Who can actually see a student's education records, and who decides

The Family Educational Rights and Privacy Act is written as a condition on federal money rather than as a privacy right. Under 34 CFR § 99.1 it binds any educational agency or institution to which funds have been made available "under any program administered by the Secretary" — which reaches nearly every school district and nearly every college in the United States, private ones included, because their students carry federal aid through the door. Almost everything that frustrates people about FERPA follows from that framing.

The rights move on enrolment, not on a birthday

FERPA starts by giving the rights to parents and then moves them, permanently, to the eligible student. Section 99.3 defines that person as "a student who has reached 18 years of age or is attending an institution of postsecondary education". The or is doing the work: either condition on its own is enough, and the transfer is not reversible by the parent.

That is why dual enrolment surprises families. A sixteen-year-old taking a community college course for high school credit is an eligible student at the college from the first day of attendance, and the college owes the parents nothing. The Department of Education's guidance is that the parents "still retain the rights under FERPA at the high school and may inspect and review any records sent by the postsecondary institution to the high school" — so the grade reaches the parent only once it has travelled to the school district, and only in whatever form it arrives.

What counts as an education record, and what does not

An education record is anything "directly related to a student" and "maintained by an educational agency or institution or by a party acting for the agency or institution". That is much wider than a transcript. Disciplinary files, the bursar's ledger, advising notes filed in a student's folder, emails a department has retained about a complaint — all of it is covered, and all of it is inspectable by the student.

The exclusions in § 99.3 matter more than the definition, because they are where requests get misdirected.

The treatment-record exclusion is the one that trips people. Counselling notes at a university health centre are usually not education records at all, so a FERPA request will not reach them and a FERPA release will not authorise them. Those requests are handled through the clinic's own paperwork — the shape of a medical authorization rather than an academic one.

How to ask for your records, and what the school owes you

The access right is procedural and has a clock on it. Section 99.10 gives the school "a reasonable period of time, but not more than 45 days" from receipt of the request.

1. 1

   Find the office that holds the record

   There is no single file. Grades sit with the registrar, conduct records with the dean of students, the account with the bursar. Ask each office separately, or your request will be answered narrowly and truthfully.

2. 2

   Put it in writing and date it

   The 45-day limit runs from receipt of the request, so a dated email is the only way to know when the deadline falls. Say which records you want rather than asking for "my file".

3. 3

   Ask to inspect, then ask for copies

   The primary right is to inspect and review. A copy is owed only where circumstances effectively prevent you from inspecting in person. Under § 99.11 a school may charge for copies, but it may not charge a fee to search for or retrieve the records.

4. 4

   Ask for an explanation of what you are reading

   Section 99.10 also requires the school to respond to reasonable requests for explanations and interpretations. Coded conduct entries and holds are worth asking about while you are in the room.

5. 5

   Note what is missing or wrong

   The inspection is what makes the amendment right usable. Write down anything inaccurate before you leave, because the next step depends on identifying it specifically.

You can correct a record; you cannot appeal a grade through it

Section 99.20 lets a parent or eligible student ask the school to amend a record they believe is "inaccurate, misleading, or in violation of the privacy rights of the student". If the school refuses, § 99.21 entitles you to a hearing. If the hearing goes against you, you may place a statement in the record commenting on the contested information, and § 99.21(c) requires the school to maintain that statement with the contested part and to disclose it whenever that part is disclosed.

The limit is the ground. A grade recorded as a C when a B was awarded is a records error and squarely within the amendment right. A grade you think was harsh is a substantive academic judgement, and FERPA has no view on it — that goes through the institution's own grade appeal, usually on a much shorter deadline than 45 days.

Why the tax-dependency exception rarely helps parents

Section 99.31(a)(8) allows a school to disclose a student's records to parents where the student is a dependent for tax purposes under section 152 of the Internal Revenue Code, whatever the student's age. Parents cite it constantly. It almost never works, and the reason is the verb.

FERPA's exceptions are permissions, not duties. Every clause in § 99.31 says an institution may disclose. Nothing in the Act obliges it to, and a school that declines to use an exception has broken no rule. Using this one also means demanding tax returns to prove dependency and then explaining to the student why the office read them, so a great many institutions simply take the position that they do not rely on it.

Two other parent-facing exceptions are worth knowing because they are the ones institutions do use. Section 99.31(a)(15) permits telling parents about a disciplinary violation involving alcohol or a controlled substance where the student is under 21 at the time of disclosure. And § 99.36 permits disclosure to appropriate parties, parents included, in connection with a health or safety emergency where there is "an articulable and significant threat"; if the school's determination has a rational basis, the Department "will not substitute its judgment" for the school's. That deference is deliberate, and it is why emergency notifications rarely turn into findings against a university.

The reliable route is a signed consent under § 99.30. It must be signed and dated, specify the records that may be disclosed, state the purpose of the disclosure, and identify the party or class of parties to whom disclosure may be made. Electronic consent counts where the method identifies and authenticates the person and indicates their approval. Because the form has to name records and a purpose, a single sentence granting a parent access to everything for ever is not a form a registrar will accept — expect a separate authorisation per office, and expect it to expire.

Directory information, and the opt-out that outlives you

Directory information is the carve-out that lets a school publish a graduation programme. Section 99.3 defines it as information in an education record "that would not generally be considered harmful or an invasion of privacy if disclosed", and the examples include name, address, telephone listing, email address, photograph, date and place of birth, major field of study, grade level, enrolment status, and degrees and honours received. It never includes a social security number, and a student ID number only in narrow circumstances where the identifier cannot on its own open an education record.

Section 99.37 lets a school disclose designated directory information without consent, provided it has given public notice of what it has designated, of the right to refuse the designation, and of the period within which a refusal must be given in writing. That notice is the annual FERPA notification almost nobody reads, and the window it sets is often a fortnight at the start of term.

Two consequences catch students out. The opt-out is a blunt instrument: it suppresses the whole category, so an employer calling to confirm a degree gets nothing, and the graduation programme leaves the name out. And it does not lapse — a school "must continue to honor any valid request to opt out of the disclosure of directory information made while a student was in attendance unless the student rescinds the opt out request". An election made in freshers' week is still suppressing degree verification a decade later.

When the school gets it wrong

This is the part that most changes what people do. In Gonzaga University v. Doe (2002) the Supreme Court held that "the relevant FERPA provisions create no personal rights to enforce under § 1983". There is no private right of action and no damages claim for a disclosure that should not have happened. The statute is directed at institutions and administered through funding.

What remains is an administrative complaint to the Student Privacy Policy Office, and it is time-barred quickly. Section 99.64 requires a complaint within 180 days of the violation or of the date the complainant "knew or reasonably should have known" of it, extendable only for good cause. The complaint must contain specific allegations of fact giving reasonable cause to believe a violation occurred; it does not have to show the school has a bad policy, because a single incident is enough to investigate.

The document that decides this is one the student signs

FERPA regulates what an institution may do. It has nothing to say about what a family has agreed, what a sponsor expects, or who is paying. A scholarship funder that wants to see grades has no route to the registrar and must get them from the student — which is why those obligations turn up as promises in the funding paperwork instead, covered in scholarship agreement conditions. The same logic applies to anything a school's own enrollment agreement says about records and notices: the contract binds the student, the statute binds the school, and the two are answering different questions. It is also why who owns course materials is a copyright problem rather than a records one, even though both concern work a student produced.

The practical conclusion is unglamorous. If a parent is going to need to speak to a bursar about a bill, the release is signed in August, not argued about in November, and it is signed once per office. If a student wants the file to be right, they inspect it in the first term rather than discovering an error when a graduate school asks for it. Both are ten-minute jobs that only look optional because the deadline for doing them is invisible.