May 23, 2005

Ms. Ardith Lynch
Associate General Counsel
Office of the General Counsel
University of Alaska
PO Box 755160
Fairbanks, Alaska 99775-5610

Dear Ms. Lynch:

This responds to your August 25, 2004, letter asking for advice whether the University of Alaska (University) may disclose education records to the State's Legislative Audit Division without obtaining consent from the affected students under the Family Educational Rights and Privacy Act (FERPA). This Office enforces FERPA, 20 U.S.C. § 1232g, and provides technical assistance to ensure compliance with the statute and regulations, which are codified at 34 CFR Part 99.

Your letter explains that the Legislative Audit Division has asked the University to disclose the following information from the education records of all full-time students for the 2002-03 and 2003-04 school years: student's name; social security number; high school, including city, state, and year of graduation; tuition status (i.e., resident or non- resident); address of family; and campus attending. According to your letter, the Legislative Audit Division is performing an audit of residency requirements for State programs and would use these records to test compliance with statutes, regulations and policies established by the Board of Regents regarding payment of in-State or out-of-State tuition.

FERPA provides generally that an educational agency or institution may not disclose education records, or personally identifiable information from education records, without the prior written consent of a parent or eligible student (i.e., a student who has reached 18 years of age or attends a postsecondary institution). 20 U.S.C. § 1232g(b)(1) and (b)(2); 34 CFR § 99.30. One of the several exceptions to this requirement permits disclosure without consent of unblocked directory information. See 34 CFR §§ 99.3 ("Directory information") and 99.37. However, among the items requested by the Legislative Audit Division, a student's social security number and tuition status may not be designated and disclosed without consent as directory information because this is not the type of information "that would not generally be considered harmful or an invasion of privacy if disclosed." 34 CFR § 99.3 ("Directory information").

Another exception to the prior written consent requirement in FERPA allows an educational agency or institution to disclose education records to authorized representatives of "State and local educational authorities ... in connection with an audit or evaluation of Federal or State supported education programs ...." 34 CFR §§ 99.31(a)(3)(iv) and 99.35(a); 20 U.S.C. § 1232g(b)(3) and (b)(5). Section (b)(5) of the statute, which was added in 1979, refers to disclosure to "State and local education officials" for purposes of auditing or evaluating publicly funded education programs. In enacting this provision, Congress stated that the amendment

would correct an anomaly which presently exists in FERPA [interpreting section (b)(3), which refers to "State educational authorities."] The Department of HEW is now interpreting that legislation as precluding State auditors from requesting records on students in order to conduct State audits of local and State-supported programs. The Department has recognized that this situation hampers States in carrying out necessary audits and evaluations and has recommended that the Committee adopt this amendment.

H.R. Rep. No. 338, 96th Cong., 1st Sess. at 10 (1979), reprinted in 1979 U.S. Code Cong. & Admin. News 819, 824. While the 1979 amendment, like the original section (b)(3), refers to "education" officials, the Department has determined that this statutory exception should be interpreted to include State auditors, including those working for the legislative branch, based on the intent expressed in the legislative history. However, since a "State auditor" generally is not considered an "educational" official or authority, we limit application of this exception to State auditors conducting audits of education programs (i.e., testing compliance with applicable requirements) and apply the broader disclosure for "evaluation" purposes only to State or local "educational" authorities.

In this case, the Legislative Audit Division seeks to obtain education records to audit compliance with the State's residency requirements for payment of in-State tuition. We believe that this disclosure falls within the limits of §§ 99.31(a)(3)(iv) and 99.35 of the FERPA regulations as outlined above. Note further that disclosures to the Legislative Audit Division under this exception must be protected in a manner that does not permit personal identification of individuals by anyone except the officials listed in § 99.31(a)(3) and must be destroyed when no longer needed for the purposes for which it is disclosed. 34 CFR § 99.35(b). The University must also record the disclosures in accordance with § 99.32 of the FERPA regulations.

I trust that this responds to your inquiry and appreciate the opportunity to assist you in this matter.

Sincerely,

/s/

LeRoy S. Rooker
Director
Family Policy Compliance Office