department of Education.
FERPA Guidelines for Education Privacy
FERPA requires education organizations to keep certain student information private. Specifically, schools, employees, or organizations cannot release personally identifiable information that belongs to a student or parent without that individual’s signed consent. FERPA also requires that relevant schools:
- Notify students of FERPA-related rights on an annual basis.
- Notify third-party staff or companies that information is protected by FERPA when data is shared in under a FERPA release.
- Allow students and parents to inspect records.
What FERPA Doesn’t Do
FERPA doesn’t require schools to maintain records for a certain length of time or notify students when certain records are slated for destruction. FERPA also doesn’t govern how amended letters of recommendation are treated or interfere with investigative access to pertinent records during a criminal investigation. In some cases, other regulations or laws come into play regarding education records. During a criminal investigation, warrant requirements govern access; during a data security breach, federal and state notification laws must be followed.
Securing and Destroying Student Records
Schools should secure student records with locking file cabinets, limited access to files, and encryption for digital records. Strong password policies, security training, and consistent processes for record release are also important. Schools should create and follow policies for the destruction of old student records — it’s usually a good idea to wait until the student has been inactive for a number of years before destroying documents. Most schools do maintain hard copies or digital copies of student transcripts for many years.
Because student records are likely to contain personally identifying information, such as full names, dates of birth, lists of addresses and relatives, and social security numbers, they should be handled with care during destruction. Schools should contract with a professional shredding vendor like Sergeant Shredder to purge files at minimum annually or several times a year.
Did you learn anything new about FERPA guidelines?