Although it fortunately is still rare, a student’s statements or behavior sometimes may raise concerns regarding the safety of the student or others. To prevent such harm from occurring, college and university administrators, faculty, and staff who become aware of such statements or behaviors may want to tell someone else – another campus employee, parent, outside health care professional, law enforcement officer, or those with whom the student may interact with – about what they know or believe. They also may be concerned, however, that the Family Educational Rights and Privacy Act (FERPA), the federal statute that governs disclosure of student records and information, prevents them from doing so.
Concerns about the ability to communicate critical information in an emergency are, in large part, the result of misunderstandings about FERPA. We offer the following information to demonstrate that FERPA is not a significant obstacle to appropriate (and desirable) communications intended to protect student, campus, or public safety. Depending on the relevant context and jurisdiction, however, additional restrictions may arise under other applicable state or federal laws, which are beyond the scope of this.
FAQ
FERPA limits the disclosure of information from student “education records,” a term that the law defines quite broadly and is not limited to “academic” records. “Education records” include virtually all records maintained by an educational institution, in any format, that are “directly related” to one or more of its past or present students. A record is “directly related” to a student if it is “personally identifiable” to the student, and a record is “personally identifiable” to a student not only if it expressly identifies the student on its face but also if the student’s identity could be deduced from the demographic, descriptive, or other information the record contains, either alone or in combination with other publicly available information. Thus, “education records” include not only registrar’s office records, transcripts, papers, exams and the like, but also non-academic student information database systems, class schedules, financial aid records, financial account records, disability accommodation records, disciplinary records, and even “unofficial” files, photographs, e-mail messages, hand-scrawled Post-it notes, and records that are publicly available elsewhere or that the student herself has publicly disclosed.
In general, information derived from a student’s education records may be disclosed only if: it is “directory information;” the student has consented to the disclosure; or the law provides an exception that permits disclosure without the student’s consent.
FERPA allows institutions to designate certain classes of information as “directory information” that may be released to anyone without a student’s consent. Directory information may (but is not required to) include such items as the student’s name, address (local, permanent, and e-mail), telephone number (local and permanent), dates of attendance at the institution, major, degrees and awards received, participation in officially recognized activities and sports, photograph, and date and place of birth, as well as other information “that would not generally be considered harmful or an invasion of privacy if disclosed.” An institution that wishes to make directory information available must first give its students an opportunity to “opt out” and block the release of their own directory information, usually by making a formal request to the institution’s registrar’s office. Even if a student has chosen to block the release of directory information, the institution may nevertheless continue to disclose that student’s directory information under any other exception that may be applicable or with the student’s case-by-case consent.
Yes. FERPA permits the disclosure of information from student education records “to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.” For example, if a student sends an e-mail to his resident assistant saying that he has just been diagnosed with a highly contagious disease such as measles, the institution could alert the student’s roommate, and perhaps others with whom the student has come in close contact, to urge them to seek appropriate testing and medical care. Safety concerns warranting disclosure could include a student’s suicidal statements or ideations, unusually erratic and angry behaviors, or similar conduct that others would reasonably see as posing a risk of serious harm.
This exception does not authorize “knee-jerk” or (in most cases) “broadcast” disclosures, but a limited disclosure to a limited number of people, made on the basis of a good-faith determination in light of the facts available at the time, and is highly unlikely to be deemed a violation of FERPA, even if the perceived emergency later turns out, in hindsight, not to have been one. In general, and when reasonably possible, the initial disclosure should be made to professionals trained to evaluate and handle such emergencies, such as campus mental health or law enforcement personnel, who can then determine whether further and broader disclosures are appropriate.
Once a student is in attendance at a postsecondary institution, all rights provided by FERPA rest with the student, even if the student is younger than 18 years old. Education record information may therefore be disclosed to the parent of a college or university student only with the student’s consent or in instances in which one of the exceptions to FERPA permits disclosure. In addition to the other exceptions discussed in this Note, two such exceptions specifically address communications to parents.
First, FERPA permits (but does not require) disclosures of any or all education record information to a student’s parents if the student is their dependent for federal tax purposes. To rely on this exception, the institution must verify the student’s dependent status, normally either by asking the student for confirmation or by asking the parents for a copy of the relevant portion of their most recent tax return. Second, an institution may (but again is not required to) provide information to a parent or legal guardian regarding any violation of law or of an institutional rule or policy governing the use or possession of alcohol or a controlled substance, if the institution has determined that the student committed a disciplinary violation with respect to such use or possession and the student is under the age of 21 at the time of both the violation and the disclosure.
These exceptions, like the other FERPA exceptions, are independent of each other. Thus, an institution may notify parents about a 19-year-old student’s underage drinking violations even if the student is not their tax dependent, and may likewise notify the parents of a 22-year-old student’s drug violations if the student is their tax dependent. Similarly, the situation need not rise to the level of a health or safety emergency in order for either of these exceptions to apply.
FERPA expressly permits institutions to include in a student’s education records appropriate information concerning disciplinary action taken against the student for conduct that posed a significant risk to the safety or well being of that student, other students, or other members of the community. Such information may be disclosed to any “school officials” who have “legitimate educational interests” in the behavior of the student, and it also may be disclosed as appropriate under the health and safety emergency exception. FERPA also expressly provides that, for purposes of the health and safety emergency exception, the “appropriate parties” to whom disclosure may be made include teachers and officials at other institutions who have legitimate educational interests in the behavior of the student.
In a separate (and again independent) exception, FERPA further permits institutions to disclose to anyone the final results of a disciplinary proceeding conducted against a student who is an alleged perpetrator of a crime of violence or a nonforcible sex offense, if the institution determines as a result of that disciplinary proceeding that the student committed a violation of the institution’s own rules or policies with respect to such crime or offense. Yet another exception permits institutions to disclose the final results of such a proceeding to the victim regardless of whether the alleged perpetrator was found to be in violation of the institution’s rules or policies. For purposes of these two exceptions, “final results” is limited to the name of the student who is an alleged perpetrator of a crime of violence, the violation found to have been committed, and any sanction imposed against the student by the institution.
In addition to the exceptions discussed above, FERPA expressly permits the disclosure of information from a student’s education records to officials of other institutions at which the student seeks or intends to enroll. To take advantage of this exception, the institution must either inform its students generally, in its annual FERPA notice, of its practice of doing so, or make a reasonable attempt to notify the individual student that it has done so. In either case, upon request, the institution also must provide the student with a copy of the disclosed records and give the student an opportunity for a hearing to challenge the content of the disclosed records.
No. Records that are created by the campus law enforcement unit (whether commissioned police or non-commissioned security) at least in part for a law enforcement purpose are not “education records” and, at least as far as FERPA is concerned, may be shared freely with anyone the institution, in its discretion, deems appropriate. For example, FERPA would not prevent a campus law enforcement unit from disclosing to external law enforcement agencies an incident report concerning the unit’s response to a student’s threatening statements or behavior. However, any copies of that report that are shared with other campus offices would become subject to FERPA, though the original in the law enforcement unit would continue not to be. Moreover, any student education records that other campus offices share with the campus law enforcement unit, as “school officials” with a “legitimate educational interest,” remain subject to FERPA even in the hands of that unit.
The institution may disclose records in response to a judicial order or lawfully issued subpoena but generally must notify the student of the order or subpoena before complying. An exception to this general rule is that a federal grand jury subpoena or other subpoena issued for a law enforcement purpose may instruct the institution not to notify the student.
Yes. FERPA’s disclosure restrictions apply only to information derived from student education records, not to personal knowledge derived from direct, personal experience with a student. For example, a faculty or staff member who personally observes a student engaging in erratic and threatening behavior is not prohibited by FERPA from disclosing that observation. (If at some point the employee describes the observation in a personally identifiable record, that record would be subject to FERPA protections. The employee would still be permitted to disclose the personal observation but would not be permitted to disclose the record of the observation unless one of the exceptions to FERPA applied or the student consented to the disclosure). Again, however, the employee generally should limit disclosure of such information to professionals trained to evaluate and manage it, as other privacy laws conceivably could apply and prohibit broader disclosures, depending upon the circumstances.
Students may have additional privacy rights under state privacy and confidentiality laws and under federal laws such as the Health Insurance Portability and Accountability Act (“HIPAA”). Moreover, certain professionals on campus, such as medical and mental health care providers, may be bound by professional obligations of confidentiality that require a higher burden to be met (such as a significant threat of serious and imminent harm to a specifically foreseeable victim) before disclosure of information in their possession may be made. Even when this is the case, however, other personnel on campus (such as a faculty member, dean of students or residential life employee) may disclose information about a student under the lower FERPA health and safety emergency standard if the circumstances warrant.
If the concern is that a student may engage in violent behavior, toward self or others, and the threat appears to be imminent, the employee should contact the campus police or security office immediately.
When circumstances reasonably permit, the employee should consult with professionals on campus or associated with the institution who may be able to assess the potential threat, identify resources for the student, and provide information that could assist in deciding on an appropriate course of action. In consultation with appropriate campus resources, a collective decision may then be made to contact a family member, an appropriate off-campus resource or others. FERPA would not present an obstacle to any of these disclosures.
Yes. Under one of FERPA’s many exceptions to the general prohibition against disclosure, campus personnel are free to share information from student education records with other “school officials” who have “legitimate educational interests” in the information. Each institution must define for itself who qualifies as a “school official” and what is a “legitimate educational interest” and give annual notice of its definitions to its students. These definitions can be quite broad – “school officials” need not be limited to “officers,” or even to employees, and “legitimate educational interests” (much like “education records”) need not be limited either to “academic” interests or to instances that are beneficial to the student. The Family Policy Compliance Office (“FPCO”), the office within the U.S. Department of Education charged with overseeing and enforcing FERPA, offers the following model definitions:
A school official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted as its agent to provide a service instead of using University employees or officials (such as an attorney, auditor, or collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks.
A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibilities for the University.
At institutions that follow these or similar models, an employee concerned that a student’s statements or behavior evidence a potential threat could – and should – share relevant information with the dean of students, the judicial affairs office, the campus counseling center, the campus law enforcement unit, or other appropriate “school officials” whose job it is to deal with such issues.
FERPA is not a serious impediment to the sharing of student information among campus officials or appropriate third parties when there is a legitimate concern relating to campus safety. Institutions may wish to review certain aspects of their current FERPA policies (such as what they include within the scope of “directory information,” who they include as “school officials,” and what they consider “legitimate educational interests”) in order to gain maximum flexibility and discretion for information sharing. As important as maintaining current policies is the need to educate those on campus about the true limits and applications of FERPA.
*Information provided by National Association of College and University Attorneys (NACUA)