Disclosing Student Disciplinary Records: Understanding FERPA Guidelines

Last updated 3 months ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

The Family Educational Rights and Privacy Act (FERPA) is a cornerstone federal law that safeguards student education records privacy.

FERPA was enacted in 1974 (sometimes called the Buckley Amendment) and applies to educational agencies and institutions receiving funding from U.S. Department of Education programs.

What is FERPA and Who Does It Protect?

FERPA covers virtually all public K-12 schools, school districts, and most public and private postsecondary institutions. It serves dual purposes:

1. Granting parents (and eligible students) the right to access their education records and seek amendments when necessary
2. Establishing rules limiting the disclosure of personally identifiable information (PII) without appropriate consent

The U.S. Department of Education’s Student Privacy Policy Office (SPPO) is the primary authority for interpreting and enforcing FERPA. They provide guidance, technical assistance, and handle complaint investigations.

FERPA compliance isn’t optional. Educational institutions with policies or practices violating FERPA risk losing eligibility for DoE funds, making these privacy regulations a critical operational and legal requirement.

What FERPA Protects: Education Records and PII

Defining “Education Record”

FERPA defines “education records” broadly. To qualify as an education record, information must:

1. Be directly related to a student
2. Be maintained by an educational agency/institution or a party acting on its behalf (like a contractor)

The format doesn’t matter—FERPA protects information recorded in any way, including handwriting, print, computer media, email, video, audio, film, microfilm, and microfiche. Common examples include:

• Grades, test scores, and transcripts
• Class lists and student course schedules
• School-maintained health and immunization records (especially at K-12 level)
• Student financial aid records
• Records on services provided under disability laws
• Documentation of attendance, schools attended, awards, and degrees

Disciplinary Records ARE Education Records

Student discipline files are explicitly included within FERPA’s definition of education records. Records related to investigating, adjudicating, or imposing sanctions for student conduct violations are protected by FERPA’s privacy and disclosure requirements.

The concept of “maintenance” is key. Even informal notes or observations about a student, if shared among staff or placed where others can access them, can transform into protected education records. This requires school personnel to be conscious of how they document and share student information.

Defining Personally Identifiable Information (PII)

FERPA protects PII within education records. PII includes information that, alone or combined, could allow a reasonable person in the school community (without personal knowledge of relevant circumstances) to identify the student with reasonable certainty.

PII includes direct identifiers such as:

• Student’s name
• Names of student’s parents or family members
• Student or family address
• Personal identifiers (Social Security number, student ID, biometric record)

It also includes indirect identifiers:

• Date or place of birth
• Mother’s maiden name
• Other information linked or linkable to a specific student

A student’s Social Security number and, in most cases, their student ID number cannot be designated as less protected “directory information.”

What’s Not an Education Record? Key Exclusions

FERPA excludes specific categories from “education records,” meaning their disclosure isn’t governed by FERPA’s consent requirements:

Sole Possession Records: Notes kept by a school official for personal use as a memory aid, not accessible or revealed to anyone except a temporary substitute. Sharing these notes typically converts them into education records.

Law Enforcement Unit Records: Records created and maintained by an educational institution’s designated law enforcement unit for law enforcement purposes. A campus police report generated for law enforcement purposes isn’t likely an education record. However, a disciplinary record created by the Dean of Students office based on that police report is an education record. Information from education records shared with law enforcement officials remains protected under FERPA.

Employment Records: Records related solely to an individual’s capacity as an employee, provided employment isn’t contingent on their student status (work-study employment records are generally education records).

Treatment Records (Eligible Students): Records on students 18+ or attending postsecondary institutions, made or maintained by health professionals acting in professional capacity, used only for treatment, and disclosed only to treatment providers. If shared for non-treatment purposes, these become education records.

Applicant Records: Records of individuals who applied but never attended the institution.

Alumni Records: Records created or received after an individual is no longer a student and not directly related to their attendance.

Peer-Graded Papers: Grades on papers exchanged between students before collection and recording by the instructor.

Personal Knowledge/Observation: Information from a school official’s personal knowledge or observation, if not derived from an education record. For example, if a teacher overhears threats, FERPA doesn’t prevent reporting what was heard. However, if that observation leads to disciplinary action with a corresponding record, that record becomes a protected education record.

The Foundation: Consent for Disclosure

The General Rule: Prior Written Consent

As a general rule, an educational agency or institution must obtain signed and dated written consent from the parent (for K-12 students under 18) or the eligible student (students 18+ or attending postsecondary institutions) before disclosing PII from education records. This applies to disciplinary records just as it does to other education records.

Requirements for Valid Consent

For consent to be valid under FERPA (34 CFR § 99.30), it must:

• Be signed and dated by the parent or eligible student. Electronic signatures are acceptable if they reliably identify and authenticate the individual and indicate approval.
• Clearly identify the particular record(s) or information authorized for disclosure. Vague authorizations are insufficient.
• Explain why the disclosure is being made.
• Specify the party or class of parties receiving the disclosure.

Oral consent is not sufficient under FERPA to authorize education record disclosure.

The requirement for consent to specify records, purpose, and recipient highlights that FERPA anticipates informed, context-specific authorization. Schools generally cannot rely on a single “blanket” consent form signed at enrollment to cover all potential future disclosures of sensitive PII, such as disciplinary records, to various parties for different reasons.

Recordkeeping of Disclosures

When schools disclose PII from education records (with consent or through certain exceptions), they generally must maintain a record of that disclosure (34 CFR § 99.32). This disclosure record typically includes:

• The party requesting or receiving the information
• Their legitimate interest in requesting or obtaining the information
• The date of disclosure

This record must be maintained with the student’s education records for as long as the records themselves are maintained. Parents and eligible students have the right to inspect and review this disclosure record.

Recordkeeping isn’t required for disclosures made:

• To the parent or eligible student themselves
• To school officials with legitimate educational interests
• With written consent of the parent or eligible student
• As directory information
• Pursuant to federal grand jury or law enforcement subpoenas where a court ordered non-disclosure
• Pursuant to other subpoenas or court orders if the school successfully notified the parent/eligible student in advance

Who Holds the Rights? Parents vs. Eligible Students

The Transfer of Rights

In K-12 settings, FERPA rights (inspection/review, amendment, and consent to disclosure) belong to parents. FERPA defines “parent” broadly, including natural parents, guardians, or individuals acting as parents. Unless limited by court order or state law, both custodial and noncustodial parents generally have equal FERPA rights.

These rights transfer to the student when they either:

• Reach age 18, OR
• Attend a postsecondary institution at any age

Once rights transfer, the student becomes an “eligible student” under FERPA.

This transfer point is significant. Even if a student is under 18, enrolling in college courses (e.g., through dual enrollment) transfers FERPA rights for those college records to the student. Parents retain rights over K-12 records, but the student controls access and disclosure at the postsecondary level.

Impact on Parental Access, Especially at Postsecondary Level

Once a student becomes an “eligible student,” parents no longer have an inherent FERPA right to inspect or review the student’s education records, including disciplinary records, or to consent to their disclosure. The institution must generally obtain written consent directly from the student to share such information with parents.

The Tax Dependency Exception: A Pathway for Parental Access

Despite the transfer of rights, FERPA includes a significant exception allowing (but not requiring) postsecondary institutions to disclose an eligible student’s education records to parents without student consent if the student qualifies as a dependent for federal income tax purposes under Section 152 of the Internal Revenue Code (34 CFR § 99.31(a)(8)).

Key points about this exception:

• Permissive, Not Mandatory: FERPA permits this disclosure but doesn’t require it. The institution decides based on its own policies. Some institutions may not disclose to parents even if the student is a dependent, while others have policies allowing it. This institutional discretion means practices vary, and parents can’t assume automatic access simply by claiming tax dependency.
• Either Parent: If either parent claims the student as a dependent on their most recent tax return, the institution may disclose records to both parents.
• Proof May Be Required: Institutions may require documentation, such as recent federal income tax returns, to verify dependent status before granting access.

Dual Enrollment Considerations

For students simultaneously enrolled in high school and a postsecondary institution:

• FERPA rights transfer to the student for their postsecondary institution records, regardless of age.
• Parents retain FERPA rights for the student’s high school records (until the student turns 18).
• The two institutions may exchange information under the FERPA exception allowing disclosures to schools where a student seeks or intends to enroll.
• The postsecondary institution may still disclose records to parents under the tax dependency exception, even if the student is under 18, because attendance at the postsecondary institution makes them an “eligible student” for those records.

When Can Disciplinary Records Be Disclosed Without Consent?

While FERPA generally requires written consent for disclosing PII from education records, the law includes several important exceptions permitting disclosure without consent under specific circumstances. Understanding these exceptions is crucial when dealing with disciplinary records.

Crimes of Violence & Non-Forcible Sex Offenses (Postsecondary Only)

FERPA provides specific exceptions allowing postsecondary institutions to disclose limited information about disciplinary proceedings involving allegations of serious offenses. These exceptions don’t apply to K-12 schools.

Disclosure to the Victim (§99.31(a)(13))

A postsecondary institution may disclose the final results of a disciplinary proceeding to the victim of an alleged crime of violence or non-forcible sex offense. This disclosure is permitted regardless of whether the alleged perpetrator was found responsible.

Disclosure to the Public (§99.31(a)(14))

A postsecondary institution may disclose the final results of a disciplinary proceeding to the public only if:

1. The student is an alleged perpetrator of a crime of violence or non-forcible sex offense, AND
2. The student was found to have violated the institution’s rules or policies regarding that allegation

This applies only to proceedings with final results reached on or after October 7, 1998.

Definitions (§99.39)

FERPA regulations define:

• “Crime of violence”: Includes arson, assault (including stalking), burglary, criminal homicide, destruction of property, kidnapping, robbery, and forcible sex offenses
• “Non-forcible sex offense”: Includes incest and statutory rape
• “Final results”: Limited to the student perpetrator’s name, the violation committed, and any sanction imposed
• “Disciplinary action or proceeding”: Refers to investigation, adjudication, or imposition of sanctions for institutional rule violations

Limitations

These exceptions are specific to postsecondary institutions. The “final results” that can be disclosed are narrowly defined and don’t include details like investigation reports, witness statements, or specific findings beyond the violation itself. The name of any other student involved, including a victim or witness, cannot be disclosed without that student’s prior written consent.

School Officials with Legitimate Educational Interests (§99.31(a)(1))

This frequently used exception allows schools to share information internally without consent.

The Exception: FERPA permits disclosing PII from education records (including disciplinary records) without consent to school officials with legitimate educational interests in the information.

Who is a “School Official”? This typically includes teachers, principals, counselors, registrars, administrators, school board members, attorneys, and support staff. It can extend to contractors, consultants, volunteers, or other third parties to whom the institution has outsourced services, provided they:

• Perform a service the institution would otherwise use employees for
• Are under the institution’s direct control regarding use and maintenance of education records
• Are subject to FERPA’s requirements that PII be used only for authorized purposes and not redisclosed without consent
• Meet the criteria in the institution’s annual FERPA notification for being a school official with legitimate educational interest

What is a “Legitimate Educational Interest”? Though not explicitly defined in statute, this generally means the official needs to review an education record to fulfill their professional responsibility. Access shouldn’t be granted based on curiosity.

Institution Defines Criteria: Each educational institution determines its own specific criteria for “school officials” and “legitimate educational interests.” These criteria must be specified in the institution’s annual notification of rights. Institutions must use reasonable methods to ensure officials access only records in which they have legitimate educational interests.

Application to Disciplinary Records: This exception allows necessary internal communication about student discipline. For example, a principal can share information about a student’s suspension with the student’s teachers or counselor if they need that information to fulfill their duties. It also permits sharing information about students disciplined for conduct posing significant safety risks with officials at other schools who have legitimate educational interests.

The flexibility granted to institutions in defining these terms is significant. While intended to allow operational latitude, it means the practical scope of this exception can vary widely. Institutions must carefully craft definitions to ensure access is limited to those with genuine, job-related need-to-know, particularly for sensitive disciplinary records.

Transfers to Other Schools (§99.31(a)(2))

FERPA facilitates information transfer when students move between schools.

The Exception: Schools may disclose PII from education records without consent to officials of other schools where the student seeks or intends to enroll, or where the student is already enrolled, provided the disclosure relates to enrollment or transfer purposes.

Transferring Disciplinary Records: This exception explicitly allows K-12 schools and postsecondary institutions to forward disciplinary records (e.g., suspension or expulsion records) to receiving institutions. Federal law, through the Every Student Succeeds Act, requires states to have procedures facilitating disciplinary record transfers for K-12 students.

Notification and Rights: The disclosing school generally must make a reasonable attempt to notify the parent or eligible student about the disclosure. However, notification isn’t required if:

• The disclosure was initiated by the parent or eligible student, or
• The school’s annual FERPA notice states it forwards education records upon request for enrollment purposes

Parents or eligible students retain the right to request copies of disclosed records and to request amendments.

This exception balances the receiving school’s need for enrollment information (including potential safety concerns related to discipline) against student privacy. While necessary for smooth transitions, schools should be mindful that forwarding disciplinary history could impact a student’s integration into a new environment.

Health and Safety Emergencies (§99.31(a)(10) & §99.36)

In urgent situations, FERPA allows disclosure to protect individuals.

The Exception: Schools may disclose PII from education records (including relevant disciplinary information) without consent to appropriate parties if necessary to protect the health or safety of the student or others during an emergency.

Conditions for Disclosure:

• Actual Emergency: The disclosure must relate to an actual, impending, or imminent emergency (natural disaster, terrorist attack, campus shooting, epidemic, specific credible threat of violence). It generally doesn’t apply to hypothetical future emergencies.
• Articulable and Significant Threat: The school must determine, based on circumstances known at the time, that an articulable and significant threat to health or safety exists. “Articulable” means the official must be able to state the specific threat.
• Rational Basis: The U.S. Department of Education generally defers to the school’s judgment if a rational basis existed for determining an emergency, based on information available at the time. Absolute certainty isn’t required.
• Necessary Information: Disclosure must be limited to PII necessary for appropriate parties to address the specific emergency.

Application to Threats of Violence: This exception is particularly relevant for responding to threats. If a student poses a credible violence threat (making threats, bringing weapons, exhibiting concerning behavior), schools may disclose relevant PII, potentially including disciplinary history related to aggression or weapons, to law enforcement, threat assessment team members, or potential targets if deemed necessary to protect safety.

Limitations: This exception is temporary, limited to the emergency period. It doesn’t permit blanket information releases. Decisions must be made case-by-case. The school must record the articulable and significant threat basis for disclosure and the parties receiving information.

This exception requires difficult judgments, often quickly. The standard isn’t absolute proof of danger but a reasonable, articulable basis for concern based on available information. Careful documentation of threat assessment and disclosure rationale is crucial.

Judicial Orders and Lawfully Issued Subpoenas (§99.31(a)(9))

FERPA allows schools to comply with legal processes under specific conditions.

The Exception: Educational institutions may disclose PII from education records without consent to comply with judicial orders or lawfully issued subpoenas.

“Lawfully Issued”: Institutions should verify the subpoena or order is valid under applicable state or federal law before complying. Consulting legal counsel is advisable, especially regarding administrative versus court-issued orders.

Prior Notification Requirement: This crucial procedural safeguard requires institutions to make reasonable efforts to notify the parent or eligible student of the order or subpoena before complying. This gives the opportunity to seek protective action, like filing a motion to quash. What constitutes “reasonable effort” and sufficient time isn’t precisely defined but should be sensible given circumstances. The institution only needs to attempt notification; it doesn’t need permission to comply afterward.

Exceptions to Prior Notification: Prior notification isn’t required for:

• Federal grand jury subpoenas where the court ordered non-disclosure
• Any other subpoena issued for law enforcement purposes where the court or issuing agency ordered non-disclosure
• Certain ex parte court orders obtained by the U.S. Attorney General related to terrorism investigation or specific federal crimes

The notification requirement balances compliance with legal demands against privacy rights. It provides a chance for individuals to assert their rights unless a court or agency has determined secrecy is necessary for specific serious investigations.

Summary of Key Exceptions for Disciplinary Record Disclosure

Note: This table summarizes key exceptions relevant to disciplinary records. Other FERPA exceptions exist, such as for audits/evaluations, financial aid, studies, accrediting organizations, and directory information, which are not the primary focus here but are listed in 34 CFR § 99.31.

FERPA in Action: K-12 and Postsecondary Scenarios

Applying these complex rules can be challenging. The following scenarios illustrate how FERPA exceptions might work in practice regarding disciplinary records.

Scenario 1: K-12 Threat Assessment

Situation: A high school student posts threatening messages online targeting another student and referencing violence. School administrators become aware.

FERPA Application:

• Internal Sharing: The principal, school counselor, and perhaps a designated School Resource Officer (if meeting “school official” criteria in the school’s annual notice) can share information from existing education records, including past disciplinary incidents involving aggression or weapons, amongst themselves under the “school official with legitimate educational interest” exception (§99.31(a)(1)). This sharing is necessary for fulfilling professional responsibilities in threat assessment.
• External Sharing (Emergency): If school officials determine there’s an “articulable and significant threat” constituting a “health or safety emergency” (§99.31(a)(10)), they may disclose necessary PII (including threat nature and relevant disciplinary history) to external parties like local law enforcement or targeted student’s parents to protect safety. The school must have a rational basis for this determination and document the disclosure.
• Personal Observation: Information officials obtained through personal observation (seeing the threatening post directly, observing student behavior) isn’t initially protected by FERPA and can be shared more freely. However, if these observations lead to creating a disciplinary record, that record becomes protected.

Scenario 2: K-12 Transfer with Disciplinary History

Situation: A middle school student is suspended for bringing a knife to School A. The family moves, and the student seeks to enroll in School B in a different district.

FERPA Application: School A may disclose the student’s disciplinary records related to the suspension to School B officials under the “transfer” exception (§99.31(a)(2)), as this information is relevant to enrollment and School B’s need to understand potential safety or support needs. School A should either attempt to notify the parents beforehand or ensure its annual FERPA notice informs parents that records are forwarded upon request to schools where students seek to enroll.

Scenario 3: Postsecondary Sexual Assault Disciplinary Outcome

Situation: Following a formal disciplinary process, University Z finds Student X responsible for sexually assaulting Student Y, violating the university’s code of conduct (a crime of violence or non-forcible sex offense).

FERPA Application:

• Disclosure to Victim: University Z may disclose the “final results” (Student X’s name, the specific violation found, and the sanction imposed, like suspension) to the victim, Student Y, under the “crime of violence/sex offense – victim” exception (§99.31(a)(13)).
• Disclosure to Public: Because Student X was found responsible, University Z may also disclose these same limited “final results” (name, violation, sanction) to the public under the “crime of violence/sex offense – public” exception (§99.31(a)(14)).
• Limitations: The university cannot disclose Student Y’s name or any identifying information about the victim or witnesses without their consent. Information disclosed as “final results” is strictly limited.

Scenario 4: Postsecondary Subpoena for Disciplinary Records

Situation: A local court issues a subpoena to University W demanding copies of a specific student’s disciplinary records related to vandalism charges being prosecuted off-campus.

FERPA Application: Assuming the subpoena is “lawfully issued” under state law, University W may comply under the “judicial order/subpoena” exception (§99.31(a)(9)). However, before releasing records, the university must make a reasonable effort to notify the student (who is an eligible student) about the subpoena to allow time to potentially challenge it in court. This notification is only waived if a specific condition applies, such as a court order prohibiting notification.

Scenario 5: Parent Request for 19-Year-Old College Student’s Disciplinary Record

Situation: A parent contacts the Dean of Students at College V, concerned about their 19-year-old daughter’s academic standing after hearing she was placed on disciplinary probation.

FERPA Application:

• Rights Holder: The 19-year-old daughter is an “eligible student” because she attends a postsecondary institution. Her FERPA rights belong to her, not her parents.
• General Rule: College V generally cannot discuss the student’s disciplinary status or records with the parent without the student’s signed, written consent.
• Dependency Exception: However, if the parent provides proof (e.g., tax forms) that they claim the daughter as a dependent for IRS tax purposes, College V may (but is not required to) disclose the disciplinary information to the parent under the “parent of dependent student” exception (§99.31(a)(8)). The college’s own policy will determine if they exercise this option.

Key Differences: K-12 vs. Postsecondary Disciplinary Disclosures

Official Resources for Further Guidance

Navigating FERPA, especially concerning sensitive disciplinary records, requires careful attention to the law and regulations. The U.S. Department of Education’s Student Privacy Policy Office (SPPO) provides numerous resources to assist schools, parents, and students.

Primary Official Website

The central hub for all official FERPA information, guidance, training materials, and resources is the SPPO website.

Key Guidance Documents and Links

• The FERPA Statute (20 U.S.C. § 1232g): Available through government legislative sites or linked via SPPO.
• The FERPA Regulations (34 CFR Part 99): The official rules implementing the law. Accessible directly via the Electronic Code of Federal Regulations or through the SPPO site’s FERPA page.
• A Parent Guide to FERPA: Provides general information for parents on their rights.
• An Eligible Student Guide to FERPA: Explains rights once they transfer to the student.
• FERPA Frequently Asked Questions (FAQs): Addresses common questions on various FERPA topics.
• Guidance on School Resource Officers, School Law Enforcement Units, and FERPA (Feb 2019): Relevant for understanding interactions between schools and law enforcement, including health/safety exceptions.
• FERPA Guidance for School Officials on Student Health Records (April 2023): While focused on health records, it contains relevant information on definitions, consent, exceptions (including health/safety), and interactions with third parties.

Contacting SPPO

For specific questions not answered by available resources, or to report a potential violation:

• File a Complaint: Instructions and forms are available at https://studentprivacy.ed.gov/file-a-complaint. Complaints generally must be filed within 180 days of the alleged violation.
• Student Privacy Help Desk (Technical Assistance): Email [email protected] or call 1-855-249-3072.

Our articles make government information more accessible. Please consult a qualified professional for financial, legal, or health advice specific to your circumstances.