POLICY LETTER: April 17, 2008 to Mountain Plains Regional Resource Center Director John Copenhaver

April 17, 2008Dr. John Copenhaver DirectorMountain Plains Regional Resource CenterCenter for Persons with DisabilitiesUtah State University1780 North Research ParkwaySuite 112Logan, Utah 84341Dear Dr. Copenhaver:This letter is in response to your March 15, 2006, letter to the Family Policy Compliance Office (FPCO), which administers the Family Educational Rights and Privacy Act (FERPA). FPCO referred your letter to the Office of Special Education Programs (OSEP) because your question relates to monitoring activities under regulations promulgated pursuant to Part B of the Individuals with Disabilities Education Act (IDEA). FPCO has consulted with OSEP and concurs in this response.In your letter, you note that States are required under IDEA to monitor local educational agencies (LEAs), or school districts, to help ensure that they are meeting the requirements of IDEA. (See 34 C.F.R. 300.600, which became effective on October 13, 2006, and section 616 of the IDEA.) Neither the IDEA nor the Department's regulations set out the specific procedures that a State must use in carrying out its monitoring activities. You also note that States normally use State educational agency (SEA) staff to monitor school districts, and that some activities during monitoring include interviews, classroom observations, and student record reviews. Some States, according to your letter, have chosen to use parents and other volunteers to assist with monitoring activities; these persons are provided access to student special education records and also interact with teachers regarding student programs. Specifically, you ask "... is it a violation of FERPA in this circumstance to provide parents and volunteers outside the school district access to student special education records and information?" You also ask, "Would parents of children with disabilities need to he notified or provide consent for their child's records to be reviewed by these parents and volunteers used by the State?"FERPA applies to an "educational agency or institution" to which funds have been made available under any program administered by the Department. 34 C.F.R. 99.1(a). This generally includes all LEAs that provide special education and related services to students under Part B of the IDEA. Under 34 C.F.R. 99.30 of the FERPA regulations, a parent or eligible student must provide a signed and dated written consent before an educational agency or institution discloses personally identifiable information from a student's education records.Page 2 Dr. John CopenhaverExceptions are set forth in 34 C.F.R. 99.31. One of those exceptions allows an educational agency or institution to disclose personally identifiable information from education records to authorized representatives of State educational authorities in connection with an audit or evaluation of a Federal or State supported education program, or for the enforcement of or compliance with Federal legal requirements that relate to those education programs. 34 C.F.R. 99.31(a)(3)(iv) and 99.35.In a State that receives funds under Part B of the IDEA, the Part B regulations apply to all "public agencies" involved in the education of children with disabilities regardless of whether that agency receives funds under Part B. 34 C.F.R. 300.2; 300.33. The Part B, IDEA regulations contain Confidentiality of Information requirements at34 C.F.R. 300.610 through 300.627 that apply to "any agency or institutions that collects, maintains, or uses personally identifiable information, or from which information is obtained, under Part B of [the IDEA]," known as "participating agencies." 34 C.F.R. 300.611(c). The Part B Confidentiality of Information regulations contain many of the same provisions that exist under FERPA and some that do not; the Part B Confidentiality of Information regulations apply to participating agencies whether or not the participating agency is an "educational agency or institution" subject to FERPA. For example, all persons collecting or using personally identifiable information must receive training or instruction concerning the State's policies and procedures for ensuring confidentiality under Part B and FERPA, whether or not the persons are educational agencies or institutions. 34 C.F.R. 300.623(c). This requirement is part of the Secretary's responsibility in accordance with FERPA to "take appropriate action ... to ensure the protection of the confidentiality of any personally identifiable data, information, and records collected or maintained" by a state or local educational agency pursuant to Part B. 34 C.F.R. 300.610.The requirements for disclosing information under Part B are set forth at34 C.F.R. 300.622. Under 34 C.F.R. 300.622(a), with one exception, parental consent must be obtained before personally identifiable information is disclosed to parties other than officials of participating agencies. For parties other than officials of participating agencies, the exception is that consent is not required if "the information is contained in education records, and thedisclosure is authorized without parental consent under [FERPA]." Also, for information outside of FERPA's scope, parental consent is not required before "personally identifiable information" is released to officials of participating agencies for the purpose of meeting a requirement of Part B.34 C.F.R. 300.622(b)(1).1 That is, for disclosures of education records or personally identifiable information contained therein (which are covered by FERPA) to participating agencies and non-participating agencies, parental consent is not required if the disclosure comes within an exception listWe conclude, therefore, that for the purposes of FERPA, an "authorized representative" of a State educational authority must be under the direct control of that authority, e.g., an employee or a contractor of the authority.littp://www.ed.gov/policy/gen/guid/secletter/030130.html. In regard to the meaning of "contractor" in this context, FPCO has explained:"Contractor" in this sense means outsourcing or using third-parties to provide services that the State educational authority would otherwise provide for itself, in circumstances where internal disclosure would be appropriate under 99.35 if the State educational authority were providing the service itself, and where the parties have entered into an agreement that establishes the State educational authority's direct control over the contractor with respect to the service provided by the contractor. Any contractor that obtains access to personally identifiable information from education records in these circumstances is bound by the same restrictions on redisclosure and destruction of information that apply to the State educational authority itself under 99.35, and the State educational authority is responsible for ensuring that its contractor does not redisclose or allow any other party to have access to any personally identifiable information from education records.http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/ca21804.html.Accordingly, under FERPA. an educational agency or institution may disclose personally identifiable information contained in educational records without parental consent under FERPA to parents and other volunteers who assist with an SEA's Part B compliance monitoring if these parents and other volunteers meet the "authorized representatives" standard under 34 C.F.R. 99.31(a)(3) of the FERPA regulations.One of the ways that an SEA may demonstrate that it has established the requisite direct control and is taking reasonable steps to exercise that control over parents and volunteers is by requiring an appropriate written agreement between the SEA and each parent or volunteer involved in the State monitoring of LEAs for compliance as required under section 616 of IDEA and by providing such individuals with adequate training on the privacy protections of FERPA and thePage 4 Dr. John CopenhaverConfidentiality of Information requirements of Part B of the IDEA. 34 C.F.R. 300.623(c). If a State elects to use a signed written agreement between the SEA and a parent or volunteer, we would expect that the agreement would specify the individual's duties and responsibilities in connection with the monitoring for compliance that is required under section 616 of IDEA; explain that such duties require access to personally identifiable information at the LEA that is protected under the Confidentiality of Information provisions in Part B and FERPA; and bind the parent or volunteer to abide by the specific confidentiality requirements in Part B and FERPA. The provision of training to these parents and volunteers should, at a minimum, be no less than the training that the SEA provides to, or requires of, itsJennifer SheehyDirectorOffice of Planning and Policycc: LeRoy S. Rooker, Director Family Policy Compliance OfficeTwo exceptions exist to this rule that are not relevant here. Parental consent is always required under 34 C.F.R. 622(b)(2) and 622(b)(3), without regard to whether a FERPA exception would otherwise apply.April 17, 2008Dr. John Copenhaver DirectorMountain Plains Regional Resource CenterCenter for Persons with DisabilitiesUtah State University1780 North Research ParkwaySuite 112Logan, Utah 84341Dear Dr. Copenhaver:This letter is in response to your March 15, 2006, letter to the Family Policy Compliance Office (FPCO), which administers the Family Educational Rights and Privacy Act (FERPA). FPCO referred your letter to the Office of Special Education Programs (OSEP) because your question relates to monitoring activities under regulations promulgated pursuant to Part B of the Individuals with Disabilities Education Act (IDEA). FPCO has consulted with OSEP and concurs in this response.In your letter, you note that States are required under IDEA to monitor local educational agencies (LEAs), or school districts, to help ensure that they are meeting the requirements of IDEA. (See 34 C.F.R. 300.600, which became effective on October 13, 2006, and section 616 of the IDEA.) Neither the IDEA nor the Department's regulations set out the specific procedures that a State must use in carrying out its monitoring activities. You also note that States normally use State educational agency (SEA) staff to monitor school districts, and that some activities during monitoring include interviews, classroom observations, and student record reviews. Some States, according to your letter, have chosen to use parents and other volunteers to assist with monitoring activities; these persons are provided access to student special education records and also interact with teachers regarding student programs. Specifically, you ask "... is it a violation of FERPA in this circumstance to provide parents and volunteers outside the school district access to student special education records and information?" You also ask, "Would parents of children with disabilities need to he notified or provide consent for their child's records to be reviewed by these parents and volunteers used by the State?"FERPA applies to an "educational agency or institution" to which funds have been made available under any program administered by the Department. 34 C.F.R. 99.1(a). This generally includes all LEAs that provide special education and related services to students under Part B of the IDEA. Under 34 C.F.R. 99.30 of the FERPA regulations, a parent or eligible student must provide a signed and dated written consent before an educational agency or institution discloses personally identifiable information from a student's education records.Page 2 Dr. John CopenhaverExceptions are set forth in 34 C.F.R. 99.31. One of those exceptions allows an educational agency or institution to disclose personally identifiable information from education records to authorized representatives of State educational authorities in connection with an audit or evaluation of a Federal or State supported education program, or for the enforcement of or compliance with Federal legal requirements that relate to those education programs. 34 C.F.R. 99.31(a)(3)(iv) and 99.35.In a State that receives funds under Part B of the IDEA, the Part B regulations apply to all "public agencies" involved in the education of children with disabilities regardless of whether that agency receives funds under Part B. 34 C.F.R. 300.2; 300.33. The Part B, IDEA regulations contain Confidentiality of Information requirements at34 C.F.R. 300.610 through 300.627 that apply to "any agency or institutions that collects, maintains, or uses personally identifiable information, or from which information is obtained, under Part B of [the IDEA]," known as "participating agencies." 34 C.F.R. 300.611(c). The Part B Confidentiality of Information regulations contain many of the same provisions that exist under FERPA and some that do not; the Part B Confidentiality of Information regulations apply to participating agencies whether or not the participating agency is an "educational agency or institution" subject to FERPA. For example, all persons collecting or using personally identifiable information must receive training or instruction concerning the State's policies and procedures for ensuring confidentiality under Part B and FERPA, whether or not the persons are educational agencies or institutions. 34 C.F.R. 300.623(c). This requirement is part of the Secretary's responsibility in accordance with FERPA to "take appropriate action ... to ensure the protection of the confidentiality of any personally identifiable data, information, and records collected or maintained" by a state or local educational agency pursuant to Part B. 34 C.F.R. 300.610.The requirements for disclosing information under Part B are set forth at34 C.F.R. 300.622. Under 34 C.F.R. 300.622(a), with one exception, parental consent must be obtained before personally identifiable information is disclosed to parties other than officials of participating agencies. For parties other than officials of participating agencies, the exception is that consent is not required if "the information is contained in education records, and thedisclosure is authorized without parental consent under [FERPA]." Also, for information outside of FERPA's scope, parental consent is not required before "personally identifiable information" is released to officials of participating agencies for the purpose of meeting a requirement of Part B.34 C.F.R. 300.622(b)(1).1 That is, for disclosures of education records or personally identifiable information contained therein (which are covered by FERPA) to participating agencies and non-participating agencies, parental consent is not required if the disclosure comes within an exception listWe conclude, therefore, that for the purposes of FERPA, an "authorized representative" of a State educational authority must be under the direct control of that authority, e.g., an employee or a contractor of the authority.littp://www.ed.gov/policy/gen/guid/secletter/030130.html. In regard to the meaning of "contractor" in this context, FPCO has explained:"Contractor" in this sense means outsourcing or using third-parties to provide services that the State educational authority would otherwise provide for itself, in circumstances where internal disclosure would be appropriate under 99.35 if the State educational authority were providing the service itself, and where the parties have entered into an agreement that establishes the State educational authority's direct control over the contractor with respect to the service provided by the contractor. Any contractor that obtains access to personally identifiable information from education records in these circumstances is bound by the same restrictions on redisclosure and destruction of information that apply to the State educational authority itself under 99.35, and the State educational authority is responsible for ensuring that its contractor does not redisclose or allow any other party to have access to any personally identifiable information from education records.http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/ca21804.html.Accordingly, under FERPA. an educational agency or institution may disclose personally identifiable information contained in educational records without parental consent under FERPA to parents and other volunteers who assist with an SEA's Part B compliance monitoring if these parents and other volunteers meet the "authorized representatives" standard under 34 C.F.R. 99.31(a)(3) of the FERPA regulations.One of the ways that an SEA may demonstrate that it has established the requisite direct control and is taking reasonable steps to exercise that control over parents and volunteers is by requiring an appropriate written agreement between the SEA and each parent or volunteer involved in the State monitoring of LEAs for compliance as required under section 616 of IDEA and by providing such individuals with adequate training on the privacy protections of FERPA and thePage 4 Dr. John CopenhaverConfidentiality of Information requirements of Part B of the IDEA. 34 C.F.R. 300.623(c). If a State elects to use a signed written agreement between the SEA and a parent or volunteer, we would expect that the agreement would specify the individual's duties and responsibilities in connection with the monitoring for compliance that is required under section 616 of IDEA; explain that such duties require access to personally identifiable information at the LEA that is protected under the Confidentiality of Information provisions in Part B and FERPA; and bind the parent or volunteer to abide by the specific confidentiality requirements in Part B and FERPA. The provision of training to these parents and volunteers should, at a minimum, be no less than the training that the SEA provides to, or requires of, itsJennifer SheehyDirectorOffice of Planning and Policycc: LeRoy S. Rooker, Director Family Policy Compliance OfficeTwo exceptions exist to this rule that are not relevant here. Parental consent is always required under 34 C.F.R. 622(b)(2) and 622(b)(3), without regard to whether a FERPA exception would otherwise apply.April 17, 2008Dr. John Copenhaver DirectorMountain Plains Regional Resource CenterCenter for Persons with DisabilitiesUtah State University1780 North Research ParkwaySuite 112Logan, Utah 84341Dear Dr. Copenhaver:This letter is in response to your March 15, 2006, letter to the Family Policy Compliance Office (FPCO), which administers the Family Educational Rights and Privacy Act (FERPA). FPCO referred your letter to the Office of Special Education Programs (OSEP) because your question relates to monitoring activities under regulations promulgated pursuant to Part B of the Individuals with Disabilities Education Act (IDEA). FPCO has consulted with OSEP and concurs in this response.In your letter, you note that States are required under IDEA to monitor local educational agencies (LEAs), or school districts, to help ensure that they are meeting the requirements of IDEA. (See 34 C.F.R. 300.600, which became effective on October 13, 2006, and section 616 of the IDEA.) Neither the IDEA nor the Department's regulations set out the specific procedures that a State must use in carrying out its monitoring activities. You also note that States normally use State educational agency (SEA) staff to monitor school districts, and that some activities during monitoring include interviews, classroom observations, and student record reviews. Some States, according to your letter, have chosen to use parents and other volunteers to assist with monitoring activities; these persons are provided access to student special education records and also interact with teachers regarding student programs. Specifically, you ask "... is it a violation of FERPA in this circumstance to provide parents and volunteers outside the school district access to student special education records and information?" You also ask, "Would parents of children with disabilities need to he notified or provide consent for their child's records to be reviewed by these parents and volunteers used by the State?"FERPA applies to an "educational agency or institution" to which funds have been made available under any program administered by the Department. 34 C.F.R. 99.1(a). This generally includes all LEAs that provide special education and related services to students under Part B of the IDEA. Under 34 C.F.R. 99.30 of the FERPA regulations, a parent or eligible student must provide a signed and dated written consent before an educational agency or institution discloses personally identifiable information from a student's education records.Page 2 Dr. John CopenhaverExceptions are set forth in 34 C.F.R. 99.31. One of those exceptions allows an educational agency or institution to disclose personally identifiable information from education records to authorized representatives of State educational authorities in connection with an audit or evaluation of a Federal or State supported education program, or for the enforcement of or compliance with Federal legal requirements that relate to those education programs. 34 C.F.R. 99.31(a)(3)(iv) and 99.35.In a State that receives funds under Part B of the IDEA, the Part B regulations apply to all "public agencies" involved in the education of children with disabilities regardless of whether that agency receives funds under Part B. 34 C.F.R. 300.2; 300.33. The Part B, IDEA regulations contain Confidentiality of Information requirements at34 C.F.R. 300.610 through 300.627 that apply to "any agency or institutions that collects, maintains, or uses personally identifiable information, or from which information is obtained, under Part B of [the IDEA]," known as "participating agencies." 34 C.F.R. 300.611(c). The Part B Confidentiality of Information regulations contain many of the same provisions that exist under FERPA and some that do not; the Part B Confidentiality of Information regulations apply to participating agencies whether or not the participating agency is an "educational agency or institution" subject to FERPA. For example, all persons collecting or using personally identifiable information must receive training or instruction concerning the State's policies and procedures for ensuring confidentiality under Part B and FERPA, whether or not the persons are educational agencies or institutions. 34 C.F.R. 300.623(c). This requirement is part of the Secretary's responsibility in accordance with FERPA to "take appropriate action ... to ensure the protection of the confidentiality of any personally identifiable data, information, and records collected or maintained" by a state or local educational agency pursuant to Part B. 34 C.F.R. 300.610.The requirements for disclosing information under Part B are set forth at34 C.F.R. 300.622. Under 34 C.F.R. 300.622(a), with one exception, parental consent must be obtained before personally identifiable information is disclosed to parties other than officials of participating agencies. For parties other than officials of participating agencies, the exception is that consent is not required if "the information is contained in education records, and thedisclosure is authorized without parental consent under [FERPA]." Also, for information outside of FERPA's scope, parental consent is not required before "personally identifiable information" is released to officials of participating agencies for the purpose of meeting a requirement of Part B.34 C.F.R. 300.622(b)(1).1 That is, for disclosures of education records or personally identifiable information contained therein (which are covered by FERPA) to participating agencies and non-participating agencies, parental consent is not required if the disclosure comes within an exception listWe conclude, therefore, that for the purposes of FERPA, an "authorized representative" of a State educational authority must be under the direct control of that authority, e.g., an employee or a contractor of the authority.littp://www.ed.gov/policy/gen/guid/secletter/030130.html. In regard to the meaning of "contractor" in this context, FPCO has explained:"Contractor" in this sense means outsourcing or using third-parties to provide services that the State educational authority would otherwise provide for itself, in circumstances where internal disclosure would be appropriate under 99.35 if the State educational authority were providing the service itself, and where the parties have entered into an agreement that establishes the State educational authority's direct control over the contractor with respect to the service provided by the contractor. Any contractor that obtains access to personally identifiable information from education records in these circumstances is bound by the same restrictions on redisclosure and destruction of information that apply to the State educational authority itself under 99.35, and the State educational authority is responsible for ensuring that its contractor does not redisclose or allow any other party to have access to any personally identifiable information from education records.http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/ca21804.html.Accordingly, under FERPA. an educational agency or institution may disclose personally identifiable information contained in educational records without parental consent under FERPA to parents and other volunteers who assist with an SEA's Part B compliance monitoring if these parents and other volunteers meet the "authorized representatives" standard under 34 C.F.R. 99.31(a)(3) of the FERPA regulations.One of the ways that an SEA may demonstrate that it has established the requisite direct control and is taking reasonable steps to exercise that control over parents and volunteers is by requiring an appropriate written agreement between the SEA and each parent or volunteer involved in the State monitoring of LEAs for compliance as required under section 616 of IDEA and by providing such individuals with adequate training on the privacy protections of FERPA and thePage 4 Dr. John CopenhaverConfidentiality of Information requirements of Part B of the IDEA. 34 C.F.R. 300.623(c). If a State elects to use a signed written agreement between the SEA and a parent or volunteer, we would expect that the agreement would specify the individual's duties and responsibilities in connection with the monitoring for compliance that is required under section 616 of IDEA; explain that such duties require access to personally identifiable information at the LEA that is protected under the Confidentiality of Information provisions in Part B and FERPA; and bind the parent or volunteer to abide by the specific confidentiality requirements in Part B and FERPA. The provision of training to these parents and volunteers should, at a minimum, be no less than the training that the SEA provides to, or requires of, itsJennifer SheehyDirectorOffice of Planning and Policycc: LeRoy S. Rooker, Director Family Policy Compliance OfficeTwo exceptions exist to this rule that are not relevant here. Parental consent is always required under 34 C.F.R. 622(b)(2) and 622(b)(3), without regard to whether a FERPA exception would otherwise apply.April 17, 2008Dr. John Copenhaver DirectorMountain Plains Regional Resource CenterCenter for Persons with DisabilitiesUtah State University1780 North Research ParkwaySuite 112Logan, Utah 84341Dear Dr. Copenhaver:This letter is in response to your March 15, 2006, letter to the Family Policy Compliance Office (FPCO), which administers the Family Educational Rights and Privacy Act (FERPA). FPCO referred your letter to the Office of Special Education Programs (OSEP) because your question relates to monitoring activities under regulations promulgated pursuant to Part B of the Individuals with Disabilities Education Act (IDEA). FPCO has consulted with OSEP and concurs in this response.In your letter, you note that States are required under IDEA to monitor local educational agencies (LEAs), or school districts, to help ensure that they are meeting the requirements of IDEA. (See 34 C.F.R. 300.600, which became effective on October 13, 2006, and section 616 of the IDEA.) Neither the IDEA nor the Department's regulations set out the specific procedures that a State must use in carrying out its monitoring activities. You also note that States normally use State educational agency (SEA) staff to monitor school districts, and that some activities during monitoring include interviews, classroom observations, and student record reviews. Some States, according to your letter, have chosen to use parents and other volunteers to assist with monitoring activities; these persons are provided access to student special education records and also interact with teachers regarding student programs. Specifically, you ask "... is it a violation of FERPA in this circumstance to provide parents and volunteers outside the school district access to student special education records and information?" You also ask, "Would parents of children with disabilities need to he notified or provide consent for their child's records to be reviewed by these parents and volunteers used by the State?"FERPA applies to an "educational agency or institution" to which funds have been made available under any program administered by the Department. 34 C.F.R. 99.1(a). This generally includes all LEAs that provide special education and related services to students under Part B of the IDEA. Under 34 C.F.R. 99.30 of the FERPA regulations, a parent or eligible student must provide a signed and dated written consent before an educational agency or institution discloses personally identifiable information from a student's education records.Page 2 Dr. John CopenhaverExceptions are set forth in 34 C.F.R. 99.31. One of those exceptions allows an educational agency or institution to disclose personally identifiable information from education records to authorized representatives of State educational authorities in connection with an audit or evaluation of a Federal or State supported education program, or for the enforcement of or compliance with Federal legal requirements that relate to those education programs. 34 C.F.R. 99.31(a)(3)(iv) and 99.35.In a State that receives funds under Part B of the IDEA, the Part B regulations apply to all "public agencies" involved in the education of children with disabilities regardless of whether that agency receives funds under Part B. 34 C.F.R. 300.2; 300.33. The Part B, IDEA regulations contain Confidentiality of Information requirements at34 C.F.R. 300.610 through 300.627 that apply to "any agency or institutions that collects, maintains, or uses personally identifiable information, or from which information is obtained, under Part B of [the IDEA]," known as "participating agencies." 34 C.F.R. 300.611(c). The Part B Confidentiality of Information regulations contain many of the same provisions that exist under FERPA and some that do not; the Part B Confidentiality of Information regulations apply to participating agencies whether or not the participating agency is an "educational agency or institution" subject to FERPA. For example, all persons collecting or using personally identifiable information must receive training or instruction concerning the State's policies and procedures for ensuring confidentiality under Part B and FERPA, whether or not the persons are educational agencies or institutions. 34 C.F.R. 300.623(c). This requirement is part of the Secretary's responsibility in accordance with FERPA to "take appropriate action ... to ensure the protection of the confidentiality of any personally identifiable data, information, and records collected or maintained" by a state or local educational agency pursuant to Part B. 34 C.F.R. 300.610.The requirements for disclosing information under Part B are set forth at34 C.F.R. 300.622. Under 34 C.F.R. 300.622(a), with one exception, parental consent must be obtained before personally identifiable information is disclosed to parties other than officials of participating agencies. For parties other than officials of participating agencies, the exception is that consent is not required if "the information is contained in education records, and thedisclosure is authorized without parental consent under [FERPA]." Also, for information outside of FERPA's scope, parental consent is not required before "personally identifiable information" is released to officials of participating agencies for the purpose of meeting a requirement of Part B.34 C.F.R. 300.622(b)(1).1 That is, for disclosures of education records or personally identifiable information contained therein (which are covered by FERPA) to participating agencies and non-participating agencies, parental consent is not required if the disclosure comes within an exception listWe conclude, therefore, that for the purposes of FERPA, an "authorized representative" of a State educational authority must be under the direct control of that authority, e.g., an employee or a contractor of the authority.littp://www.ed.gov/policy/gen/guid/secletter/030130.html. In regard to the meaning of "contractor" in this context, FPCO has explained:"Contractor" in this sense means outsourcing or using third-parties to provide services that the State educational authority would otherwise provide for itself, in circumstances where internal disclosure would be appropriate under 99.35 if the State educational authority were providing the service itself, and where the parties have entered into an agreement that establishes the State educational authority's direct control over the contractor with respect to the service provided by the contractor. Any contractor that obtains access to personally identifiable information from education records in these circumstances is bound by the same restrictions on redisclosure and destruction of information that apply to the State educational authority itself under 99.35, and the State educational authority is responsible for ensuring that its contractor does not redisclose or allow any other party to have access to any personally identifiable information from education records.http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/ca21804.html.Accordingly, under FERPA. an educational agency or institution may disclose personally identifiable information contained in educational records without parental consent under FERPA to parents and other volunteers who assist with an SEA's Part B compliance monitoring if these parents and other volunteers meet the "authorized representatives" standard under 34 C.F.R. 99.31(a)(3) of the FERPA regulations.One of the ways that an SEA may demonstrate that it has established the requisite direct control and is taking reasonable steps to exercise that control over parents and volunteers is by requiring an appropriate written agreement between the SEA and each parent or volunteer involved in the State monitoring of LEAs for compliance as required under section 616 of IDEA and by providing such individuals with adequate training on the privacy protections of FERPA and thePage 4 Dr. John CopenhaverConfidentiality of Information requirements of Part B of the IDEA. 34 C.F.R. 300.623(c). If a State elects to use a signed written agreement between the SEA and a parent or volunteer, we would expect that the agreement would specify the individual's duties and responsibilities in connection with the monitoring for compliance that is required under section 616 of IDEA; explain that such duties require access to personally identifiable information at the LEA that is protected under the Confidentiality of Information provisions in Part B and FERPA; and bind the parent or volunteer to abide by the specific confidentiality requirements in Part B and FERPA. The provision of training to these parents and volunteers should, at a minimum, be no less than the training that the SEA provides to, or requires of, itsJennifer SheehyDirectorOffice of Planning and Policycc: LeRoy S. Rooker, Director Family Policy Compliance OfficeTwo exceptions exist to this rule that are not relevant here. Parental consent is always required under 34 C.F.R. 622(b)(2) and 622(b)(3), without regard to whether a FERPA exception would otherwise apply.