Security

Understanding FERPA: How K–12 Schools Can Update Their Data Privacy Approach

The flow of student information is a sensitive issue, and it is important for schools to understand when, how and with whom they can share data.

Mike Chapple

Mike Chapple is associate teaching professor of IT, analytics and operations at the University of Notre Dame.

Administrators and educational staff at schools around the country understand the importance of protecting student privacy. The Family Educational Rights and Privacy Act, signed into law in 1974 by President Gerald Ford, created clear protections for student educational records, limiting the ways school officials can share those records with outside parties and ensuring parents retain access to information about their children.

FERPA is well known within the educational community, but it is often misunderstood. In many cases, administrators believe that FERPA prohibits them from sharing information with anyone, and it is sometimes used as the basis for restricting information sharing among educators within a school.

What Does FERPA Protect?

In a K–12 setting, the rights extended under FERPA typically apply to the parents of minor students under the age of 18. These protections include:

The right to review any educational records maintained by the school about their student
The right to request correction of information they believe is incorrect
The right to avoid disclosure of student records to third parties without written consent

There are quite a few exceptions to the disclosure consent requirement, including exceptions for basic biographical “directory” information and for cases where the information is being disclosed to authorized school officials for a legitimate educational purpose. Interpreting these provisions can be complicated, and the advice of an attorney who specializes in education law can be invaluable in navigating them.

5 Ways Schools Can Build a Modern Data Privacy Strategy

FERPA’s provisions are common-sense requirements that codify some of the foundational principles of privacy: Individuals should have the right to review and correct their records and control the disclosure of their personal information.

As schools seek to implement these basic principles in practice, they find the worlds of privacy and cybersecurity are intertwined and complex.

In the 45 years since FERPA became law, schools have replaced centralized paper records with distributed digital systems that require careful security controls.

Here are five things that schools can do today to ensure their privacy practices meet modern standards.

Train all faculty and staff on privacy provisions. In a world of distributed data, privacy becomes everyone’s responsibility. Faculty and staff with access to student information systems must understand that they should only retrieve information from that system when they have, in the words of FERPA, a “legitimate educational interest.” Unauthorized browsing of records may constitute a FERPA violation. Similarly, anyone accessing student educational records has a responsibility to protect the privacy of those records and should not disclose them to anyone not eligible to review them under FERPA.
Designate a FERPA guru. FERPA is a constant source of confusion among educators and administrators. Every district should have at least one designated subject matter expert with a deep understanding of the district’s privacy practices. Creating this position does not absolve others of responsibility for complying with FERPA, but it does give them a place to turn when they have questions about tricky privacy issues.
Implement strong, granular access controls. In the early days of student information systems, it wasn’t uncommon for all faculty and staff to have unrestricted access to student records. That approach is not consistent with the “legitimate educational interest” provision of FERPA. Schools should implement access controls that limit record access based upon an individual’s role. This may include both domain-based restrictions and student-based restrictions. For example, a teacher might have access to all record domains but be limited to students in their classes. Or, a school nurse might have access to records about all students, but that access might be domain-limited to health-related information.
Monitor for security threats. Cybersecurity threats are sophisticated and require specific expertise to combat. Districts should designate a technology staff member as their cybersecurity official and charge that person with monitoring security systems for threats. This includes analysis of security logs as well as periodic testing of security controls. Building a strong cybersecurity foundation reduces the likelihood of a major data breach.
Implement data loss prevention technology. One of the biggest challenges in protecting student privacy rests in understanding where educational records are stored and how they move on the network. DLP technology provides this insight, allowing security officials to inventory sensitive records and control their flow across the network. Properly implemented DLP technology can identify and block a potential privacy violation before it takes place.

Preserving privacy is a complex undertaking that requires a mix of sound policy, strong business practices and modern technology. This is a great time for schools to inventory their existing privacy practices and assess whether they are in line with contemporary best practices.