Ask the FERPA Professor

Dear FERPA Professor,  

The 2012 FERPA Guide, page 40, instructs institutions to maintain a record of disclosure “with the education records of the student”. Additionally, the 2012 FERPA Guide, page 163, outlines the requirement of recording the disclosure.

When presented with unintentional disclosures I have always kept my “FERPA Log” in case my institution is contacted by the U.S. Department of Education's Student Privacy Policy Office.

I am now wondering whether a note needs to be in the individual student records besides my summary “FERPA Log”.

Are there any guidelines/advice if a consolidated “FERPA Log” meets this requirement of recording the disclosures or is something needed at the individual student level?

For example, if a class of 20 students grades are mistakenly disclosed do we put a note on all 20 student records?

Thank you,

FERPA Curious

Dear FERPA-Curious,

It is nice to hear from you. Maybe 2024 is your year to make the AACRAO Annual in Columbus to participate in more FERPA discussions.

Concerning your questions below, the recordation requirement in FERPA found at § 99.32(a)(1) requires that an institution must maintain a record of "each disclosure of personally identifiable information from the education records of each student." § 99.32(a)(2) further requires the "institution shall maintain the record with the education records of the student." Thus, the example you give below concerning the 20 students would require that the disclosure notice be included in the education records of each of those students. In addition, the FERPA regulations don't differentiate between intentional and unintentional disclosures from a student's education record. You can find the FERPA disclosure definition at § 99.3"Disclosure" in the regulations.

I hope this is helpful in answering your questions. You can find the above-cited regulations on pages 163 and 153 of the 2012 AACRAO FERPA Guide.

The FERPA Professor