New Guidance Addresses FERPA Related to School Safety

On the heels of a report by the Federal Commission on School Safety suggesting that many school leaders remain confused about the ability to share student identifying information during an emergency situation, the Department of Education’s Privacy Technical Assistance Center recently released a Q&A document addressing this issue. The guidance discusses sharing information with school resource officers (SROs), other law enforcement officials, and other community resources in the face of a school-based threat, as well as upon a student’s transfer to a new school. With the increased focus on these issues in recent months, schools should consider preparing procedures or other guidelines for school leaders to use in an emergency situation, reviewing directory information policies and annual FERPA rights documents, and creating or updating reciprocal reporting agreements to reduce confusion and undue delay when information needs to be shared in response to school threat.

While parental consent is generally required before a school can share student records and personally identifiable information with third parties, the guidance is a reminder of important exceptions that apply when school safety is at issue. The Q&A document addresses the following situations in which schools may share information in an emergency:

• Directory Information. A school or district can disclose directory information to third parties, including law enforcement, without parental consent at any time, including in response to a school threat. FERPA defines directory information as information contained in a student’s education record that would not generally be considered harmful or an invasion of privacy if disclosed, such as name, address, telephone number, email address, birth date, and grade level. The district must give parents notice of what information it has designated as directory information as well as an opportunity to opt-out of disclosure, which most schools do at the start of each school year. Districts should consider whether their directory information definitions and notice are as broad as necessary to facilitate the sharing of important information in an emergency.
• School Officials. Education records and personally identifiable information in those records may be disclosed to school officials with a legitimate educational interest in the records, including in the case of a school threat. The district must include in its annual notice of FERPA rights who constitutes a school official and what constitutes a legitimate educational interest. Generally, school officials are school employees like a teacher, principal, school nurse, or counselor; but school officials can also include third parties who perform a service that the school would otherwise provide, are under the control of the district with respect to the use, maintenance, and redisclosure of educational records, and otherwise meet the definitions of school officials with legitimate educational interests in the records. Accordingly, SROs and other law enforcement officials can review education records as school officials if they meet the stated criteria. A contract, reciprocal reporting agreement, or MOU should outline these criteria and responsibilities to ensure FERPA compliance. Additionally, members of the school’s threat assessment team, which may include law enforcement officials, mental health professionals, and other experts in the community, can also review education records as school officials if they meet the stated criteria. An agreement regarding or acknowledgment of FERPA requirements is best practice to ensure compliance, so we recommend regular reviews of relevant documents with an eye toward what information might need to be shared—and with whom—in the case of an emergency.
• Health or Safety Emergencies. FERPA provides that education records and personally identifiable information in those records can be disclosed without parental consent in the event of a specific and articulable threat of a health or safety emergency when disclosure to appropriate parties is necessary to protect the health or safety of the student or other individuals. This is an important exception when dealing with school threats. While the relevant terms are not defined in FERPA, a school official should be able to explain the threat, its significance, and why disclosure will assist in protecting people from the threat. In Illinois, the Illinois School Student Records Act and its implementing regulations also give factors to consider when determining whether it is appropriate to release records under this exception. We recommend that districts prepare written guidance for relevant school leaders to help them easily comply with all legal requirements during the often-stressful times surrounding a school threat.

Schools need a clear understanding of these and other requirements under FERPA, and the Q&A guidance is a helpful resource for gaining that understanding.