Postsecondary officials are regularly asked to balance the interests of safety and privacy for individual students. While the Family Educational Rights and Privacy Act (FERPA) generally requires institutions to ask for written consent before disclosing a student's personally identifiable information, it also allows colleges and universities to take key steps to maintain campus safety. Understanding the law empowers school officials to act decisively and quickly when issues arise.

Health or Safety Emergency

In an emergency, FERPA permits school officials to disclose without student consent education records, including personally identifiable information from those records, to protect the health or safety of students or other individuals. At such times, records and information may be released to appropriate parties such as law enforcement officials, public health officials, and trained medical personnel. See 34 CFR § 99.31(a)(10) and § 99.36. This exception to FERPA's general consent rule is limited to the period of the emergency and generally does not allow for a blanket release of personally identifiable information from a student's education records. In addition, the Department interprets FERPA to permit institutions to disclose information from education records to parents if a health or safety emergency involves their son or daughter.

Disciplinary Records

While student disciplinary records are protected as education records under FERPA, there are certain circumstances in which disciplinary records may be disclosed without the student's consent. A postsecondary institution may disclose to an alleged victim of any crime of violence or non-forcible sex offense the final results of a disciplinary proceeding conducted by the institution against the alleged perpetrator of that crime, regardless of whether the institution concluded a violation was committed. An institution may disclose to anyone—not just the victim—the final results of a disciplinary proceeding, if it determines that the student is an alleged perpetrator of a crime of violence or non-forcible sex offense, and with respect to the allegation made against him or her, the student has committed a violation of the institution's rules or policies. See 34 CFR §§ 99.31(a)(13) and (14).

The Clery Act

The Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act requires postsecondary institutions to provide timely warnings of crimes that represent a threat to the safety of students or employees and to make public their campus security policies. It also requires that crime data be collected, reported, and disseminated to the campus community and to the Department annually. The Clery Act is intended to provide students and their families with accurate, complete, and timely information about safety on campuses so that they can make informed decisions. Such disclosures are permitted under FERPA. The following Web site provides more information about these and other provisions about campus safety: http://www.ed.gov/admins/lead/safety/campus. html.

Law Enforcement Unit Records

Many colleges and universities have their own law enforcement units to monitor safety and security in and around campus. Institutions that do not have specific law enforcement units may designate a particular office or school official to be responsible for referring potential or alleged violations of law to local police authorities. Investigative reports and other records created and maintained by these law enforcement units are not considered education records subject to FERPA. Accordingly, institutions may disclose information from law enforcement unit records to anyone, including outside law enforcement authorities, without student consent. See 34 CFR § 99.8.

While an institution has flexibility in deciding how to carry out safety functions, it must also indicate in its policy or in information provided to students which office or school official serves as the college or university's "law enforcement unit." (The institution's notification to students of their rights under FERPA can include this designation. As an example, the Department has posted a model notification on its Web site at http://www.ed.gov/policy/gen/guid /fpco/ferpa/ps-officials.html.)

Law enforcement unit officials who are employed by the college or university should be designated in the institution's FERPA notification as "school officials" with a "legitimate educational interest." As such, they may be given access to personally identifiable information from students' education records. The institution's law enforcement unit officials must protect the privacy of education records it receives and may disclose them only in compliance with FERPA. For that reason, it is advisable that law enforcement unit records be maintained separately from education records.

Disclosure to Parents

When a student turns 18 years old or enters a postsecondary institution at any age, all rights afforded to parents under FERPA transfer to the student. However, FERPA also provides ways in which schools may share information with parents without the student's consent. For example:

• Schools may disclose education records to parents if the student is a dependent for income tax purposes.

• Schools may disclose education records to parents if a health or safety emergency involves their son or daughter.

• Schools may inform parents if the student who is under age 21 has violated any law or its policy concerning the use or possession of alcohol or a controlled substance.

• A school official may generally share with a parent information that is based on that official's personal knowledge or observation of the student.

FERPA and Student Health Information

Postsecondary institutions that provide health or medical services to students may share student medical treatment records with parents under the circumstances described above. While these records may otherwise be governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HIPAA Privacy Rule excludes student medical treatment records and other records protected by FERPA. The Department plans to issue further guidance on the interplay between FERPA and HIPAA.

FERPA and Student and Exchange Visitor Information System (SEVIS)

FERPA permits institutions to comply with information requests from the Department of Homeland Security (DHS) and its Immigration and Customs Enforcement Bureau (ICE) in order to comply with the requirements of SEVIS. Officials who have specific questions about this and other matters involving international students should contact the U.S. Department of Education's Family Policy Compliance Office.

Transfer of Education Records

Finally, FERPA permits school officials to disclose any and all education records, including disciplinary records, to another institution at which the student seeks or intends to enroll. While student consent is not required for transferring education records, the institution's annual FERPA notification should indicate that such disclosures are made. In the absence of information about disclosures in the annual FERPA notification, school officials must make a reasonable attempt to notify the student about the disclosure, unless the student initiates the disclosure. Additionally, upon request, the institution must provide a copy of the information disclosed and an opportunity for a hearing. See 34 CFR § 99.31(a)(2) and § 99.34(a).

Contact Information

For further information about FERPA, please contact the Family Policy Compliance Office or visit its Web site.

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Ave. S.W.
Washington, DC 20202-5920
202-260-3887

For quick, informal responses to routine questions about FERPA, parents may also e-mail the Family Policy Compliance Office at FERPA.Customer@ED.Gov.

For inquiries about FERPA compliance training, e-mail FERPA.Client@ED.Gov.

Additional information and guidance may be found at FPCO's Web site at: http://www. ed.gov/policy/gen/guid/fpco/index.html.