The principal requirements of FERPA are straightforward: they give a student or his parent the right to inspect and review, and request correction or amendment of, an education record maintained about him [20 U.S.C. 1232g(a)(1) and (2)]; and give a student or his parents some measure of control over the disclosure of information from an education record about him [20 U.S.C. 1232g(b)(1)]. FERPA obligates educational institutions to provide procedures for inspection and review of records within 45 days from the time it receives a request for access to them. [20 U.S.C. 1232g(a)(1)(A)] It also exempts the following types of records from parent and student access:

• records maintained by law enforcement units of educational institutions, if such records are maintained separately from other education records and if no exchange of information between those records and other education records is permitted [20 U.S.C. 1232g(a)(4)(B)(ii)];
• medical or psychological treatment records maintained separately from other education records and used only for medical treatment purposes; provided, however, that such records may be seen by an appropriate professional of the student's choice [20 U.S.C. 1232g(a)(4)(B)(iv)J;
• so-called "desk drawer notes;" that is, personal records of instructional, supervisory, or administrative personnel that are not shared with anyone else except a substitute [20 U.S.C. 1232g(a)(4)(B)(i)J;
• confidential letters of recommendation that were in a student's record before the Act or to which the student has waived his right of access [20 U.S.C. 1232g(a)(1)(B)(ii) and (iii)(I)]; and
• records about applicants who have never been students at the educational institution. [20 U.S.C. 1232g(a)(6)]

FERPA requires educational institutions to allow students or parents to have a hearing to challenge information in records they believe to be inaccurate, misleading, or otherwise in violation of their privacy rights. It also obligates an educational institution to correct or delete challenged information or, if it refuses to make the requested correction, to insert in the record the student or parent's written explanation regarding the disputed information. [20 U.S.C. 1232g(a)(2)]

In addition, FERPA requires written consent from a student or parent before a student's record or any personally identifiable information in it may be disclosed to a third party. Consent is not required, however, when the disclosure is to:

• officials of the educational institution acting in pursuit of a legitimate educational purpose [20 U.S.C. 1232g(b)(1)(A)J;
• officials of schools or school systems in which the student seeks to enroll, provided the student is notified of the disclosure, given a copy of the record or information upon request, and has an opportunity to have a hearing to challenge the contents of the record or information [20 U.S.C. 1232g(b)(1)(B)];
• certain Federal and State agencies for auditing and evaluation purposes on the condition that no redisclosure of the record is made and it is destroyed when no longer needed [20 U.S.C. 1232g(b)(1)(C), (E), and (4)(B)];
• accrediting agencies for accrediting purposes [20 U.S.C. 1232g(b)(1)(G)];
• organizations conducting studies for educational purposes on behalf of educational institutions, on the condition that no redisclosure of the record is made and it is destroyed when no longer needed [ 20 U.S.C. 1232g(b)(1)(F)];
• in an emergency, when necessary to protect the health and safety of the student or other persons [20 U.S.C. 1232g(b)(1)(I)]; and
• in response to a judicial order or lawfully issued subpoena, provided that parents and students are notified in advance of compliance with the order or subpoena. [20 U.S.C 1232g(b)(2)(B)].

FERPA also permits an educational institution to disclose directory information (i.e., information about the identity or status of the student which has been publicly designated by the institution as directory information) without the consent of the student or his parent, provided the student or parent has had a reasonable opportunity to inform the institution that any or all of the information should not be released without the student's prior consent. [20 US. C. 1232g(a)(5)] An educational institution must keep an accounting of all disclosures requested or obtained, and allow a student or parent to review the accounting. [20 U.S.C. 1232g(b)(4)(A)]

FERPA instructs the Secretary of Health, Education, and Welfare to promulgate regulations to protect the rights of students and their families in surveys or data-collection activities conducted, assisted, or authorized by the DHEW or an educational institution. [20 U.S.C. 1232g(c)] Finally, it places a requirement on educational institutions to inform students and parents of their rights under the Act. [20 U.S.C. 1232g(e)]

FERPA applies to any institution receiving U.S. Office of Education funding and provides for the termination of such funding if an institution fails to comply with it and compliance cannot be secured voluntarily. [20 U.S.C. 1232g(f)] DHEW is required to set up an office and a review board to investigate, review, and adjudicate violations and complaints alleging violations. [20 U.S.C. 1232g(g)]

The Commission believes that FERPA represents a reasonably successful attempt to establish a clear set of minimum requirements for the protection of students' and parents' privacy rights. At the same time, its gives each educational institution considerable latitude in establishing its own procedures to fulfill these requirements. Ironically, FERPA's most specific provisions are the exceptions to its requirements, and most of them were added at the request of representatives of educational institutions and Federal agencies during the drafting of the compromise measure.