What Is an “Education Record” Under FERPA?
A Discussion and Flowchart
by Daniel J. Solove
The scope of coverage of the Family Educational Rights and Privacy Act (FERPA) of 1974, 20 U.S.C. § 1232g, is a challenging issue. It does not cover all information about students. Nor does it cover all information about people that a school maintains.
FERPA covers information from “education records,” which are “those records, files, documents, and other materials which contain information directly related to a student; and are maintained by an educational agency or institution.” FERPA, 20 U.S.C. § 1232g(a)(4)(A).
This is a very broad definition. It encompasses paper and electronic files, grades, video recordings, audio recordings, and other data. The personal knowledge and observations of educators that are not part of the record are not covered by FERPA.
FERPA applies to currently-enrolled students. Applicants, alumni, donors, employees, and others do not have FERPA rights. FERPA rights continue after a student graduates for the information in records while the student was enrolled. But if data is collected about an alumnus post-graduation, it is not part of the education record.
The following types of records are not considered “education records” under FERPA and are not regulated under FERPA:
(1) Law Enforcement Records. Records maintained by a separate law enforcement unit of a school are not considered “education records” and are not subject to FERPA protections.
(2) Treatment Records. Treatment records are the medical or psychological records of students 18 years or older who are being treated by a physician, psychiatrist, psychologist, or other related professional. They are not considered “education records.”
(3) Sole Possession Notes. “Sole possession notes” are notes that are (a) used only as a memory aid; (b) kept only by an employee for his or her own use; and (c) not shared with anyone.
It is important to note, though, that the types of records above can become education records in a number of circumstances. When used or disclosed in certain ways, they can be deemed education records and become FERPA-regulated.
Below is a flow chart I made to help make it easier to walk through the process of determining what is an “education record.” Please note that the flowchart is designed to focus on the main points and doesn’t delve into everything. It is designed to be a handy “cheat sheet” not to be serve as definitive legal advice.
Our FERPA Training + Other Education Privacy and Security Training
We have a training course on the Family Educational Rights and Privacy Act (FERPA) that is designed for administrators, faculty, and staff.
Our course (~15 minutes) provides a basic introduction to FERPA and practical guidance about how to comply. The course is taught by Professor Daniel Solove, who has taught in higher education for more than 15 years. Professor Solove teaches in a highly-engaging way that is ideally suited for the higher education context. The course is visually stimulating, interactive, and filled with concrete examples.
The course module is SCORM-compliant and works on most learning management systems.
In addition to FERPA training, we have short training courses on:
• cloud computing
• cyberbullying
• online gossip and self-exposure
• data security awareness
• phishing
• social engineering
• encryption
• portable electronic devices
• GLBA
• PCI payment card data
• FTC Red Flags Rule
• HIPAA
• research involving health data
Click here for a listing of our education privacy training courses.
Click here for a listing of all our information security awareness training courses.
Click here for a listing of our financial privacy topics.
Click here for our catalog.
About Professor Solove and TeachPrivacy
This resource page was written by Professor Daniel J. Solove. Professor Solove is a law professor at George Washington University Law School and the leading expert on privacy and data security law. He has taught for 15 years, has published 10 books and more than 50 articles, including the leading textbook on information privacy law and a short guidebook on the subject. His LinkedIn blog has more than 900,000 followers. Click here for more information about Professor Solove.
TeachPrivacy provides privacy awareness training, information security awareness training, phishing training, HIPAA training, FERPA training, PCI training, as well as training on many other privacy and security topics. TeachPrivacy was founded by Professor Solove, who is deeply involved in the creation of all training programs because he believes that training works best when made by subject-matter experts and by people with extensive teaching experience.
Please Contact Us If You Are Interested In Privacy and Data Security Training
We can provide you with a login so you can evaluate the programs. Click here for our catalog.