8.2 Confidentiality and Family Legal Rights
Key Takeaways
- FERPA (20 U.S.C. § 1232g; 34 CFR Part 99) is the federal school-records law: education records are student-related records the school maintains, including IEPs and typical school health files.
- Directory information is a narrow, opt-out category; grades, IEP or disability status, English learner status, discipline, and meal eligibility are not directory information.
- Parents have rights to inspect records (generally within 45 days), request amendment, and consent to most disclosures; either parent usually holds those rights unless a court order says otherwise.
- Share records only with school officials who have a legitimate educational interest, in private; never discuss a child in the hallway or on social media.
- HIPAA generally does not govern elementary school education records; Pennsylvania teachers follow the LEA student-records plan required by 22 Pa. Code §§ 12.31–12.32.
8.2 Confidentiality and Family Legal Rights
PECT lens: Objective 0004.2 tests laws related to family and student confidentiality and classroom practices that protect the legal rights of students and families. On PreK–4 items the controlling federal law for school records is FERPA (Family Educational Rights and Privacy Act), 20 U.S.C. § 1232g, regulations at 34 CFR Part 99 — not HIPAA.
If 0004.1 is about how families work, 0004.2 is about what you may say, show, post, or send. A kind teacher who chats about a child's IEP in the hallway still fails this objective.
FERPA in one page
FERPA applies to educational agencies and institutions that receive funds under a U.S. Department of Education program — Pennsylvania public schools and most public charter schools included.
Education records (34 CFR 99.3) are records that are (1) directly related to a student and (2) maintained by the school (or a party acting for the school). Typical examples:
- Grades, transcripts, report cards, attendance
- Individualized Education Programs (IEPs), 504 plans, evaluation reports
- Discipline records and counseling notes kept in the student's file
- Standardized test scores, including PSSA and ACCESS results
- School health records maintained by the school (immunizations, nurse logs)
- Photos and videos of a student maintained by the school as part of the file
- Personally identifiable information (PII) drawn from those records
Generally not education records: a teacher's sole-possession notes used only as a personal memory aid and not shared; records of a school's law enforcement unit; peer-graded papers before the teacher collects and records them. The moment you share a “memory aid” with a colleague or file it, treat it as an education record.
Directory information is a narrow, optional category: information the school has designated in an annual notice as not generally harmful if disclosed (often name, grade level, photograph, participation in activities, honors). Parents and eligible students may opt out. Directory is not a loophole for sensitive facts.
| Usually may be directory (if designated and no opt-out) | Never treat as directory |
|---|---|
| Name, grade, dates of attendance, honor roll, school photo (if listed) | Grades, test scores, IEP or disability status, English learner status, Social Security number, discipline, free or reduced-price meal status, a student ID that unlocks records |
Parental rights you must not block
Until a student turns 18 or attends a postsecondary institution (an “eligible student”), parents hold FERPA rights. For PreK–4, that is almost always the parent or guardian.
Core rights:
- Inspect and review education records, generally within 45 days of the request (34 CFR 99.10). Schools may not destroy records after a request is pending. Copies are not always required if inspection is possible; a fee may not effectively prevent access.
- Request amendment of records that are inaccurate, misleading, or in violation of privacy, with a hearing process if the school refuses.
- Written consent before disclosure of PII from education records, except for listed exceptions (school officials, certain enrollment transfers, health or safety emergencies, and others in 34 CFR 99.31).
- File a complaint with the U.S. Department of Education's Student Privacy Policy Office (SPPO).
Either parent generally has these rights, including a noncustodial parent, unless the school has a court order, state statute, or legally binding document that specifically revokes them (34 CFR 99.4). “They don't live here” is not enough to freeze a parent out. Follow the district records plan and the documents on file.
Exam trap: “Only the parent who enrolled the child may see the file” is usually wrong. “Hide the report card from a parent who is difficult” is a rights violation, not professionalism.
Need-to-know among staff — not anyone with a badge
FERPA allows disclosure without consent to school officials, including teachers, whom the school has determined have legitimate educational interests (34 CFR 99.31(a)(1)). The school must use reasonable methods so officials see only the records they need.
Legitimate educational interest means you need the record to do your job for that student: plan instruction, keep the child safe, implement an IEP, or provide a related service. It does not mean curiosity, gossip, or “I used to teach that family.”
Need-to-know snapshots:
- The Grade 1 teacher and the special educator who implement the IEP may discuss those IEP goals in a private setting.
- The art teacher may need a relevant accommodation (seating, sensory), not the child's full evaluation narrative.
- A teacher down the hall who does not work with the child does not get the file.
- A parent volunteer is not a school official for other children's records.
- A substitute needs what is required to teach and keep children safe that day, not a tour of the cumulative folder.
- Contractors (a digital gradebook vendor) may be school officials only if they perform a school function under school control and may not redisclose.
Redisclosure is its own violation. If you lawfully learn IEP information, you may not repeat it at a barbecue, in a teacher Facebook group, or in a group text.
Classroom practices that protect rights
PECT items are usually hallway, social media, and bulletin-board stories, not a recitation of the Code of Federal Regulations.
Do not:
- Discuss a child by name in the hallway, lobby, playground fence, grocery store, or staff lounge as entertainment
- Post grades, named behavior charts, or IEP status where other families can see them
- Put another child's scored work or intervention group list in a parent chat or class app feed
- Photograph children for social media or a personal classroom Instagram without following district media/directory consent
- Email identifiable IEP or assessment data through a personal account
- Use a child or sibling as the messenger of confidential information
- Announce “the special-ed kids” or “the ESL kids” in front of the class
Do:
- Close the classroom door or use a private room for IEP and conference talk
- Store cumulative files and IEPs according to the district student-records plan
- Check the annual FERPA notice and opt-out list before you send a class photo to the local paper
- Share only the slice a colleague needs, in a professional channel
- Send a family only their child's information
IEP confidentiality. An IEP is an education record under FERPA and is protected under IDEA confidentiality rules (34 CFR 300.610–627). Parents have inspection rights. Staff who implement the IEP have a legitimate interest. Other parents, the PTA, and social media do not. Do not “explain” one child's disability to another family to justify a grouping.
HIPAA is generally not the school-records law
The HIPAA Privacy Rule covers many health-care providers. Joint U.S. Department of Education and HHS guidance is clear: records that are education records under FERPA are excluded from HIPAA. In a typical Pennsylvania elementary school, the nurse's student health record is an education record. You protect it with FERPA practices, not by quoting HIPAA authorization forms you do not control.
A community pediatrician's office may be a HIPAA entity. Once a note is given to the school and maintained in the student's record, school staff treat it as FERPA. Do not pick HIPAA as the law that governs classroom files, IEPs, or nurse cards. Do not ignore health privacy either — FERPA still forbids hallway talk about a child's asthma, medication, or toileting plan.
Mandated reporting of suspected child abuse (Pennsylvania CPSL; later objective 0005.4) is a legal duty, not a FERPA leak. FERPA includes a health or safety emergency exception. You do not withhold a ChildLine report because “records are confidential.” You also do not use reporting as an excuse to gossip.
Pennsylvania student-records practice at teacher level
Pennsylvania does not ask each teacher to invent a private policy. 22 Pa. Code §§ 12.31–12.32 require every school entity's governing board to adopt a written plan for the collection, maintenance, and dissemination of student records that conforms to FERPA and PDE guidelines. § 12.33 (old pupil-records guidelines) is reserved; districts still keep a local plan. 22 Pa. Code § 12.12 addresses confidential communications of students in the student-rights chapter.
Teacher-level translation:
- Follow your LEA's student-records plan (often Board Policy 216 in Pennsylvania districts) and the building's procedures for files, gradebooks, and portals.
- Keep working notes professional, dated, and free of gossip. If a parent requests records, casual sticky notes and group chats can become part of the story.
- Do not keep a shadow file of rumors at home.
- Special education records also sit under IDEA and 22 Pa. Code Chapter 14; extra sensitivity, same need-to-know logic.
- Chapter 15 (504) records are likewise confidential education records.
- Parents who need access should be directed through the principal or records custodian if the request is for the cumulative file; do not refuse, hide, or freelance a delay.
The Pennsylvania Department of Health likewise treats the student health record as an education record under FERPA. You are not the district solicitor. You are the adult who decides whether this conversation belongs in the hallway.
How to decode a 0004.2 stem
- Is it an education record (maintained, student-related)? FERPA.
- Is it directory as designated, with no opt-out? If not, you need consent or an exception.
- Is the recipient a school official with a legitimate educational interest? Need-to-know, private setting.
- Is the option HIPAA for a school file? Almost always a distractor.
- Hallway, social media, volunteer lists, and “only the custodial parent” are classic traps.
During hallway duty, a Grade 2 teacher describes a student's IEP reading goals to a colleague who does not teach the child, while families walk past. Which statement best applies 0004.2?
A parent asks a kindergarten teacher which privacy law governs the immunization card and asthma action plan kept by the school nurse. What is the most accurate teacher-level answer?
A PTA volunteer coordinating a reading-night fundraiser asks the teacher for a list of which students have IEPs and which receive free or reduced-price meals, so we know who needs extra help. What should the teacher do?