The Family Educational Rights and Privacy Act (FERPA): A Comprehensive Guide

Last updated 1 day ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

A parent who wants to see a child’s school records does not have to rely only on the school’s willingness to share them. The Family Educational Rights and Privacy Act (FERPA) gives parents a right to inspect education records and seek corrections.

FERPA rights transfer to students at age 18 or when they attend college at any age. A parent who once requested a child’s records can then need the student’s consent, or a specific disclosure exception, to see the college’s file.

What FERPA protects and which schools it covers

FERPA applies to schools receiving funding under programs administered by the U.S. Department of Education. Private and faith-based elementary and secondary schools generally do not receive that funding and generally are outside FERPA. For a private school, check the funding question before assuming either that FERPA applies or that it does not.

An education record must be directly related to a student and maintained by a school or a party acting for the school. Both parts matter: information about a child does not become a FERPA record simply because it concerns school.

Notes a teacher keeps only as a personal memory aid are excluded if they remain in the maker’s sole possession and are not shared except with a temporary substitute. School law-enforcement records have a separate exclusion when the school’s law-enforcement unit creates them for a law-enforcement purpose and maintains them. That exclusion does not cover records kept by another school component or records created and maintained exclusively for school discipline. The same incident can therefore produce records with different privacy rules, depending on their purpose and where they are kept.

FERPA generally defines a student as someone who is or has been in attendance at a school that maintains education records about that person. An applicant who never attends does not meet that attendance requirement, so a request for an admissions file from that school falls outside FERPA.

When parents’ rights become students’ rights

A student who reaches 18 or attends a postsecondary institution at any age becomes what FERPA calls an eligible student, and all FERPA rights transfer from the parent to the student. College attendance can therefore change who makes the privacy decisions before the student is legally an adult. A parent planning to discuss college records should settle the access arrangement with the student rather than rely on the high-school routine. A signed release can authorize the college to share specified records with the parent.

For a student under 18 attending both high school and college, parents retain FERPA rights over high-school records and the student holds the rights over college records.

Before rights transfer, either parent has full FERPA rights unless the school has evidence of a court order, state statute or legally binding document that specifically revokes them. A change in custody alone should not be treated as proof that a parent has lost every record-access right.

A college may disclose education records to the parents of a student who is a dependent under federal tax law. That is permission for the college, not a right for the parent; the student still holds the FERPA rights.

A college may also tell parents about an alcohol or controlled-substance violation if it determines that the student committed a disciplinary violation and the student is under 21 when disclosure occurs. This exception does not override a state law that prohibits the college from disclosing the information.

How to see a record and challenge an error

Start with the school’s annual FERPA notice and follow its record-access procedure. Identify the records sought and keep a dated copy of the request so the access deadline is clear. The school must provide access within a reasonable period, no more than 45 days after receiving the request.

If circumstances effectively prevent inspection and review, the school must provide copies or make another arrangement that allows access. A school may charge for copies unless the fee effectively prevents access, but it may not charge to search for or retrieve records. If distance or cost makes it impossible to inspect the records in person, say so in the request and ask for copies or another arrangement.

A school must not destroy education records while an inspection and review request is outstanding. When a record contains information about several students, the parent or eligible student may see only the specific information about that student.

Correction is different from appealing a decision

A parent or eligible student may ask to amend information believed to be inaccurate, misleading or in violation of the student’s privacy rights. The school must decide whether to amend the record within a reasonable time. Point to the disputed entry and explain the factual or privacy problem that needs correction.

FERPA does not require a school to change substantive grades, performance evaluations or disciplinary decisions through its record-amendment procedure. A grade recorded incorrectly and a grade the student believes was unfair are different disputes. Use the school’s academic or disciplinary appeal process for the decision itself, while using record amendment for an error in what was recorded.

On request, a parent or eligible student has a right to a hearing to challenge record content as inaccurate, misleading or in violation of privacy rights. If the hearing does not produce a correction, the parent or student may place a statement in the record explaining the disagreement. That statement must remain with the contested part for as long as the record is maintained and accompany disclosures of that part.

When schools can share records without permission

Schools generally need signed and dated written consent before disclosing personally identifiable information from education records, unless a FERPA exception applies. The consent must identify the records, state the purpose and name the party or class of parties receiving the information.

Personally identifiable information includes direct identifiers and information that, alone or combined with other details, lets a reasonable person in the school community identify a student with reasonable certainty. Removing a name does not necessarily make a record anonymous. Consider what the remaining details reveal together, especially in a small class or distinctive incident.

School officials, including teachers, may access records without consent when the school determines they have legitimate educational interests. That means a school-related need for the records under the criteria the school must describe in its annual FERPA notice. An outsourced contractor can qualify as a school official if it performs a function otherwise handled by employees, is under the school’s direct control over the records and follows restrictions on use and redisclosure. Employment or a service contract is not, by itself, a reason to give someone every student’s file.

When a school sends records to another school where the student seeks to enroll or is already enrolled, it must reasonably attempt to notify the parent or eligible student unless that person initiated the disclosure or the annual notice says the school forwards records in those cases. The parent or eligible student may request a copy of the transferred record and an opportunity for an amendment hearing.

Schools may disclose records in connection with financial aid the student has applied for or received when the information is necessary to determine eligibility, the amount or conditions of aid, or to enforce its terms.

Schools may also disclose records to organizations conducting studies on their behalf to develop or administer predictive tests, administer student aid programs or improve instruction. Under that exception, the study must not let anyone other than representatives of the organization with legitimate interests identify students or parents, and the information must be destroyed when it is no longer needed for the study. The written agreement must specify the study’s purpose, scope, duration, disclosed information, permitted uses and the period for destroying the information.

When records go to an authorized representative for the audit or evaluation of a federal- or state-supported education program, the agreement must protect the information against unauthorized use and further disclosure, limit its use to authorized representatives with legitimate interests and specify when it must be destroyed.

A lawful subpoena or judicial order can permit disclosure, generally after reasonable advance notice so the parent or student can seek protective action. The notice requirement does not apply to a federal grand jury subpoena, or another subpoena issued for a law-enforcement purpose, when an order bars disclosing its existence or contents.

Parents and eligible students may inspect the school’s record of disclosures. Recipients generally may not redisclose protected information without consent, and their employees and agents may use it only for the original disclosure purpose.

An emergency requires a specific threat

A school may disclose records when it identifies an articulable and significant health or safety threat and the recipient needs the information to protect the student or others. In ordinary words, the school needs a threat it can explain and a reason that the particular recipient needs the information. For an emergency disclosure, the school must record the threat that justified it and the parties who received the information. Ask which emergency justified the disclosure and who received the records if this exception is disputed.

Directory information, school technology and health records

Public information still requires notice and a choice

A school may designate as directory information details not generally considered harmful or invasive to disclose, including names, contact information, photographs, majors and enrollment status. Before disclosing it, the school must give public notice of the designated types, explain the right to refuse and state a period for a written opt-out. Read the school’s actual list and opt-out instructions instead of assuming that a familiar item, such as a photograph, is always public.

A directory-information opt-out cannot prevent ordinary identification by name, identifier or institutional email in class, or a school’s requirement for a badge displaying properly designated directory information. The opt-out limits a category of disclosures; it does not make participation in school anonymous.

A photo or video can be an education record when it directly relates to a student and is maintained by the school or someone acting for it, subject to specific exclusions.

An education app does not move the school’s duty elsewhere

When an online service provider maintains education records, the school must still be able to give the parent or eligible student access to those records. Ask which records the service maintains and how the school will arrange access.

Student health records have a distinct boundary

Health records maintained by a covered elementary or secondary school, including school-nurse and immunization records, generally are FERPA education records. At covered colleges, student health records are either education records or treatment records under FERPA, and both are excluded from the Health Insurance Portability and Accountability Act (HIPAA) privacy rules, even if the school is a HIPAA-covered entity. The relevant question is which institution maintains the record and in what capacity, rather than simply whether the information is medical.

FERPA excludes treatment records from education records: they are records on a student who is 18 or older, or attending a postsecondary institution, that are made or maintained by recognized health professionals, used only for treatment and disclosed only to those providing treatment. Remedial educational activities and activities that are part of the school’s instructional program do not count as treatment for this exclusion. A school is not required to give an eligible student access to treatment records, but the student may have them reviewed by a physician or other appropriate professional of the student’s choice.

What to do when a school violates FERPA

Each year, a school must notify parents of attending students, or eligible students, of their rights to inspect and review records, seek amendment, consent to disclosures (subject to exceptions) and file a complaint with the Department of Education. The notice must include access and amendment procedures and, when the school-official exception is used, criteria for school officials and legitimate educational interests. Schools must effectively notify parents or eligible students with disabilities, and elementary and secondary schools must effectively notify parents whose primary or home language is not English. Keep the notice with a records request: it identifies the school’s own procedures and the standards it says it uses.

A parent or eligible student may submit a written FERPA complaint with specific factual allegations to the Education Department’s Student Privacy Policy Office. The official complaint form can be emailed to FERPA.Complaints@ed.gov or mailed to the office’s listed address. Use the official complaint page for the form and submission instructions, and include the disputed records, requests or disclosures that explain the problem.

A complaint generally must be submitted within 180 days of the violation or when the complainant knew or reasonably should have known of it. The office may extend that period for good cause. Do not let an unresolved discussion with a school obscure the federal filing deadline.

If compliance is not achieved, the Department can withhold further program payments, pursue a cease-and-desist order or terminate eligibility for program funding. FERPA itself does not give students or parents a private right to sue a school for violations, including through the federal civil-rights statute commonly called Section 1983. A federal complaint is therefore a route to institutional compliance, not a promise of personal damages.

The Unified Agenda reports regulatory and deregulatory activities that federal agencies are developing or reviewing.

As of October 3, 2026, the Department of Education’s 2026 Unified Agenda listed a FERPA rulemaking at the proposed rule stage, addressing record definitions, disclosures to third parties, subpoenas and enforcement. The agenda’s September 2026 target for a proposed rule was an estimate, and the entry lists no legal deadline. An agenda entry describes planned rulemaking; it does not itself rewrite the rights a family can exercise.