FERPA and HIPAA Guidelines for Staff

Family Educational Rights and Privacy Act (FERPA)

The Family Educational Rights and Privacy Act (FERPA) of 1974 is a federal law designed to protect the privacy of student education records. Under FERPA, students have specific rights regarding their educational records, and institutions must comply with these guidelines. Faculty and staff must have a working knowledge of FERPA before releasing any student information.

Health Insurance Portability and Accountability Act (HIPAA)

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 regulates the privacy and security of health information. While HIPAA generally applies to health care providers, its impact on educational institutions is limited because most student health records fall under FERPA.

The Family Education and Privacy Act was enacted by Congress to protect the privacy of student educational records. This privacy right is a right vested in the student.

  • Institutions must have written permission from the parent or eligible student in order to release any information from a student's educational record.
  • Institutions may disclose directory information in the student's educational record without the student's consent.
  • It is good policy for the institution to notify the student about such disclosure and to seek the written permission of the student to allow disclosure of any educational records including directory information.
  • Institutions should give the student ample opportunity to submit a written request that the school refrain from disclosing directory information about them.
  • Institutions must not disclose non-directory information about students without their written consent except in very limited circumstances.
  • Institutions should notify students about their rights under FERPA through annual publications.
  • When in doubt, it is always advisable to err on the side of caution and to not release student educational records without first fully notifying the parent/eligible student about the disclosure.

Finally, the school should always seek a written consent from the parent or eligible student before disseminating educational records to third parties.