Student Records & Confidentiality Policies

Student Records & Confidentiality - Policy Q & A

Student Engagement

September, 2014
Ana M. Damme, Reece L. Peterson, & Ann O'Conner, University of Nebraska-Lincoln

This policy Q & A addresses the topic of the legal requirements for student records and confidentiality in school. A downloadable/printable PDF of this Q & A is available here.

List of Questions - click any question to jump straight to the answer


What is a student record?

Student records encompass all records, files, documents, and other materials that contain information directly related to the student and are maintained by the school or school employee (34 CFR § 99.3; National Forum on Education Statistics, 2006). Documents that would be included in the student record and protected by FERPA include but are not limited to the following: individualized education plans, immunization records, school nurse records, assessment results, social security number, attendance records, disciplinary records and transcripts (National Forum on Education Statistics, 2006).

Return to top

Do disciplinary matters have to be kept separate from academic matters in student records?

Yes. Files must have academic and disciplinary matters separate.

Return to top

What is FERPA and how is it different from HIPAA?

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects private information of students and allows parents to access and amend their children’s educational records (National Forum on Education Statistics, 2006). FERPA protects students from educational agencies sharing their private information without written parental consent of a parent (National Forum on Education Statistics, 2006). FERPA is different from the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. HIPAA was enacted to improve the efficiency and effectiveness of the health care system. HIPAA established national standards and requirements for handling private health information. Health care providers are required to protect the privacy and security of individually identifiable health information. Generally speaking, HIPAA does not apply to elementary or secondary schools because they are not a HIPAA-covered entity. Also, if schools maintain health information, it is kept in the student’s education record, which is covered under FERPA (Joint Guidance on FERPA and HIPAA, 2008).

Return to top

Do schools have information that may be covered by HIPAA?

Schools that are not subject to FERPA are subject to the HIPAA Privacy Rule. Schools that do not receive funding from the U.S. Department of Education (i.e., private schools) are not subject to FERPA and therefore, must comply with the HIPAA Privacy Rule with respect to the individually identifiable health information (Joint Guidance on FERPA and HIPAA, 2008).

Return to top

What is not included in the student record, and therefore not protected by the Family Educational Rights and Privacy Act (FERPA)?

Notes created by school employees such as teachers are not considered to be a part of the student record and protected by FERPA if they are only for temporary use. For instance, teachers will write notes for a temporary substitute and are only used for a temporary memory aid. These notes are kept in the sole possession of the maker (National Forum on Education Statistics, 2006).

Group information about students, which is not individually identifiable such as statistical analysis of student test scores, is also not covered.

Return to top

What is the school’s responsibility regarding records?

Under the Family Educational Rights and Privacy Act (FERPA), school employees are required to safeguard the confidentiality of student records. FERPA protects the privacy of students and their legal guardians (National Forum on Education Statistics, 2006). Schools are required to obtain parental written consent before they are allowed to share student identifiable information.

The school must also keep a record of all persons who have access to specific student records:

Nebraska Administrative Code, Chapter 51, 009.01D
Each participating agency shall keep a record of parties obtaining access to education records collected, maintained, or used (except access by parents and authorized employees of the participating service agency), including the name of the party, the date access was given, and the purpose for which the party is authorized to use the records

Return to top

What is confidentiality?

Confidentiality is a person’s obligation not to disclose or transmit information to unauthorized parties (National Forum on Education Statistics, 2006).

Return to top

Who has the right to view student records?

The student, parent or guardian, teachers, counselors, and school administrators are to have access to the school’s files or records maintained on students. This includes the right to inspect, review and obtain copies of these records. Auditing officials of the state or federal government and state educational authorities also have the right to view student files in certain circumstances discussed below (Neb. Rev. Stat. 79-2,104(1) and (3)).

And student and legal guardians have access to the student record. School employees with legitimate educational interests can have access to the student record, such as teachers, counselors or others working with that student. A legal guardian must provide written consent for all other people to have access to a student’s record (National Forum on Education Statistics, 2006) (Neb. Rev. Stat. 79-2,104(1)). Additionally, state and federal auditors, as well as state educational authorities, are permitted access to only the necessary information in student records to complete an audit. (Neb. Rev. Stat. 79-2,104(3)(a)).

Return to top

Can parents get a copy of their student’s records?

The parent can request a copy of their student’s record from the school; however, the school is allowed to require the parent to pay a reasonable copying fee for this service. The school can create a schedule of fees, which would include an appropriate cost for the reproduction of the student’s records.

Return to top

Can school districts charge a fee to copy student records?

Yes. The school district can establish a schedule of fees that includes the reasonable cost of reproduction of the student’s files or records, but the fee can’t prevent the parent or guardian from inspecting or reviewing the student’s file. The school can’t charge a fee for searching or retrieving student records.

Return to top

Can the school share a student record without consent?

Generally, schools cannot share student records without parental consent; however, there are exceptions. According to the National Forum on Education Statistics (2006), schools can share “information from student records to school officials with a legitimate educational interest in the information” (p. 2). An example would be if a third-party health provider or a physician needs access to the records. In this case, the privacy of the records would be covered under HIPAA (Joint Guidance on FERPA and HIPAA, 2008). Another scenario when student records can be shared without consent is when the student threatens to inflict serious and imminent bodily harm to oneself or fellow students (Joint Guidance on FERPA and HIPAA, 2008).

Return to top

What if a parent wants someone else like an outside therapist to have student records, can the school just release the records if the parent calls and asks them to?

No. The parent or guardian or the student (if they are of majority age) must provide written consent (Neb. Rev. Stat. 79-2,104(1)). This section does not preclude or prohibit the disclosure of student records to any other person or entity which may be allowed to have access pursuant to the federal Family Educational Rights and Privacy Act of 1974, 20 U.S.C. 1232g, as such act existed on February 1, 2013, and regulations adopted thereunder (Neb. Rev. Stat. 79-2,104(3)(b)). Otherwise, files and records are not to be divulged to any unauthorized person.

Return to top

Can a parent give access to their student’s record to an outside party such as a mental health provider or physician?

Generally, student records cannot be released without consent of the student or the parent. However, when the parent or student provides written consent to share the student record then the school must share the record with the outside person or agency.

Return to top

What happens to the student’s student record when he or she is not a minor?

Once a student is no longer a minor or is enrolled into a postsecondary institution, the rights under FERPA transfer from the parents to the student. However, if the student is a dependent to their parents for tax purposes, then the school can provide education records without the consent of the student (FERPA frequently asked questions, 2005).

Return to top

How long are student records maintained by schools?

Student records should be retained permanently. If a student has left the school and been continuously absent for at least three years. Disciplinary records, which are stored separately, should be destroyed after 3 years of continuous absence from the school. (Neb. Rev. Stat. 79-2,104(1)).

Return to top

How long must a school keep disciplinary records?

After a student has been continuously absent from school for three years, the disciplinary material must be removed and destroyed (Neb. Rev. Stat. 79-2,104(1)).

Return to top

How are records properly discarded by school staff?

After the end of the period for which records must be maintained, student records should be disposed in a way that maintains the confidentiality requirement. One way of disposing the student records properly would be to shred the documents.

Return to top

Do state and federal auditors and state educational authorities have unlimited access to student records?

No. They have access to records which are necessary for the auditing and evaluating of federally or state-supported education programs or in connection with the enforcement of legal requirements which relate to these programs. They can also have access to the records when the collection of personally identifiable data is specifically authorized by law, but this information must be maintained in a manner that will not allow anyone but the officials listed in this section to view it and it must be destroyed when no longer needed for the above listed tasks (Neb. Rev. Stat. 79-2,104(3)(a)).

Return to top

What is the Nebraska Legislature’s view on the sharing of student records?

The Legislature finds and declares that the sharing of student data, records, and information among school districts, educational service units, learning communities, and the State Department of Education, to the fullest extent practicable and permitted by law, is vital to advancing education in this state. Whenever applicable law permits the sharing of such student data, records, and information, each school district, educational service unit, and learning community shall comply unless otherwise prohibited by law. The State Board of Education shall adopt and promulgate rules and regulations providing for and requiring the uniform sharing of student data, records, and information among school districts, educational service units, learning communities, and the department (Neb. Rev. Stat. 79-2,104(4)).

Return to top

When was this law last updated?

The Nebraska Law was last updated in 2013 (Neb. Rev. Stat. 79-2,104). FERPA was passed in 1974 last updated in 2011. HIPAAnwas enacted in 1996.

Return to top