FERPA is the Family Educational Rights and Privacy Act, a federal law that lets parents, and students once they turn 18 or enter college, inspect their education records and decide who else gets to see them, with a right to ask for corrections. It applies to schools that receive U.S. Department of Education funds. That is why a college may refuse to discuss a student's grades with a parent, even a parent who pays the tuition.
Which schools does FERPA cover?
The regulations apply to a school or school agency that receives money under a program the Secretary of Education administers. Public school districts and most colleges fall in that group. A college counts even when its only federal money arrives as student aid, such as Pell Grants, because the rule treats funds paid to the school by students as funds made available to it (34 CFR part 99, section 99.1).
The reverse also holds. A school that receives no such funds is outside the law. The Department of Education and the Department of Health and Human Services say in their joint guidance that "Private and religious schools at the elementary and secondary levels generally do not receive funds from the U.S. Department of Education and are, therefore, not subject to FERPA." Some do receive such funds, so ask yours directly instead of assuming.
An education record is any record that is directly related to a student and kept by the school or by someone acting for it. That reaches well past the report card. Attendance logs, discipline files, emails about the student, and an elementary school nurse's immunization record can all qualify.
Six categories are carved out under 34 CFR 99.3:
Notes kept in the sole possession of the person who made them, used only as a personal memory aid, and shown to no one except a temporary substitute.
Records of the school's own law enforcement unit, such as campus police, created and kept by that unit for a law enforcement purpose (section 99.8). FERPA neither requires nor bars their release, but education records handed to the unit stay protected.
Employment records made in the normal course of business and relating only to someone's job. Records of a student who works at the school because he is a student are not in this group.
Treatment records of a student who is 18 or older, or who attends college, made by a doctor or similar professional, used only for treatment, and shared only with the people providing it. The student can have them reviewed by a doctor of the student's choice.
Records created after a person is no longer a student, if they do not relate to the time as a student.
Grades on a peer-graded paper before the teacher collects and records them.
What are your main FERPA rights?
The first is the right to inspect and review. The school must let a parent or eligible student see the records and explain them on reasonable request. It must respond within a reasonable time that cannot exceed 45 days after it receives the request (section 99.10). A school may not destroy a record while a request to see it is pending.
The second is the right to ask for a correction. If you believe a record is inaccurate or misleading, or that it violates the student's privacy rights, you can ask the school to amend it. If it refuses, it must tell you about your right to a hearing. The hearing officer cannot have a direct interest in the outcome, and you may bring someone to help you, including an attorney, at your own expense (sections 99.20 to 99.22). If the school still declines, you can place a statement in the file giving your side, and the school must attach it whenever it shares the disputed record.
The third is the right to consent before the school discloses personally identifiable information from the record. The consent must be signed and dated (section 99.30). Then come the exceptions.
Who can see records without your consent?
Section 99.31 lists the situations where a school may release information without consent. It permits these disclosures; it does not require the school to make them. These are the ones families run into most.
Who gets the records
Condition in 34 CFR 99.31
School officials, including teachers
The school has decided they have legitimate educational interests. Outside contractors can qualify if they do a job the school would otherwise give to employees and are under its direct control.
Another school where the student seeks or intends to enroll, or is already enrolled
The disclosure is for purposes related to the student's enrollment or transfer.
Financial aid offices and lenders
The information is needed to decide eligibility, set the amount or conditions, or enforce the aid terms.
Parents of a dependent student
The student is a dependent under section 152 of the Internal Revenue Code.
A court or party with a subpoena
A judicial order or lawfully issued subpoena. The school must make a reasonable effort to notify you first, so you can seek protection in court. Narrow exceptions cover a federal grand jury or other law enforcement subpoena when the court or issuing agency has ordered it kept confidential, and certain terrorism orders obtained by the U.S. Attorney General.
Appropriate people in an emergency
There is an emergency, and knowing the information is necessary to protect the health or safety of the student or others (section 99.36).
Anyone, for directory information
The school gave public notice and a chance to opt out (section 99.37).
Parents of a college student under 21
The college found the student committed a disciplinary violation involving alcohol or a controlled substance, and the student is still under 21 when the parent is told. A state law that bars the disclosure still controls.
Directory information usually means basics such as a name or enrollment status; each school publishes its own list. You can refuse to let the school treat some or all of it as directory information by notifying the school in writing within the period it sets. An opt-out does not stop a school from requiring a student to give a name or school email address inside a class the student is enrolled in.
When do FERPA rights move from parent to student?
When a student turns 18 or begins attending a college at any age, the student becomes an "eligible student," and the rights and consent powers that belonged to the parents transfer to the student (sections 99.3 and 99.5). A 17-year-old taking classes at a community college is an eligible student for that college's records.
This is the rule behind the familiar line, "we can't tell you, FERPA." A college generally needs the student's written consent before talking with a parent about grades or conduct. But the transfer is not total. Section 99.5 confirms the school may still tell a parent without consent when any exception in section 99.31 fits, including the tax-dependent rule and the health or safety emergency rule. The alcohol and drug rule above is another. A parent of a college student who wants regular access can ask the student to sign a consent form at the registrar's office.
Parents of minors keep their rights, and the regulations give "full rights" to either parent unless the school has evidence of a court order, state statute, or legally binding document, such as a divorce or custody order, that specifically revokes those rights (section 99.4). For broader school-decision questions, see our guide on parents' rights when schools make major decisions.
Does FERPA or HIPAA cover school health records?
For most schools, FERPA. The joint guidance from the Departments of Education and Health and Human Services (last updated December 2019 on the Department of Education's student privacy site) says an elementary or secondary school nurse's records, including immunization records, would generally be education records under FERPA. It also says the HIPAA Privacy Rule generally does not apply to elementary and secondary schools, either because the school is not a covered entity or because the only health information it holds sits in FERPA education records. Our explainer on HIPAA and medical privacy covers the other law.
On campus, the guidance says a college clinic at a school subject to FERPA keeps its student patients' records under FERPA, as education records or treatment records, while its records for nonstudent patients fall under HIPAA. A hospital merely affiliated with a university is different: its patient records are typically not FERPA records, and HIPAA applies if the hospital is a covered entity.
Can you sue a school for violating FERPA?
Not under FERPA itself. In Gonzaga University v. Doe (2002), the Supreme Court held that the law's nondisclosure provisions create no personal rights that an individual can enforce in a lawsuit under 42 U.S.C. 1983. The Department of Education enforces FERPA instead, and its main tool is the power to withhold federal funds. The opinion is in the Supreme Court's bound volume 536. Other claims might exist under state law or other statutes, so a FERPA violation does not always end the matter.
What to do if you need records or think FERPA was violated
Send a written request to inspect the records to the principal or registrar. Date it and keep a copy. Name the records you want. The school has up to 45 days.
Read the annual notice the school must give about your rights; it describes the school's own procedure for inspecting and amending records.
If a record is wrong or misleading, ask in writing that the school amend it and say why.
If the school refuses, ask in writing for a hearing, and bring your evidence.
To keep directory information private, send the school a written opt-out within the deadline stated in its notice.
To report a violation, file a complaint with the Department of Education's Student Privacy Policy Office. Use the official FERPA complaint page and form. A complaint must include specific facts giving reasonable cause to believe a violation occurred, and under section 99.64 it is timely if filed within 180 days of the violation or of when you knew or should have known about it. The Office may extend that limit for good cause.
If the issue involves a child's special education file, our guide to IEP disputes explains the separate dispute routes. Questions about sex-based discrimination records may also involve Title IX.
This is general information, not legal advice. Rules change and can vary by state, so check the official sources linked here or talk with a licensed attorney in your state.
Free tools for parents
Self-help tools to act on the steps above — private, and nothing you enter leaves your browser:
Special-education letter generator — request an evaluation, an IEP meeting, an IEE, or records, or give 10-day private-placement notice.
FERPA is a federal privacy law for school records. It lets parents, or students who are 18 or in college, look at the student's education records, ask to fix errors, and say yes or no before most outside sharing. It binds schools that receive U.S. Department of Education funds.
Does FERPA apply to private schools?
It depends on funding. FERPA applies to schools that receive funds under Department of Education programs. A private college usually qualifies through student aid. Federal joint guidance says private and religious elementary and secondary schools generally receive no such funds and are not subject to FERPA, so ask the school directly.
Can a college tell my parents my grades?
Usually only with your written consent, because your FERPA rights belong to you once you are an eligible student. A college may still share with parents if you are their tax dependent or in a health or safety emergency. It may also tell them if you are under 21 and it finds you broke an alcohol or drug rule.
How long does a school have to show me my child's records?
A school must respond within a reasonable time, and no later than 45 days after it receives your request. Submit the request in writing, keep a copy, and note the date. The school cannot destroy the records while your request is pending.
How long do I have to file a FERPA complaint?
A complaint is timely if the Student Privacy Policy Office receives it within 180 days of the alleged violation, or of the date you knew or reasonably should have known about it. The Office can extend this deadline for good cause, so file even if you are close to the limit.
Can I sue a school for violating FERPA?
Generally not. In Gonzaga University v. Doe (2002), the Supreme Court held that FERPA's nondisclosure provisions create no personal rights enforceable under 42 U.S.C. 1983. Your federal route is a complaint to the Department of Education's Student Privacy Policy Office, and state law may offer other options in your situation.
Is a school nurse's file protected by FERPA or HIPAA?
For most public elementary and secondary schools, FERPA. Federal joint guidance says nurse records are generally education records under FERPA, and the HIPAA Privacy Rule generally does not apply to such schools. A private school that gets no Education Department funds can be a different case.
This article is general legal information, not legal advice, and may not reflect the most current law or the law in your jurisdiction. Laws vary by state and change over time. For advice about your specific situation, consult a licensed attorney.
Knowing your rights is the first step
Join thousands committing to calmly and consistently exercise their constitutional rights.
