Summary

TOPIC ADDRESSED: Protection of Education Records
SECTION OF IDEA: Other Letters That Do Not Interpret the IDEA But May Be of Interest to Readers

Letter

October 7, 2005

B. Alan McGraw, Esq.
Altizer, Walk & White
209 East Main Street
P.O. Box 30
Tazewell, Virginia 24651

Dear Mr. McGraw:

This responds to your August 12, 2005, request for guidance on behalf of the Tazewell County, Virginia School Board about restricting physical access to education records. This Office is responsible for administering the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g and 34 CFR Part 99. Under that authority we investigate, process and review complaints and violations and provide technical assistance to ensure compliance with the statute and regulations. 34 CFR § 99.60(b).

FERPA provides that no funds administered by the Secretary of Education shall be made available to an educational agency or institution that has a "policy or practice of permitting the release of education records" or "providing access to" any personally identifiable information in education records, without the prior written consent of a parent or eligible student (as defined in § 99.3 of the regulations) except as authorized by law. See 20 U.S.C. § 1232g(b)(1) and (b)(2). Under § 99.30 of the regulations, a parent or eligible student must provide a signed and dated written consent before education records are disclosed, except as provided in § 99.31. "Disclosure" is defined to mean "to permit access to or the release, transfer, or other communication of personally identifiable information contained in education records to any party, by any means, including oral, written, or electronic means." 34 CFR § 99.3.

The term "education records" is defined in FERPA as those records that are directly related to a student; and maintained by an educational agency or institution, or by a party acting for the agency or institution. 34 CFR § 99.3. "Record," in turn, means "any information recorded in any way, including, but not limited to, hand writing, print, computer media, video or audio tape, film, microfilm, and microfiche." 34 CFR § 99.3.

While the law does not prescribe specific methods that should be used to protect education records from unauthorized access or disclosure, the prohibition in FERPA against disclosing or permitting access to education records without consent clearly does not allow an educational agency or institution to leave education records unprotected or subject to access by unauthorized individuals, whether in paper, film, electronic, or any other format. We interpret this prohibition to mean that an educational agency or institution must use physical, technological, administrative and other methods, including training, to protect education records in ways that are reasonable and appropriate to the circumstances in which the information or records are maintained.

Your letter indicates that the Tazewell County Board of Supervisors recently proposed a plan in which various county government offices and agencies would share computer network hardware, software, and personnel resources with the Tazewell County school system. According to your letter,

school system technical support personnel inform us that the county government's "penetration'" of the school system's network resources would be significant, such that electronic student educational records could be accessed by persons or entities not employed by the school system.

You explained that these individuals are not authorized to obtain access to education records, without consent, under § 99.31 of the regulations and you are concerned that the proposal would violate FERPA.

Based on the provisions described above, this Office would consider a record management system that allows unauthorized individuals to have access to education records to constitute a policy or practice of violating FERPA. In the context of paper records, for example, this means that a school district may not place the report cards of all students in a box on a teacher's or principal's desk and allow parents or students to look through the box to find the student's own record. Similarly, with respect to electronic recordkeeping, a school district may not maintain a system that provides for access to education records by parties that are not parents, students, authorized "school officials," or otherwise permitted to have access as specified in § 99.31 of the regulations.

I trust that the above information is helpful in explaining the scope and limitations of FERPA as it relates to your concern.

Sincerely,

/s/
LeRoy S. Rooker
Director
Family Policy Compliance Office