Minimizing Disclosure Risk in HHS Open Data Initiatives. 1. Family Educational Rights and Privacy Act (FERPA) of 1974


Under FERPA, federally-funded educational institutions and agencies are prohibited from disclosing protected educational information to any entity other than a student or a student’s parents. Personally identifiable information (PII) may be disclosed only if the student or parent signs a document identifying the information to be released, to whom it should be released, and the reason for the disclosure. Educational institutions can release directory information, such as students’ names, addresses, and telephone numbers, but must notify students and parents that the information will be released and give them time to opt out of the disclosure. Students and parents have the right to review and make changes to the students’ records and must be notified annually of this right and the institution’s policies for disclosing records.

Educational institutions can disclose PII without consent under special circumstances. These include, but are not limited to, the following:

  • To other school officials within the same institution who have a legitimate educational interest in receiving the information
  • To another institution where the student intends to enroll
  • In relation to financial aid for which the student has applied or has received, for the purpose of determining eligibility, amount of aid, and conditions of the aid and/or to enforce terms and conditions of the financial aid
  • To the juvenile justice system with the intention of improving the system’s ability to serve the student

Institutions can also disclose PII to organizations conducting research on behalf of the institution and that have a “legitimate interest” in the information. The researchers must enter into a written agreement detailing the purpose, scope, and duration of the study and plans to destroy all PII once it is no longer needed for the study.6

6 “Family Educational and Privacy Rights,” Title 20 U.S. Code, Sec. 1232g. Available at [ fdsys/pkg/USCODE-2011-title20/pdf/USCODE-2011-title20-chap31-subchapIII-part4-sec1232g.pdf]. Accessed May 30, 2014

View full report


"rpt_Disclosure.pdf" (pdf, 1.01Mb)

Note: Documents in PDF format require the Adobe Acrobat Reader®. If you experience problems with PDF documents, please download the latest version of the Reader®