FERPA: Who Is Covered and Who Is Not

A practical way to approach ferpa: who is covered and who is not is to ask what a student would expect if they saw the sharing described in plain language. Where the sharing matches that expectation and the authority supports it, it may proceed with a log entry; where it surprises, it needs permission, an identified exception or a fresh decision, not a quiet assumption.

Mixed-audience platforms need a child-directed analysis for their younger users, not a single policy written for adults.

Proctoring tools collect some of the most personal information on site, and their adoption needs a higher standard of review than a routine classroom tool.

Cross-office disclosing inside one college still needs authorization, because internal does not mean unrestricted.

Amendment is not the same as removal: a successful challenge corrects or explains a record, and the original entry frequently remains in the file with the challenge noted.

Admissions information involves applicants who may never enroll, and their records deserve safeguarding even though they never become students in the usual sense.

Media requests for student information should go via the confidentiality officer, not via the first office that picks up the phone.

AI feedback tools might retain student work for training unless the contract says otherwise, and that term should be settled before adoption.

Proctoring integrations collect video, audio, screen and sometimes biometric data, and the sensitivity of that collection ought to set the review standard.

Accessibility information in a learning platform may reveal disability status, and access to it should be limited to staff who need it for support.

Alumni systems retain giving, employment and contact information, and former students ought to be able to correct and limit that information.

Trigger access reviews on role alters automatically where possible, and treat manual review as a fallback, not as the plan.

Audit access to personal files, and follow up on anomalies, since an audit that finds nothing is either lucky or blind.

Include students in governance, since students notification confidentiality problems that employees have normalised.

Review privacy oversight after a merger or system change, because the data map from before the change shall no longer be accurate.

Read exceptions narrowly and on their own terms, and do not stretch an exception to cover an objective that merely resembles the named one.

Assess surveillance proposals for necessity and proportionality, not only for legality, because lawful surveillance may still harm trust.

Review a determination following it is made: was the information used for the specified purpose, does the receiver still need it, has storage expired?

Detect events early via tracking, since early detection limits the number of students affected.

In that illustration the survey report shows only aggregates above a stated threshold, and no small-group result can identify a respondent.

In that illustration a review finds the storage unjustified, the birth dates are deleted, and the screening is redesigned to collect the minimum required.

Consider a college that receives a media request for a student's disciplinary record and routes it to the confidentiality officer instead of answering from the first department.

Consider an institution that runs a wellness survey with personal issues and settles anonymity, retention and reporting before a single response is collected.

In that illustration the requirements are published to residents, access is logged, and footage is deleted on schedule unless it is needed for a specific investigation.

Treating alumni records as unprotected history is an error, since graduation does not end the university's duty.

Distributing a sensitive survey without settling anonymity and storage first is an error that can not be repaired by a later apology.

Approving a disclosure without recording it is a mistake, because a reviewer, auditor or student shall eventually request what happened and why.

Redisclosing a record received under an exemption, without checking whether the second sharing is covered, is an error that spreads the original disclosure.

Auditing surveillance systems solely for image quality, and not for access and retention, is an error, since cameras generate records continuously.