Originally appeared in the CAS Weekly Newsletter
Dear Legal Mailbag:
I work as a school counseling secretary, and I regularly deal with confidential student information. Given that responsibility, I want to know and follow the rules so that I don’t mess up.
Part of my job is to deal with parent requests for student records. If we receive an email from parents wanting their child’s records, do they need to sign a release of records or can we take the email as the request?
Signed,
Doing the Work
Dear Doing:
Your question is governed by the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, affectionately known as FERPA. FERPA applies to all education institutions that receive federal funding, which includes your employer and all school districts in Connecticut. Legal Mailbag regularly deals with FERPA questions, and the FERPA regulations, 34 C.F.R. § 99.1, are a key source of information about this important law.
In brief, you do not need a release to respond to parent requests for access to education records. Rather, a release is typically (but not always) required when school officials share records with third parties. However, if you receive a request for records by an email purportedly from a parent, Legal Mailbag recommends that you follow the safeguards applicable when a parent consents to the release of records by electronic means, as described below.
FERPA imposes two separate responsibilities on school districts. First, parents have a right to access educational records as to their children, and that right of access transfers to the student him- or herself when the student reaches the age of eighteen (when they become “eligible students”). “Education records” subject to this requirement are defined as records “(1) Directly related to a student; and (2) Maintained by an educational agency or institution or by a party acting for the agency or institution.” 34 C.F.R. § 99.3. The right of access is defined as the right to inspect and review such records, which right includes the right to receive a copy “[i]f circumstances effectively prevent the parent or eligible student from exercising the right to inspect and review the student’s education records.” 34 C.F.R. § 99.10. As a practical matter, it is often easier simply to provide the records electronically. Moreover, parents have a right to receive a copy of education records under the Freedom of Information Act.
Second, FERPA imposes the duty on school districts to maintain the confidentiality of personally-identifiable information in education records. FERPA sets forth certain exceptions to this confidentiality requirement. For example, school officials with a legitimate educational interest can access confidential student records without first obtaining parent consent. However, the general rule is that parents must provide written consent before school officials (including school counseling secretaries) may disclose confidential student information to third parties.
With this framework in mind, Legal Mailbag is pleased to elaborate on the answer to your question. It is clear that parents are not required to sign a release for access to the records related to their own children. As noted above, by virtue of their status as parents, they have the right of access to inspect and review student records without signing a release. However, the process for parents to give consent by electronic means to the disclosure of student records to third parties is instructive.
Significantly, the FERPA regulations permit parents to provide “written consent” electronically to the release of records only under specified circumstances:
(d) “Signed and dated written consent” under this part may include a record and signature in electronic form that—
(1) Identifies and authenticates a particular person as the source of the electronic consent; and
(2) Indicates such person’s approval of the information contained in the electronic consent.
34 C.F.R. § 99.30(d).
The key word here is “authenticates.” School officials may not simply rely on an email to serve as “written consent” for the disclosure of student records. Rather, any such consent must identify the records subject to the release, and school officials must take measures to be sure that the email consent is actually from the parent in question. Similarly, if you receive an email purporting to be from a parent asking for you to send education records, you should take measures to authenticate the email. You can do so simply by checking the contact information previously provided by the parent to confirm the email address or by calling the parent to confirm that the email is from the parent entitled to receive the records. Once you are confident that you are responding to the parent entitled to the records, you may send the records without obtaining a release.