In the aftermath of several high-profile campus security incidents that have occurred in the past decade, questions concerning access to student records have become a focal point for many university administrators, school security personnel and school police departments. These incidents have led campus officials to reconsider their practices and policies regarding access to student records and the circumstances when student records can be shared with others.
The Family Educational Rights and Privacy Act of 1974 (FERPA) provides the statutory framework that generally governs access to and disclosure of student records. Under FERPA, education records usually cannot be disclosed without a court order or consent of the student or parents of a minor student. FERPA's scope is wide as "education records" are broadly defined as records directly related to a student and maintained by an educational agency. (34 C.F.R. § 99.3.) The law only applies to educational institutions that receive funds under programs administered by the Department of Education.
While FERPA may appear to prohibit the disclosure of pertinent student information, the statute actually provides campuses with some flexibility regarding the sharing of student records between a school or university and its police or security personnel. It is important for education campuses to develop disclosure plans that are compliant with FERPA while also providing the greatest protection for students, faculty and staff.
1. When can campus police or security have access to student records?
FERPA allows a school to disclose education records to "school officials" who have "legitimate educational interests" in the information. (34 C.F.R. § 99.31(a)(1)(i)(A).). The Department of Education has determined that the school has broad discretion to designate those school officials who have legitimate educational interests in accessing education records. For example, the "Model Notification of Rights under FERPA for Postsecondary Institutions," promulgated by the Department of Education, provides that:
Schools or colleges that provide their campus police or security departments with access to student education records should expressly designate police or security personnel as "school officials" with "legitimate educational interests" in those records. Campus administrators must also keep in mind that the annual notification of FERPA rights must include the school's criteria for determining who constitutes a "school official" and what constitutes a "legitimate educational interest." Accordingly, educational institutions should carefully consider who to identify as school officials in order to provide school personnel and students with the greatest degree of security.
In the event that campus police or security personnel receive any education records, those records do not lose their protection under FERPA. Therefore, protocols should be implemented to ensure that education records are maintained confidentially and only disclosed in compliance with FERPA. It is generally advisable to maintain police records separately from education records.2. When can campus administration or faculty have access to school police records?
If FERPA allows campus police and security to access student records, does it also allow school and college administrators and faculty to access campus police records? In fact it does: FERPA expressly does not apply to - and does not prohibit the disclosure of - records maintained by a school's law enforcement unit. Like other terms in FERPA, which are defined broadly, "law enforcement unit" simply means the person, office or department authorized or designated to enforce laws or maintain the security and safety of the school.
While law enforcement records are accepted from FERPA's reach, the exception only applies to records that (1) are created by a law enforcement unit, (2) are created for law enforcement purposes and (3) are actually maintained by the law enforcement unit. All these elements must be present in order for law enforcement records to be exempt from FERPA restrictions.
For example, records that are created by the law enforcement unit for law enforcement purposes but maintained outside of the law enforcement unit, are not exempt from FERPA's coverage. Similarly, any records created and maintained by a law enforcement unit exclusively for a non-law enforcement purpose (such as a disciplinary action conducted by the school) do not qualify as exempt records and would be subject to FERPA if they directly relate to a student.
Administration and police officials also need to be careful of the way records are maintained. If a school treats police records as student records, then those records would likely be subject to FERPA restrictions. However, a school official with a legitimate educational interest could still be given access to those records based on the exception discussed previously.
On the other hand, if a college or K-12 campus keeps law enforcement records and student records separately, information within the law enforcement records likely will not be subject to FERPA. In such a case, the information could be disclosed subject only to any applicable state or local laws that might restrict access to those records.
It is also worth noting that the federal Clery Act, applicable to colleges and universities who participate in federal financial aid programs, requires the collecting, reporting and annual dissemination of crime data to the campus community. Such disclosures are permitted under FERPA since they do not contain personally identifiable information.
3. Does FERPA make any allowances for disclosure of information from student records in responding to emergencies?
In June 2010, the Department of Education released guidelines regarding disclosing information from student education records during emergencies. The guidelines clarify that FERPA is not supposed to be an obstacle when addressing emergencies and protecting student safety. Rather, school and university administrators, police and security officials should know that FERPA provides a great deal of flexibility to campuses in disseminating information in order to respond to emergency situations.
Regardless of who a university or K-12 institution designates as a school official with a legitimate interest in student records, where a health or safety emergency exists, campuses may disclose personally identifiable information from a student's education records to appropriate parties (such as campus police or security, other students, parents or outside law enforcement). The school would be required to show that there is an identifiable and significant threat to health and safety in order to demonstrate there is an emergency.
Mere possible or eventual emergencies - where the likelihood of the emergency actually occurring is unknown - may not justify the disclosure of student records and information. In addition, disclosure is limited to the period of the emergency and generally does not allow for a blanket release of all personally identifiable information from a student's education records. In other words, schools should only disclose whatever information is necessary in order to protect health and safety during an actual emergency.
Before personally identifiable information regarding students may be disclosed without written consent, campus officials also need to determine that the recipient needs the information to protect health or safety. There must be a rational basis for the school or university's decision to disclose information to the individuals who receive it. As long as a school can explain how the disclosure of information rationally relates to an emergency, the Department of Education usually will not second guess the decision to release that information.
FERPA tries to strike a balance between a college or K-12 school's need to disclose student records and a student's (and parent's) privacy expectations. Because of this, anytime an academic institution discloses information from a student's record, the campus must record in the student's education records the identifiable and significant threat that prompted the disclosure and the parties to whom information was disclosed. (34 C.F.R. § 99.32(a)(5).)
For colleges, the Clery Act requires schools provide timely warnings of crimes that represent a threat to the safety of students or employees. Under amendments to the Clery Act made in the aftermath of Virginia Tech, colleges are now also required to provide emergency warnings to alert the campus community of an immediate threat to the health or safety of students or employees. Under FERPA's emergency exception, these warnings might appropriately include information from a student's education record if the circumstances called for such disclosure.
Administration, police and security personnel need to be aware of the parameters established by FERPA. Given the discretion FERPA affords to campus administration, schools and universities should carefully review disclosure policies to allow for necessary disclosure during emergencies or to prevent emergencies.
Planning ahead can avoid FERPA acting as an impediment to the sharing of relevant student information between the school and its police or security personnel.
Article originally appeared in Campus Safety Magazine.