glossaryPage.heroH1
glossaryPage.heroSubtitle
glossaryPage.definitionTitle
FERPA compliance is the operational practice of protecting student education records under the Family Educational Rights and Privacy Act (US, 1974), codified at 20 USC §1232g. It requires institutions to control access, audit disclosures, respect parental rights until the student turns 18 (then student rights), and allow inspection and correction of records.
glossaryPage.howItWorksTitle
FERPA compliance is implemented through layered controls inside the school's student information system. Access is role-based and scoped by audience: parents see their child's record until age 18, students gain rights at 18 or upon postsecondary enrollment, teachers see only assigned classes, administrators see institution-wide data, and third-party vendors operate under written data-sharing agreements. Every record access is written to an immutable audit log capturing user, record, action, and timestamp. Consent is captured electronically before any disclosure of non-directory information. The system automatically flips the access model from parent to student on the eligible birthday or matriculation event. Retention schedules and secure destruction policies (cryptographic erasure or shredding) close the record lifecycle in line with US Department of Education guidance.
glossaryPage.whySchoolsTitle
Schools maintain FERPA compliance primarily because federal funding eligibility depends on it: institutions receiving funds under Title IV of the Higher Education Act or programs administered under the Elementary and Secondary Education Act (ESEA) must comply, or the US Department of Education's Student Privacy Policy Office can withdraw funds. Office for Civil Rights penalties for unresolved violations typically reach $35,000 to $45,000 per incident, and repeat findings escalate. Beyond federal exposure, FERPA compliance underpins the trust parents and students place in the institution, and it forces disciplined due diligence on third-party vendors such as the learning management system, library platform, and assessment tools that touch student records.
glossaryPage.keyFeaturesTitle
- Role-based record access scoped to parent, student, teacher, administrator, and third-party vendor audiences
- Immutable audit log capturing every disclosure with user, record, action, and timestamp
- Electronic consent capture before disclosing any non-directory personally identifiable information
- Automated access flip from parent to student on the eligible birthday or postsecondary enrollment
- Retention schedules and secure destruction policies aligned with US Department of Education guidance
- Written third-party-vendor data-sharing agreements for LMS, SIS, and library platforms
glossaryPage.faqTitle
What is the difference between FERPA and HIPAA?
FERPA governs education records held by schools that receive US federal funding; HIPAA governs protected health information held by covered health providers and plans. School-based health records maintained by the institution generally fall under FERPA, not HIPAA, per joint guidance from the US Departments of Education and Health and Human Services.
What counts as an education record under FERPA?
An education record is any record directly related to a student that is maintained by an educational agency or institution, or by a party acting on its behalf, per 20 USC §1232g(a)(4). It includes grades, transcripts, disciplinary files, attendance, and most teacher notes shared with others. Sole-possession notes, law-enforcement-unit records, and employment records are excluded.
Can schools share directory information without consent?
Yes. FERPA permits disclosure of directory information (typically name, address, dates of attendance, honors) without consent, provided the school gives annual public notice of the categories it considers directory information and a reasonable opportunity for parents or eligible students to opt out before disclosure occurs.
How does FERPA compare to GDPR for student data?
FERPA is a US sectoral law specific to education records and centered on access and disclosure controls; GDPR is a horizontal EU regulation covering all personal data with broader rights to erasure, portability, and lawful-basis documentation. Schools serving both US and EU students must satisfy both regimes, treating GDPR as the higher floor for consent and data-subject rights.
glossaryPage.relatedTitle
¿Listo para Transformar Su Institución?
Vea cómo OpenEduCat libera tiempo para que cada estudiante reciba la atención que merece.
Pruébelo gratis por 15 días. No se requiere tarjeta de crédito.