[Federal Register Volume 73, Number 237 (Tuesday, December 9, 2008)]
[Rules and Regulations]
[Pages 74806-74855]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: E8-28864]



[[Page 74805]]

-----------------------------------------------------------------------

Part II





Department of Education





-----------------------------------------------------------------------



34 CFR Part 99



Family Educational Rights and Privacy; Final Rule

  Federal Register / Vol. 73 , No. 237 / Tuesday, December 9, 2008 / 
Rules and Regulations  

[[Page 74806]]


-----------------------------------------------------------------------

DEPARTMENT OF EDUCATION

34 CFR Part 99

RIN 1855-AA05
[Docket ID ED-2008-OPEPD-0002]


Family Educational Rights and Privacy

AGENCY: Office of Planning, Evaluation, and Policy Development, 
Department of Education.

ACTION: Final regulations.

-----------------------------------------------------------------------

SUMMARY: The Secretary amends our regulations implementing the Family 
Educational Rights and Privacy Act (FERPA), which is section 444 of the 
General Education Provisions Act. These amendments are needed to 
implement a provision of the USA Patriot Act and the Campus Sex Crimes 
Prevention Act, which added new exceptions permitting the disclosure of 
personally identifiable information from education records without 
consent. The amendments also implement two U.S. Supreme Court decisions 
interpreting FERPA, and make necessary changes identified as a result 
of the Department's experience administering FERPA and the current 
regulations.
    These changes clarify permissible disclosures to parents of 
eligible students and conditions that apply to disclosures in health 
and safety emergencies; clarify permissible disclosures of student 
identifiers as directory information; allow disclosures to contractors 
and other outside parties in connection with the outsourcing of 
institutional services and functions; revise the definitions of 
attendance, disclosure, education records, personally identifiable 
information, and other key terms; clarify permissible redisclosures by 
State and Federal officials; and update investigation and enforcement 
provisions.

DATES: These regulations are effective January 8, 2009.

FOR FURTHER INFORMATION CONTACT:  Frances Moran, U.S. Department of 
Education, 400 Maryland Avenue, SW., room 6W243, Washington, DC 20202-
8250. Telephone: (202) 260-3887.
    If you use a telecommunications device for the deaf (TDD), you may 
call the Federal Relay Service (FRS) at 1-800-877-8339.
    Individuals with disabilities may obtain this document in an 
alternative format (e.g., Braille, large print, audiotape, or computer 
diskette) on request to the contact person listed under FOR FURTHER 
INFORMATION CONTACT.

SUPPLEMENTARY INFORMATION: On March 24, 2008, the U.S. Department of 
Education (the Department or we) published a notice of proposed 
rulemaking (NPRM) in the Federal Register (73 FR 15574). In the 
preamble to the NPRM, the Secretary discussed the major changes 
proposed in that document that are necessary to implement statutory 
changes made to FERPA, to implement two U.S. Supreme Court decisions, 
to respond to changes in information technology, and to address other 
issues identified through the Department's experience in administering 
FERPA.
    We believe that the regulatory changes adopted in these final 
regulations provide clarification on many important issues that have 
arisen over time with regard to how FERPA affects decisions that school 
officials have to make on an everyday basis. Educational agencies and 
institutions face considerable challenges, especially with regard to 
maintaining safe campuses, protecting personally identifiable 
information in students' education records, and responding to requests 
for data on student progress. These final regulations, as well as the 
discussion on various provisions in the preamble, will assist school 
officials in addressing these challenges in a manner that complies with 
FERPA and protects the privacy of students' education records.

Notice of Proposed Rulemaking

    In the NPRM, we proposed regulations to implement section 507 of 
the USA Patriot Act (Pub. L. 107-56), enacted October 26, 2001, and the 
Campus Sex Crimes Prevention Act, section 1601(d) of the Victims of 
Trafficking and Violence Protection Act of 2000 (Pub. L. 106-386), 
enacted October 28, 2000. Other major changes proposed in the NPRM 
included the following:
     Amending Sec.  99.5 to clarify the conditions under which 
an educational agency or institution may disclose personally 
identifiable information from an eligible student's education records 
to a parent without the prior written consent of the eligible student;
     Amending Sec.  99.31(a)(1) to authorize the disclosure of 
education records without consent to contractors, consultants, 
volunteers, and other outside parties to whom an educational agency or 
institution has outsourced institutional services or functions;
     Amending Sec.  99.31(a)(1) to ensure that teachers and 
other school officials only gain access to education records in which 
they have legitimate educational interests;
     Amending Sec.  99.31(a)(2) to permit educational agencies 
and institutions to disclose education records, without consent, to 
another institution even after the student has enrolled or transferred 
so long as the disclosure is for purposes related to the student's 
enrollment or transfer;
     Amending Sec.  99.31(a)(6) to require that an educational 
agency or institution may disclose personally identifiable information 
under this section only if it enters into a written agreement with the 
organization specifying the purposes of the study and the use and 
destruction of the data;
     Amending Sec.  99.31 to include a new subsection to 
provide standards for the release of information from education records 
that has been de-identified;
     Amending Sec.  99.35 to permit State and local educational 
authorities and Federal officials listed in Sec.  99.31(a)(3) to make 
further disclosures of personally identifiable information from 
education records on behalf of the educational agency or institution; 
and
     Amending Sec.  99.36 to remove the language requiring 
strict construction of this exception and add a provision stating that 
if an educational agency or institution determines that there is an 
articulable and significant threat to the health or safety of a student 
or other individual, it may disclose the information to any person, 
including parents, whose knowledge of the information is necessary to 
protect the health or safety of the student or other individuals.

Significant Changes From the NPRM

    These final regulations contain several significant changes from 
the NPRM as follows:
     Amending the definition of personally identifiable 
information in Sec.  99.3 to provide a definition of biometric record;
     Removing the proposed definition of State auditor in Sec.  
99.3 and provisions in Sec.  99.35(a)(3) related to State auditors and 
audits;
     Revising Sec.  99.31(a)(6) to clarify the specific types 
of information that must be contained in the written agreement between 
an educational agency or institution and an organization conducting a 
study for the agency or institution;
     Removing the statement from Sec.  99.31(a)(16) that FERPA 
does not require or encourage agencies or institutions to collect or 
maintain information concerning registered sex offenders;
     Requiring a State or local educational authority or 
Federal official or agency that rediscloses personally identifiable 
information from education records to record that disclosure if the

[[Page 74807]]

educational agency or institution does not do so under Sec.  99.32(b); 
and
     Revising Sec.  99.32(b) to require an educational agency 
or institution that makes a disclosure in a health or safety emergency 
to record information concerning the circumstances of the emergency.
    These changes are explained in greater detail in the following 
Analysis of Comments and Changes.

Analysis of Comments and Changes

    In response to the Secretary's invitation in the NPRM, 121 parties 
submitted comments on the proposed regulations. An analysis of the 
comments and of the changes in the regulations since publication of the 
NPRM follows.
    We group major issues according to subject, with applicable 
sections of the regulations referenced in parentheses. We discuss other 
substantive issues under the sections of the regulations to which they 
pertain. Generally, we do not address technical and other minor 
changes, or suggested changes that the law does not authorize the 
Secretary to make. We also do not address comments pertaining to issues 
that were not within the scope of the NPRM.

Definitions (Sec.  99.3)

(a) Attendance

    Comment: We received no comments objecting to the proposed changes 
to the definition of the term attendance. Three commenters expressed 
support for the changes because the availability and use of alternative 
instructional formats are not clearly addressed by the current 
regulations. One commenter suggested that the definition could avoid 
obsolescence by referring to the receipt of instruction leading to a 
diploma or certificate instead of listing the types of instructional 
formats.
    Discussion: We proposed to revise the definition of attendance 
because we received inquiries from some educational agencies and 
institutions asking whether FERPA was applicable to the records of 
students receiving instruction through the use of new technology 
methods that do not require a physical presence in a classroom. Because 
the definition of attendance is key to determining when an individual's 
records at a school are education records protected by FERPA, it is 
essential that schools and institutions understand the scope of the 
term. To prevent the regulations from becoming out of date as new 
formats and methods are developed, the definition provides that 
attendance may also include ``other electronic information and 
telecommunications technologies.''
    While most schools are aware of the various formats distance 
learning may take, we believe it is informative to list the different 
communications media that are currently used. Also, we believe that 
parents, eligible students, and other individuals and organizations 
that use the FERPA regulations may find the listing of formats useful.
    We do not agree that the definition of attendance should be limited 
to receipt of instruction leading to a diploma or certificate, because 
this would improperly exclude many instructional formats.
    Changes: None.

(b) Directory Information (Sec. Sec.  99.3 and 99.37)

(1) Definition (Sec.  99.3)
    Comment: We received a number of comments on our proposal to revise 
the definition of directory information to provide that an educational 
agency or institution may not designate as directory information a 
student's social security number (SSN) or other student identification 
(ID) number. The proposed definition also provided that a student's 
user ID or other unique identifier used by the student to access or 
communicate in electronic systems could be considered directory 
information but only if the electronic identifier cannot be used to 
gain access to education records except when used in conjunction with 
one or more factors that authenticate the student's identity.
    All commenters agreed that student SSNs should not be disclosed as 
directory information. Several commenters strongly supported the 
definition of directory information as proposed, noting that failure to 
curtail the use of SSNs and student ID numbers as directory information 
could facilitate identity theft and other fraudulent activities.
    One commenter said that the proposed regulations did not go far 
enough to prohibit the use of students' SSNs as a student ID number, 
placing SSNs on academic transcripts, and using SSNs to search an 
electronic database. Another commenter expressed concern that the 
proposed regulations could prohibit reporting needed to enforce 
students' financial obligations and other routine business practices. 
According to this commenter, restrictions on the use of SSNs in FERPA 
and elsewhere demonstrate the need for a single student identifier that 
can be tied to the SSN and other identifying information to use for 
grade transcripts, enrollment verification, default prevention, and 
other activities that depend on sharing student information. Another 
commenter stated that institutions should not be allowed to penalize 
students who opt out of directory information disclosures by denying 
them access to benefits, services, and required activities.
    Several commenters said that the definition in the proposed 
regulations was confusing and unnecessarily restrictive because it 
treats a student ID number as the functional equivalent of an SSN. They 
explained that when providing access to records and services, many 
institutions no longer use an SSN or other single identifier that both 
identifies and authenticates identity. As a result, at many 
institutions, the condition specified in the regulations for treating 
electronic identifiers as directory information, i.e., that the 
identifier cannot be used to gain access to education records except 
when used in conjunction with one or more factors that authenticate the 
user's identity, often applies to student ID numbers as well because 
they cannot be used to gain access to education records without a 
personal identification number (PIN), password, or some other factor to 
authenticate the user's identity. Some commenters suggested that our 
nomenclature is the problem and that regardless of what it is called, 
an identifier that does not allow access to education records without 
the use of authentication factors should be treated as directory 
information. According to one commenter, allowing institutions to treat 
student ID numbers as directory information in these circumstances 
would improve business practices and enhance student privacy by 
encouraging institutions to require additional authentication factors 
when using student ID numbers to provide access to education records.
    One commenter strongly opposed allowing institutions to treat a 
student's electronic identifier as directory information if the 
identifier could be made available to parties outside the school 
system. This commenter noted that electronic identifiers may act as a 
key, offering direct access to the student's entire file, and that PINs 
and passwords alone do not provide adequate security for education 
records. Another commenter said that if electronic identifiers and ID 
numbers can be released as directory information, then password 
requirements need to be more stringent to guard against unauthorized 
access to information and identity theft.
    Some commenters recommended establishing categories of directory 
information, with certain information

[[Page 74808]]

made available only within the educational community. One commenter 
expressed concern about Internet safety because the regulations allow 
publication of a student's e-mail address. Another said that FERPA 
should not prevent institutions from printing the student's ID number 
on an ID card or otherwise restrict its use on campus but that 
publication in a directory should not be allowed.
    Two commenters asked the Department to confirm that the regulations 
allow institutions to post grades using a code known only by the 
teacher and the student.
    Discussion: We share commenters' concerns about the use of 
students' SSNs. In general, however, there is no statutory authority 
under FERPA to prohibit an educational agency or institution from using 
SSNs as a student ID number, on academic transcripts, or to search an 
electronic database so long as the agency or institution does not 
disclose the SSN in violation of FERPA requirements. As discussed 
elsewhere in this preamble, FERPA does prohibit using a student's SSN, 
without consent, to search records in order to confirm directory 
information.
    Some States prohibit the use of SSNs as a student ID number, and 
some institutions have voluntarily ceased using SSNs in this manner 
because of concerns about identity theft. Students are required to 
provide their SSNs in order to receive Federal financial aid, and the 
regulations do not prevent an agency or institution from using SSNs for 
this purpose. We note that FERPA does not address, and we do not 
believe that there is statutory authority under FERPA to require, 
creation of a single student identifier to replace the SSN. In any 
case, the Department encourages educational agencies and institutions, 
as well as State educational authorities, to follow best practices of 
the educational community with regard to protecting students' SSNs.
    We agree that students should not be penalized for opting out of 
directory information disclosures. Indeed, an educational agency or 
institution may not require parents and students to waive their rights 
under FERPA, including the right to opt out of directory information 
disclosures. On the other hand, we do not interpret FERPA to require 
educational agencies and institutions to ensure that students can 
remain anonymous to others in the school community when using an 
institution's electronic communications systems. As a result, parents 
and students who opt out of directory information disclosures may not 
be able to use electronic communications systems that require the 
release of the student's name or electronic identifier within the 
school community. (As discussed later in this notice in our discussion 
of the comments on Sec.  99.37(c), the right to opt out of directory 
information disclosures may not be used to allow a student to remain 
anonymous in class.)
    The regulations allow an educational agency or institution to 
designate a student's user ID or other electronic identifier as 
directory information if the identifier functions essentially like the 
student's name, and therefore, disclosure would not be considered 
harmful or an invasion of privacy. That is, the identifier cannot be 
used to gain access to education records except when combined with one 
or more factors that authenticate the student's identity.
    We have historically advised that student ID numbers may not be 
disclosed as directory information because they have traditionally been 
used like SSNs, i.e., as both an identifier and authenticator of 
identity. We agree, however, that the proposed definition was confusing 
and unnecessarily restrictive because it failed to recognize that many 
institutions no longer use student ID numbers in this manner. If a 
student identifier cannot be used to access records or communicate 
electronically without one or more additional factors to authenticate 
the user's identity, then the educational agency or institution may 
treat it as directory information under FERPA regardless of what the 
identifier is called. We have revised the definition of directory 
information to provide this flexibility.
    We share the commenters' concerns about the use of PINs and 
passwords. In the preamble to the NPRM, we explained that PINs or 
passwords, and single-factor authentication of any kind, may not be 
reasonable for protecting access to certain kinds of information (73 FR 
15585). We also recognize that user IDs and other electronic 
identifiers may provide greater access and linking to information than 
does a person's name. Therefore, we remind educational agencies and 
institutions that disclose student ID numbers, user IDs, and other 
electronic identifiers as directory information to examine their 
recordkeeping and data sharing practices and ensure that, when these 
identifiers are used, the methods they select for authenticating 
identity provide adequate protection against the unauthorized 
disclosure of information in education records.
    We also share the concern of commenters who stated that students' 
e-mail addresses and other identifiers should be disclosed as directory 
information only within the school system and should not be made 
available outside the institution. The disclosure of directory 
information is permissive under FERPA, and, therefore, an agency or 
institution is not required to designate and disclose any student 
identifier (or any other item) as directory information. Further, while 
FERPA does not expressly recognize different levels or categories of 
directory information, an agency or institution is not required to make 
student directories and other directory information available to the 
general public just because the information is shared within the 
institution. For example, under FERPA, an institution may decide to 
make students' electronic identifiers and e-mail addresses available 
within the institution but not release them to the general public as 
directory information. In fact, the preamble to the NPRM suggested that 
agencies and institutions should minimize the public release of student 
directories to mitigate the risk of re-identifying information that has 
been de-identified (73 FR 15584).
    With regard to student ID numbers in particular, an agency or 
institution may print an ID number on a student's ID card whether or 
not the number is treated as directory information because under FERPA 
simply printing the ID number on a card, without more, is not a 
disclosure and, therefore, is not prohibited. See 20 U.S.C. 
1232g(b)(2). If the student ID number is not designated as directory 
information, then the agency or institution may not disclose the card, 
or require the student to disclose the card, except in accordance with 
one of the exceptions to the consent requirement, such as to school 
officials with legitimate educational interests. If the student ID 
number is designated as directory information in accordance with these 
regulations, then it may be disclosed. However, the agency or 
institution may still decide against making a directory of student ID 
numbers available to the general public.
    We discuss codes used by teachers to post grades in our discussion 
of the definition of personally identifiable information elsewhere in 
this preamble.
    Changes: We have revised the definition of directory information in 
Sec.  99.3 to provide that directory information includes a student ID 
number if it cannot be used to gain access to education records except 
when used with one or more other factors to authenticate the user's 
identity.

[[Page 74809]]

(2) Conditions for Disclosing Directory Information
(i) 99.37(b)
    Comment: All comments on this provision supported our proposal to 
clarify that an educational agency or institution must continue to 
honor a valid request to opt out of directory information disclosures 
even after the student no longer attends the institution. One commenter 
stated that the proposed regulations appropriately provided former 
students with the continuing ability to control the release of 
directory information and remarked that this will benefit students and 
families. One commenter asked how long an opt out from directory 
information disclosures must be honored. Another commenter said that 
students may object if their former schools do not disclose directory 
information without their specific written consent because the school 
is unable to determine whether the student previously opted out. This 
could occur, for example, if a school declined to disclose that a 
student had received a degree to a prospective employer.
    Discussion: The regulations clarify that once a parent or eligible 
student opts out of directory information disclosures, the educational 
agency or institution must continue to honor that election after the 
student is no longer in attendance. While this is not a new 
interpretation, school districts and postsecondary institutions have 
been unclear about its application and have not administered it 
consistently. The inclusion in the regulations of this longstanding 
interpretation is necessary to ensure that schools clearly understand 
their obligation to continue to honor a decision to opt out of the 
disclosure of directory information after a student stops attending the 
school, until the parent or eligible student rescinds it.
    Educational agencies and institutions are not required under FERPA 
to disclose directory information to any party. Therefore, parents and 
students have no basis for objecting if an agency or institution does 
not disclose directory information because it is not certain whether 
the parent or student opted out. The regulations provide an educational 
agency or institution with the flexibility to determine the process it 
believes is best suited to serve its population as long as it honors 
prior elections to opt out of directory information disclosures.
    Changes: None.
(ii) Sec.  99.37(c)
    Comment: We received two comments in support of our proposal to 
clarify in this section that parents and students may not use the right 
to opt out of directory information disclosures to prevent disclosure 
of the student's name or other identifier in the classroom.
    Discussion: We appreciate the commenters' support.
    Changes: None.
(iii) Sec.  99.37(d)
    Comment: Two commenters supported the prohibition on using a 
student's SSN to disclose or confirm directory information unless a 
parent or eligible student provides written consent. One of these 
commenters questioned the statutory basis for this interpretation.
    Several commenters asked whether, under the proposed regulations, a 
school must deny a request for directory information if the requester 
supplies the student's SSN. One commenter asked whether a request for 
directory information that contains a student's SSN may be honored so 
long as the school does not use the SSN to locate the student's 
records. One commenter stated that the regulations could more 
effectively protect students' SSNs but was concerned that denying a 
request for directory information that contains an SSN may 
inadvertently confirm the SSN.
    One commenter expressed concern that the prohibition on using a 
student's SSN to verify directory information would leave schools with 
large student populations unable to locate the appropriate record 
because they will need to rely solely on the student's name and other 
directory information, if any, provided by the requester, which may be 
duplicated in their databases. This commenter said that students would 
object if institutions were unable to respond quickly to requests by 
banks or landlords for confirmation of enrollment because the request 
contained the student's SSN.
    One commenter suggested that the regulations require an educational 
agency or institution to notify a requester that the release or 
confirmation of directory information does not confirm the accuracy of 
the SSN or other non-directory information submitted with the request. 
Another commenter asked whether the regulations apply to confirmation 
of student enrollment and other directory information by outside 
service providers such as the National Student Clearinghouse.
    Discussion: The provision in the proposed regulations prohibiting 
an educational agency or institution from using a student's SSN when 
disclosing or verifying directory information is based on the statutory 
prohibition on disclosing personally identifiable information from 
education records without consent in 20 U.S.C. 1232g(b). The 
prohibition applies also to any party outside the agency or institution 
providing degree, enrollment, or other confirmation services on behalf 
of an educational agency or institution, such as the National Student 
Clearinghouse.
    A school is not required to deny a request for directory 
information about a student, such as confirmation whether a student is 
enrolled or has received a degree, if the requester supplies the 
student's SSN (or other non-directory information) along with the 
request. However, in releasing or confirming directory information 
about a student, the school may not use the student's SSN (or other 
non-directory information) supplied by the requester to identify the 
student or locate the student's records unless a parent or eligible 
student has provided written consent. This is because confirmation of 
information in education records is considered a disclosure under 
FERPA. See 20 U.S.C. 1232g(b). A school's use of a student's SSN (or 
other non-directory information) provided by the requester to confirm 
enrollment or other directory information implicitly confirms and, 
therefore, discloses, the student's SSN (or other non-directory 
information). This is true even if the requester also provides the 
school with the student's name, date of birth, or other directory 
information to help identify the student.
    A school may choose to deny a request for directory information, 
whether or not it contains a student's SSN, because only a parent or 
eligible student has a right to obtain education records under FERPA. 
Denial of a request for directory information that contains a student's 
SSN is not an implicit confirmation or disclosure of the SSN.
    These regulations will not adversely affect the ability of 
institutions to respond quickly to requests by parties such as banks 
and landlords for confirmation of enrollment that contain the student's 
SSN because students generally provide written consent for schools to 
disclose information to the inquiring party in order to obtain banking 
and housing services. We note, however, that if a school wishes to use 
the student's SSN to confirm enrollment or other directory information 
about the student, it must ensure that the written consent provided by 
the student includes consent for the school to

[[Page 74810]]

disclose the student's SSN to the requester.
    There is no authority in FERPA to require a school to notify 
requesters that it is not confirming the student's SSN (or other non-
directory information) when it discloses or confirms directory 
information. However, when a party submits a student's SSN along with a 
request for directory information, in order to avoid confusion, unless 
a parent or eligible student has provided written consent for the 
disclosure of the student's SSN, the school may indicate that it has 
not used the SSN (or other non-directory information) to locate the 
student's records and that its response may not and does not confirm 
the accuracy of the SSN (or other non-directory information) supplied 
with the request.
    We recognize that with a large database of student information, 
there may be some loss of ability to identify students who have common 
names if SSNs are not used to help identify the individual. However, 
schools that do not use SSNs supplied by a party requesting directory 
information, either because the student has not provided written 
consent or because the school is not certain that the written consent 
includes consent for the school to disclose the student's SSN, 
generally may use the student's address, date of birth, school, class, 
year of graduation, and other directory information to identify the 
student or locate the student's records.
    Changes: None.

(c) Disclosure (Sec.  99.3)

    Comment: Two commenters said that the proposal to revise the 
definition of disclosure to exclude the return of a document to its 
source was too broad and could lead to improper release of highly 
sensitive documents, such as an individualized education program (IEP) 
contained in a student's special education records, to anyone claiming 
to be the creator of a record. One of the commenters stated that 
changing the definition was unnecessary, as schools already have a 
means of verifying documents by requesting additional copies from the 
source. Both commenters also expressed concern that, because 
recordation is not required, a parent or eligible student will not be 
aware that the verification occurred.
    We also received comments of strong support for the proposed change 
to the definition of disclosure. The commenters stated that this 
change, targeted to permit the release of records back to the 
institution that presumably created them, will enhance an institution's 
ability to identify and investigate suspected fraudulent records in a 
timely manner.
    Discussion: For several years now, school officials have advised us 
that problems related to fraudulent records typically involve a 
transcript or letter of recommendation that has been altered by someone 
other than the responsible school official. Under the current 
regulations, an educational agency or institution may ask for a copy of 
a record from the presumed source when it suspects fraudulent activity. 
However, simply asking for a copy of a record may not be adequate, for 
example, if the original record no longer exists at the sending 
institution. In these circumstances, an institution will need to return 
a record to its identified source to be able to verify its 
authenticity. The final regulations permit a targeted release of 
records back to the stated source for verification purposes in order to 
provide schools with the flexibility needed for this process while 
preserving a more general prohibition on the release of information 
from education records.
    We do not agree that the term disclosure as proposed in the NPRM is 
too broad and could lead to the improper release of highly sensitive 
documents to anyone claiming to be the creator of the record. School 
officials have not advised us that they have had problems receiving IEP 
records and other highly sensitive materials from parties who did not 
in fact create or provide the record. Therefore, we do not believe that 
the proposed definition of disclosure is too broad.
    The commenters are correct that the return of an education record 
to its source does not have to be recorded, because it is not a 
disclosure. We do not consider this problematic, however, because the 
information is merely being returned to the party identified as its 
source. This is similar to the situation in which a school is not 
required under the regulations to record disclosures of education 
records made to school officials with legitimate educational interests. 
As in that instance, there is no direct notice to a parent or student 
of either the disclosure of the record or the information in the 
record. We also believe that if a questionable document is deemed to be 
inauthentic by the source, the student will be informed of the results 
of the authentication process by means other than seeing a record of 
the disclosure in the student's file. There appears to be little value 
in notifying a parent or student that a document was suspected of being 
fraudulent if the document is found to be genuine and accurate.
    Finally, we note that a transcript or other document does not lose 
its protection under FERPA, including the written consent requirements, 
when an educational agency or institution returns it to the source. The 
document and the information in it remains an ``education record'' 
under FERPA when it is returned to its source. As an education record, 
it may not be redisclosed except in accordance with FERPA requirements, 
including Sec.  99.31(a)(1), which allows the source institution to 
disclose the information to teachers and other school officials with 
legitimate educational interests, such as persons who need to verify 
the accuracy or authenticity of the information. If the source 
institution makes any further disclosures of the record or information, 
it must record them.
    Changes: None.

Additional Changes to the Definition of Disclosure

    Comment: Several commenters requested additional changes to the 
definition of disclosure. One commenter requested that any transfer of 
education records to a State's longitudinal data system not be 
considered a disclosure. Several commenters requested that additional 
changes be made so that a school could provide current education 
records of students back to the students' former schools or districts. 
A commenter recommended excluding from the definition of disclosure 
statistical information that is personally identifiable because of 
small cell sizes when the recipient agrees to maintain the 
confidentiality of the information.
    Discussion: The revised definition of disclosure, which excludes 
the return of a document to its stated source, clarifies that 
information provided by school districts or postsecondary institutions 
to State educational authorities, including information maintained in a 
consolidated student records system, may be provided back to the 
original district or institution without consent. There is no statutory 
authority, however, to exclude from the definition of disclosure a 
school district's or institution's release or transfer of personally 
identifiable information from education records to its State 
longitudinal data system. (We discuss the disclosure of education 
records in connection with the development of consolidated, 
longitudinal data systems in our response to comments on redisclosure 
and recordkeeping requirements elsewhere in this preamble.) Likewise, 
there is no statutory authority to exclude from the definition of 
disclosure the release of personally identifiable information from

[[Page 74811]]

education records to parties that agree to keep the information 
confidential. (See our discussion of personally identifiable 
information and de-identified records and information elsewhere in this 
preamble.)
    The revised regulations do not authorize the disclosure of 
education records to third parties who are not identified as the 
provider or creator of the record. For example, a college may not send 
a student's current college records to a student's high school under 
the revised definition of disclosure because the high school is not the 
stated source of those records. (We discuss this issue elsewhere in the 
preamble under Disclosure of Education Records to Students' Former 
Schools.)
    Changes: None.

(d) Education Records

(1) Paragraph (b)(5)
    Comment: Several commenters supported our proposal to clarify the 
existing exclusion from the definition of education records for records 
that only contain information about an individual after he or she is no 
longer a student, which we referred to as ``alumni records'' in the 
NPRM, 73 FR 15576. One commenter suggested that the term ``directly 
related,'' which is used in the amended definition in reference to a 
student's attendance, is inconsistent with the use of the term 
``personally identifiable'' in other sections of the regulations and 
could cause confusion.
    One commenter asked whether a postsecondary school could provide a 
student's education records from the postsecondary school to a 
secondary school that the student attended previously.
    Several commenters objected to the proposed regulations because, 
according to the commenters, the regulations would expand the records 
subject to FERPA's prohibition on disclosure of education records 
without consent. A journalist stated that the settlement agreement 
cited in the NPRM is an example of a record that should be excluded 
from the definition and that schools already are permitted to protect 
too broad a range of documents from public review because the documents 
are education records. The commenter stated that information from 
education records such as a settlement agreement is newsworthy, 
unlikely to contain confidential information, and that disclosure of 
such information provides a benefit to the public. Another commenter 
expressed concern that the regulations allow schools to collect 
negative information about a former student without giving the 
individual an opportunity to challenge the content because the 
information is not an education record under FERPA.
    Discussion: It has long been the Department's interpretation that 
records created or received by an educational agency or institution on 
a former student that are directly related to the individual's 
attendance as a student are not excluded from the definition of 
education records under FERPA, and that records created or received on 
a former student that are not directly related to the individual's 
attendance as a student are excluded from the definition and, 
therefore, are not ``education records.'' The proposed regulations in 
paragraph (b)(5) were intended to clarify the use of this exclusion, 
not to change or expand its scope.
    Our use of the phrase ``directly related to the individual's 
attendance as a student'' to describe records that do not fall under 
this exclusion from the definition of education records is not 
inconsistent with the term ``personally identifiable'' as used in other 
parts of the regulations and should not be confused. The term 
``personally identifiable information'' is used in the statute and 
regulations to describe the kind of information from education records 
that may not be disclosed without consent. See 20 U.S.C. 1232g(b); 34 
CFR 99.3, 99.30. While ``personally identifiable information'' 
maintained by an agency or institution is generally considered an 
``education record'' under FERPA, personally identifiable information 
does not fall under this exclusion from the definition of education 
records if the information is not directly related to the student's 
attendance as a student. For example, personally identifiable 
information related solely to a student's activities as an alumnus of 
an institution is excluded from the definition of education records 
under this provision. We think that the term ``directly related'' is 
clear in this context and will not be confused with ``personally 
identifiable.''
    A postsecondary institution may not disclose a student's 
postsecondary education records to the secondary school previously 
attended by the student under this provision because these records are 
directly related to the student's attendance as a student at the 
postsecondary institution. (We discuss this issue further under 
Disclosure of Education Records to Students' Former Schools.)
    We do not agree that documents such as settlement agreements are 
unlikely to contain confidential information. Our experience has been 
that these documents often contain highly confidential information, 
such as special education diagnoses, educational supports, or mental or 
physical health and treatment information. Our changes to the 
definition were intended to clarify that schools may not disclose this 
information to the media or other parties, without consent, simply 
because a student is no longer in attendance at the school at the time 
the record was created or received. A parent or eligible student who 
wishes to share the student's own records with the media or other 
parties is free to do so.
    Neither FERPA nor the regulations contains a provision for a parent 
or eligible student to challenge information that is not contained in 
an education record. FERPA does not prohibit a parent or student from 
using other venues to seek redress for collection and release of 
information in non-education records.
    Changes: None.
(2) Paragraph (b)(6)
    Comment: We received several comments supporting the proposed 
changes to the definition of education records that would exclude from 
the definition grades on peer-graded papers before they are collected 
and recorded by a teacher. These commenters expressed appreciation that 
this revision would be consistent with the U.S. Supreme Court's 
decision on peer-graded papers in Owasso Independent School Dist. No. 
I-011 v. Falvo, 534 U.S. 426 (2002) (Owasso). Two commenters asked how 
the provision would be applied to the use of group projects and group 
grading within the classroom.
    Discussion: The proposed changes to the definition of education 
records in paragraph (b)(6) are designed to implement the U.S. Supreme 
Court's 2002 decision in Owasso, which held that peer grading does not 
violate FERPA. As noted in the NPRM, 73 FR 15576, the Court held in 
Owasso that peer grading does not violate FERPA because ``the grades on 
students' papers would not be covered under FERPA at least until the 
teacher has collected them and recorded them in his or her grade 
book.'' 534 U.S. at 436.
    As suggested by the Supreme Count in Owasso, 534 U.S. at 435, FERPA 
is not intended to interfere with a teacher's ability to carry out 
customary practices, such as group grading of team assignments within 
the classroom. Just as FERPA does not prevent teachers from allowing 
students to grade a test or homework assignment of another student or 
from calling out that grade in class, even though the grade may 
eventually become an education record,

[[Page 74812]]

FERPA does not prohibit the discussion of group or individual grades on 
classroom group projects, so long as those individual grades have not 
yet been recorded by the teacher. The process of assigning grades or 
grading papers falls outside the definition of education records in 
FERPA because the grades are not ``maintained'' by an educational 
agency or institution at least until the teacher has recorded the 
grades.
    Changes: None.

(e) Personally Identifiable Information

    Comments on the proposed definition of personally identifiable 
information are discussed elsewhere in this preamble under the heading 
Personally Identifiable Information and De-identified Records and 
Information.

(f) State Auditors and Audits (Sec. Sec.  99.3 and Proposed 
99.35(a)(3))

    Comment: Several commenters supported the clarification in proposed 
Sec.  99.35(a)(3) that State auditors may have access to education 
records, without consent, in connection with an ``audit'' of Federal or 
State supported education programs under the exception to the written 
consent requirement for authorized representatives of ``State and local 
educational authorities.'' All but one of the commenters, however, 
disagreed strongly with the proposed definition of audit in Sec.  
99.35(a)(3), which was limited to testing compliance with applicable 
laws, regulations, and standards and did not include the broader 
concept of evaluations.
    In general, the commenters said that the proposed definition of 
audit was too narrow and would prevent State auditors from conducting 
performance audits and other services that they routinely provide in 
accordance with professional auditing standards, including the U.S. 
Comptroller's Government Auditing Standards. See www.gao.gov/govaud/ybk01.htm. A State legislative auditor noted, for example, that 45 
State legislatures have established legislative program evaluation 
offices whose express purpose is to provide research and evaluation for 
legislative decision making, and that these offices regularly use 
personally identifiable information from education records for their 
work. Some of the commenters also questioned whether financial audits 
and attestation engagements would be excluded under the proposed 
definition.
    One commenter said that the State auditor provisions in proposed 
Sec. Sec.  99.3 and 99.35(a)(3) should be expanded to apply to other 
non-education State officials responsible for evaluating publicly 
funded programs. Another commenter recommended that the regulations 
include examination of education records by health department officials 
to improve compliance with mandated immunization schedules.
    The majority of the comments we received with respect to the 
inclusion of local auditors in the proposed definition of State auditor 
in Sec.  99.3 supported permitting local auditors to have access to 
personally identifiable information for purposes of auditing Federal or 
State supported education programs. One commenter said that local 
auditors should not be included in the definition, while another 
commenter stated that auditors for the city health department need 
access to FERPA-protected information to determine the accuracy of 
claims for payment and asked for further clarification on the issue.
    Discussion: We explained in the preamble to the NPRM that the 
statute allows disclosure of personally identifiable information from 
education records without consent to authorized representatives of 
``State educational authorities'' in connection with an audit or 
evaluation of Federal or State supported education programs. 73 FR 
15577. Legislative history indicates that Congress amended the statute 
in 1979 to ``correct an anomaly'' in which the existing exception to 
the consent requirement in 20 U.S.C. 1232g(b)(3) was interpreted to 
preclude State auditors from obtaining access to education records for 
audit purposes. See H.R. Rep. No. 338, 96th Cong., 1st Sess. at 10 
(1979), reprinted in 1979 U.S. Code Cong. & Admin. News 819, 824. 
However, because the amended statutory language in 20 U.S.C. 
1232g(b)(5) refers only to ``State and local educational officials,'' 
the proposed regulations sought to clarify that this included ``State 
auditors'' or auditors with authority and responsibility under State 
law for conducting audits. Due to the breadth of this inclusion, 
however, the proposed regulations also sought to limit access to 
education records by State auditors by narrowing the definition of 
audit.
    The Secretary has carefully reviewed the comments and, based upon 
further intradepartmental review, has decided to remove from the final 
regulations the provisions related to State auditors and audits in 
Sec. Sec.  99.3 and 99.35(a)(3). We share the commenters' concerns 
about preventing State auditors from conducting activities that they 
routinely perform under applicable auditing standards. However, because 
our focus was on the narrow definition of audit, we proposed a very 
broad definition of State auditor in Sec.  99.3 and did not examine 
which of the various types of officials, offices, committees, and staff 
in executive and legislative branches of State government should be 
included in the definition. We are concerned that without the narrow 
definition of audit as proposed in Sec.  99.35(a)(3), the proposed 
definition of State auditor may allow non-consensual disclosures of 
education records to a variety of officials for purposes not supported 
by the statute. The Department will study the matter further and may 
issue new regulations or guidance, as appropriate. In the interim, the 
Department will provide guidance on a case-by-case basis.
    Changes: We are not including the definition of State auditor in 
Sec.  99.3 and the provisions related to State auditors and audits in 
Sec.  99.35(a)(3) in these final regulations.

Disclosures to Parents (Sec. Sec.  99.5 and 99.36)

    Comment: A majority of commenters approved of the Secretary's 
efforts to clarify that, even after a student has become an eligible 
student, an educational agency or institution may disclose education 
records to the student's parents, without the consent of the student, 
if certain conditions are met. Those commenters stated that the 
clarification was especially helpful, particularly in light of issues 
that arose after the April 2007 shootings at the Virginia Polytechnic 
Institute and State University (Virginia Tech). A commenter stated that 
the clarification will assist emergency management officials on college 
and university campuses and help school officials know when they can 
properly share student information with parents and students. One 
commenter expressed support for the proposed regulations, because it 
has been her experience that colleges do not share information with 
parents on their children's financial aid or academic status.
    Some commenters disagreed with the proposed changes. One stated 
that, due to varying family dynamics, disclosures should not be limited 
only to parents, but should also include other appropriate family 
members. Another commenter objected to the phrase in Sec.  99.5(a)(2) 
that would permit disclosure to a parent without the student's consent 
if the disclosure meets ``any other provision in Sec.  99.31(a).'' The 
commenter stated that this ``catch-all phrase'' exceeded statutory 
authority.
    Noting the sensitivity of financial information included in income 
tax returns, a few commenters raised concerns about the discussion in 
the

[[Page 74813]]

NPRM in which we explained that an institution can determine that a 
parent claimed a student as a dependent by asking the parent to supply 
a copy of the parent's most recent Federal tax return. Another 
commenter stated that the NPRM did not go far enough and recommended 
specifically requiring an institution to rely on a copy of a parent's 
most recent Federal tax return to determine a student's dependent 
status, while another commenter recommended that we change the 
regulations to indicate that only the parent who has claimed the 
student as a dependent may have access to the student's education 
records.
    A commenter noted that some States have high school students who 
are concurrently enrolled in secondary schools and postsecondary 
institutions as early as ninth grade and supported the clarification 
that postsecondary institutions may disclose information to parents of 
students who are tax dependents.
    Discussion: Parents' rights under FERPA transfer to a student when 
the student reaches age 18 or enters a postsecondary institution. 20 
U.S.C. 1232g(d). However, under Sec.  99.31(a)(8), an educational 
agency or institution may disclose education records to an eligible 
student's parents if the student is a dependent as defined in section 
152 of the Internal Revenue Code of 1986. Under Sec.  99.31(a)(8), 
neither the age of a student nor the parent's status as custodial 
parent is relevant to the determination whether disclosure of 
information from an eligible student's education records to that parent 
without written consent is permissible under FERPA. If a student is 
claimed as a dependent for Federal income tax purposes by either 
parent, then under the regulations, either parent may have access to 
the student's education records without the student's consent.
    The statutory exception to the consent requirement in FERPA for the 
disclosure of records of dependent students applies only to the parents 
of the student. 20 U.S.C. 1232g(b)(1)(H). Accordingly, the Secretary 
does not have statutory authority to apply Sec.  99.31(a)(8) to any 
other family members. However, under Sec.  99.30(b)(3), an eligible 
student may provide consent for the school to disclose information from 
his or her education records to another family member. In some 
situations, such as when there is no parent in the student's life or 
the student is married, a spouse or other family member may be 
considered an appropriate party to whom a disclosure may be made, 
without consent, in connection with a health or safety emergency under 
Sec. Sec.  99.31(a)(10) and 99.36.
    In most cases, when an educational agency or institution discloses 
education records to parents of an eligible student, we expect the 
disclosure to be made under the dependent student provision (Sec.  
99.31(a)(8)), in connection with a health or safety emergency 
(Sec. Sec.  99.31(a)(10) and 99.36), or if a student has committed a 
disciplinary violation with respect to the use or possession of alcohol 
or a controlled substance (Sec.  99.31(a)(15)). This is the reason we 
mention these provisions specifically in the regulations. However, 
inclusion of the phrase ``of any other provision in Sec.  99.31(a)'' in 
Sec.  99.5(a)(2) is necessary and within our statutory authority 
because there may be other exceptions to FERPA's general consent 
requirement under which an agency or institution might disclose 
education records to a parent of an eligible student, such as the 
directory information provision in Sec.  99.31(a)(11) and the provision 
permitting disclosure in compliance with a court order or lawfully 
issued subpoena in Sec.  99.31(a)(9).
    As we explained in the NPRM, institutions can determine that a 
parent claims a student as a dependent by asking the parent to submit a 
copy of the parent's most recent Federal income tax return. However, we 
do not think it is appropriate to require an agency or institution to 
rely only on the most recent tax return to determine the student's 
dependent status because institutions should have flexibility in how to 
reach this determination. For instance, institutions may rely instead 
on a student's assertion that he or she is not a dependent unless the 
parent provides contrary evidence. We agree that financial information 
on a Federal tax return is sensitive information and, for that reason, 
in providing technical assistance and compliance training to school 
officials, we have advised that parents may redact all financial and 
other unnecessary information that appears on the form, as long as the 
tax return clearly shows the parent's or parents' names and the fact 
that the student is claimed as a dependent.
    In addition, in the fall of 2007, we developed two model forms that 
appear on the Department's Family Policy Compliance Office (FPCO or the 
Office) Web site that institutions may adapt and provide to students at 
orientation to indicate whether they are a dependent and, if not, 
obtaining consent from the student for disclosure of information to 
parents: http://www.ed.gov/policy/gen/guid/fpco/ferpa/safeschools/modelform.html and http://www.ed.gov/policy/gen/guid/fpco/ferpa/safeschools/modelform2.html.
    With regard to the comment about high school students who are 
concurrently enrolled in postsecondary institutions as early as ninth 
grade, FERPA not only permits those postsecondary institutions to 
disclose information to parents of the high school students who are 
dependents for Federal income tax purposes, it also permits high 
schools and postsecondary institutions who have dually-enrolled 
students to share information. Where a student is enrolled in both a 
high school and a postsecondary institution, the two schools may share 
education records without the consent of either the parents or the 
student under Sec.  99.34(b). If the student is under 18, the parents 
still retain the right under FERPA to inspect and review any education 
records maintained by the high school, including records that the 
college or university disclosed to the high school, even though the 
student is also attending the postsecondary institution.
    Changes: None.

Outsourcing (Sec.  99.31(a)(1)(i)(B))

(a) Outside Parties Who Qualify as School Officials

    Comment: A few commenters disagreed with the proposal to expand the 
``school officials'' exception in Sec.  99.31(a)(1)(i)(B) to include 
contractors, consultants, volunteers, and other outside parties to whom 
an educational agency or institution has outsourced institutional 
services or functions it would otherwise use employees to perform. They 
believed that the modifications undermined the plain language of the 
statute and congressional intent. Several other commenters supported 
the proposed regulations, saying that it was helpful to include in the 
regulations what has historically been the Department's interpretation 
of the ``school officials'' exception. A majority of commenters, while 
not agreeing or disagreeing with the proposed changes in Sec.  
99.31(a)(1)(i)(B), raised a number of issues concerning the proposal.
    Several commenters expressed concern that the requirement that an 
outside party must perform an institutional service or function for 
which the agency or institution would otherwise use employees is too 
restrictive and impractical. One commenter noted that some functions 
that a contractor performs could not be performed by a school official.
    Some commenters said we should clarify the regulations to explain 
the

[[Page 74814]]

circumstances under which volunteers may serve as school officials and 
have access to personally identifiable information from education 
records in connection with their services or responsibilities to the 
school. One commenter noted that this clarification was needed 
especially for parent-volunteers working at a school attended by their 
own children where they are likely to know other students and their 
families.
    Several commenters asked that we clarify in the regulations that 
Sec.  99.31(a)(1) also applies to school transportation officials, 
school bus drivers, and school bus attendants who need access to 
education records in order to safely and efficiently transport 
students. Another commenter asked for clarification whether, under the 
proposed regulations, practicum students, fieldwork students, and 
unpaid interns in schools would be considered ``school officials.'' One 
commenter asked whether Sec.  99.31(a)(1) permits outsourced medical 
providers to be considered ``school officials.''
    One commenter asked how proposed Sec.  99.31(a)(1) would apply to 
parties other than educational agencies and institutions. The commenter 
was concerned about permitting SEAs to disclose personally identifiable 
information to outside parties under Sec.  99.31(a)(1)(i)(B) because 
SEAs are not subject to Sec.  99.7, which requires educational agencies 
and institutions to annually notify parents and eligible students of 
their rights under FERPA, including a specific requirement in Sec.  
99.7(a)(3)(iii) that an educational agency or institution that has a 
policy of disclosing information under Sec.  99.31(a)(1) must include 
in its annual notice a specification of criteria for determining who 
constitutes a school official and what constitutes a legitimate 
educational interest. A number of commenters requested clarification 
about the applicability of Sec.  99.31(a)(1)(i)(B) to State authorities 
that operate State longitudinal data systems that maintain records of 
local educational agencies (LEAs) or institutions and are responsible 
for certain reporting requirements under the No Child Left Behind Act. 
Some of these commenters believe that State authorities operating these 
systems are ``school officials'' under Sec.  99.31(a)(1) who should be 
able to disclose education records for the purpose of outsourcing under 
Sec.  99.31(a)(1)(i)(B).
    One commenter recommended that the regulations permit the 
disclosure of education records to non-educational State agencies for 
evaluation purposes under Sec.  99.31(a)(1). Another commenter asked 
that we revise the regulations to permit representatives of the Centers 
for Disease Control and Prevention to access education records for the 
purpose of public health surveillance under the ``school officials'' 
exception.
    Another commenter requested further guidance on how Sec.  
99.31(a)(1) would apply to local law enforcement officers who work in 
collaboration with schools in various capacities and whether education 
records could be shared with these officers in order to ensure safe 
campuses.
    Discussion: The Secretary does not agree that the proposed changes 
to Sec.  99.31(a)(1) go beyond the plain reading of the statute and 
congressional intent. As we explained in the NPRM, FERPA's broad 
definition of education records includes records that are maintained by 
``a person acting for'' an educational agency or institution. 20 U.S.C. 
1232g(a)(4)(A)(ii); see 34 CFR 99.3. (In floor remarks describing the 
meaning of the definition of education records, Senators James Buckley 
and Claiborne Pell, principal sponsors of the December 1974 FERPA 
amendments, specifically referred to materials that are maintained by a 
school ``or by one of its agents.'' See ``Joint Statement in 
Explanation of Buckley/Pell Amendment'' (Joint Statement), 120 Cong. 
Rec. S21488 (Dec. 13, 1974).) Although the Secretary is concerned that 
educational agencies and institutions not misapply Sec.  99.31(a)(1), 
the changes to the regulations are necessary to clarify the scope of 
the ``school officials'' exception in FERPA.
    We disagree with commenters that the requirement in Sec.  
99.31(a)(1)(i)(B)(1) that the outside party must perform an 
institutional service or function for which the agency or institution 
would otherwise use employees is too restrictive or unworkable. The 
requirement serves to ensure that the ``school officials'' exception 
does not expand into a general exception to the consent requirement in 
FERPA that would allow disclosure any time a vendor or other outside 
party wants access to education records to provide a product or service 
to schools, parents, and students. As explained in the preceding 
paragraphs and in the NPRM, 73 FR 15578-15579, the statutory basis for 
expanding the ``school officials'' exception to outside service 
providers is that they are ``acting for'' the agency or institution, 
not selling products and services. This means, for example, that a 
school may not use the ``school officials'' exception to disclose 
personally identifiable information from a student's education record, 
such as the student's SSN or student ID number, without consent, to an 
insurance company that wishes to offer students a discount on auto 
insurance because the school is not outsourcing an institutional 
service or function for which it would otherwise use its own employees.
    Further, the requirement that the outside party must be performing 
services or functions an employee would otherwise perform does not mean 
that a school employee must be able to perform the outsourced service 
in order for the outside party to be considered a school official under 
Sec.  99.31(a)(1)(i)(B)(1). For example, many school districts 
outsource their legal services on an as-needed basis. Even though these 
school districts may have never hired an attorney as an employee, they 
may still disclose personally identifiable information from education 
records to outside legal counsel to whom they have outsourced their 
legal services. FERPA does not otherwise restrict whether a school may 
outsource institutional services and functions; it only addresses to 
whom and under what conditions personally identifiable information from 
students' education records may be disclosed.
    Once a school has determined that an outside party is a ``school 
official'' with a ``legitimate educational interest'' in viewing 
certain education records, that party may have access to the education 
records, without consent, in order to perform the required 
institutional services and functions for the school. These outside 
parties may include parents and other volunteers who assist schools in 
various capacities, such as serving on official committees, serving as 
teachers' aides, and working in administrative offices, where they need 
access to students' education records to perform their duties.
    The disclosure of education records under any of the conditions 
listed in Sec.  99.31, including the ``school officials'' exception, is 
permissive and not required. (Only parents and eligible students have a 
right under FERPA to inspect and review their education records.) 
Therefore, schools should always use good judgment in determining the 
extent to which volunteers, as well as other school officials, need to 
have access to education records and to ensure that school officials, 
including volunteers, do not improperly disclose information from 
students' education records.
    We decline to adopt commenters' suggestion that we include in Sec.  
99.31(a)(1)(i)(B) a list of the types of parties who may serve as 
school officials and receive personally identifiable information from 
education

[[Page 74815]]

records in connection with the institutional services and functions 
outsourced by the school. We think it would be impossible to provide a 
comprehensive listing and believe that agencies and institutions are in 
the best position to make these determinations. At the discretion of a 
school, school officials may include school transportation officials 
(including bus drivers), school nurses, practicum and fieldwork 
students, unpaid interns, consultants, contractors, volunteers, and 
other outside parties providing institutional services and performing 
institutional functions, provided that each of the requirements in 
Sec.  99.31(a)(1)(i)(B) has been met.
    Under Sec.  99.31(a)(1), a university could outsource the practical 
training of students. The information disclosed to the hospital, 
clinic, or business conducting the practical training may only be used 
for the purposes for which it was disclosed. In the NPRM, we discuss in 
more detail the types of services and functions covered under Sec.  
99.31(a)(1)(i)(B). (73 FR 15578-15580.)
    In response to the comment about the applicability of Sec.  
99.31(a)(1)(i)(B) to State educational authorities that operate State 
longitudinal data systems, such officials are not ``school officials'' 
under FERPA. Rather, these officials are generally considered 
authorized representatives of a State educational authority, and LEAs 
typically disclose information from students' education records to a 
longitudinal data system maintained by an SEA or other State 
educational authorities under the exception to the consent requirement 
for disclosures to authorized representatives of State and local 
educational authorities, Sec.  99.31(a)(3)(iv)), not the ``school 
officials'' exception. This issue is explained in more detail elsewhere 
in this preamble under Educational research (Sec. Sec.  99.31(a)(6), 
99.31(a)(3). We also discuss disclosures to non-educational agencies, 
such as to public health agencies, in the section of this preamble 
entitled Disclosure of Education Records to Non-Educational Agencies.
    Members of a school's law enforcement unit, as defined in Sec.  
99.8 of the regulations, who are employed by the agency or institution 
qualify as school officials under Sec.  99.31(a)(1)(i)(A) if the school 
has complied with the notification requirements in Sec.  
99.7(a)(3)(iii). As school officials, they may be given access to 
personally identifiable information from those students' education 
records in which the school has determined they have legitimate 
educational interests. The school's law enforcement unit must protect 
the privacy of education records it receives and may disclose them only 
with consent or under one of the exceptions to consent listed in Sec.  
99.31. For that reason, it is advisable that officials of a law 
enforcement unit maintain education records separately from law 
enforcement unit records, which are not subject to FERPA requirements. 
As we explained in Balancing Student Privacy and School Safety: A Guide 
to the Family Educational Rights and Privacy Act for Elementary and 
Secondary Schools, investigative reports and other records created by 
an institution's law enforcement unit are excluded from the definition 
of education records under Sec.  99.3 and, therefore, are not subject 
to FERPA requirements. Accordingly, schools may disclose information 
from law enforcement unit records to anyone, including local police and 
other outside law enforcement authorities, without consent. This 
brochure can be found on FPCO's ``Safe Schools & FERPA'' Web page: 
http://www.ed.gov/policy/gen/guid/fpco/ferpa/safeschools/index.html.
    Outside police officers or other non-employees to whom the school 
has outsourced its safety and security functions do not qualify as 
``school officials'' under FERPA unless they meet each of the 
requirements of Sec.  99.31(a)(1)(i)(B). If these police officers or 
other outside parties do not meet the requirements for being a school 
official under FERPA, they may not have access to students' education 
records without consent, unless there is a health or safety emergency, 
a lawfully issued subpoena or court order, or some other exception to 
FERPA's general consent requirement under which the disclosure falls.
    With respect to our amendment to the ``school officials'' 
exception, we note that Sec.  99.32(d) excludes from the recordation 
requirements disclosures of education records that educational agencies 
and institutions make to school officials. This exclusion from the 
recordation requirement will apply as well to disclosures to 
contractors, consultants, volunteers, and other outside parties to whom 
an agency or institution discloses education records under Sec.  
99.31(a)(1)(i)(B). The Department has long recognized that FERPA does 
not prevent schools from outsourcing institutional services and 
functions; to require schools to record disclosures to these outside 
parties serving as school officials would be overly burdensome and 
unworkable.
    An educational agency or institution that complies with the 
notification requirements in Sec.  99.7(a)(3)(iii) by specifying its 
policy regarding the disclosure of education records to contractors and 
other outside parties serving as school officials provides legally 
sufficient notice to parents and students regarding these disclosures. 
We have posted model notifications on our Web site, one for 
postsecondary institutions and one for LEAs. See http://www.ed.gov/policy/gen/guid/fpco/ferpa/ps-officials.html and http://www.ed.gov/policy/gen/guid/fpco/ferpa/lea-officials.html.
    Changes: None.

(b) Direct Control

    Comment: Some commenters asked the Department to clarify what the 
term ``direct control'' means as used in Sec.  99.31(a)(1)(i)(B)(2). 
This section provides that in order to be considered a ``school 
official'' an outside party must be under the direct control of the 
agency or institution. Some commenters asked if this term means that 
the school must monitor the operations of the outside party, and how it 
affects an agency's or institution's relationship with subcontractors 
or third- or fourth-party database hosting companies. One commenter 
stated that the regulations should not distinguish between whether the 
education records are hosted in a vendor's offsite network or within 
the institution's local network servers, while another commenter asked 
for clarification of how Sec.  99.31(a)(1)(i)(B) applies to outsourcing 
electronic mail (e-mail) services to third parties such as Microsoft or 
Google.
    One commenter stated that institutions should be required to verify 
that parties to whom they outsource services have the necessary 
resources to safeguard education records provided to them.
    A commenter suggested that, instead of the proposed ``direct 
control'' standard, the Department adopt language similar to the 
safeguarding standard found in the Gramm-Leach-Bliley Act (GLB) (Pub. 
L. 106-102, November 12, 1999). The commenter suggested that, as 
adapted in FERPA, the standard would require that for an outside party, 
acting on behalf of an educational institution, to be considered a 
``school official,'' the institution would have to: (1) Take reasonable 
steps to select and retain contractors, consultants, volunteers, or 
other outside parties that are capable of maintaining appropriate 
safeguards with respect to education records; and (2) mandate by 
contract that the outside party implement and maintain such safeguards.
    Discussion: The term ``direct control'' in Sec.  
99.31(a)(1)(i)(B)(2), is intended to

[[Page 74816]]

ensure that an educational agency or institution does not disclose 
education records to an outside service provider unless it can control 
that party's maintenance, use, and redisclosure of education records. 
This could mean, for example, requiring a contractor to maintain 
education records in a particular manner and to make them available to 
parents upon request. We are revising the regulations, however, to 
provide this clarification.
    Neither the statute nor the FERPA regulations specifically requires 
that educational agencies and institutions verify that outside parties 
to whom schools outsource services have the necessary resources to 
safeguard education records provided to them. However, as discussed in 
the NPRM, educational agencies and institutions are responsible under 
FERPA for ensuring that they themselves do not have a policy or 
practice of releasing, permitting the release of, or providing access 
to personally identifiable information from education records, except 
in accordance with FERPA. This includes ensuring that outside parties 
that provide institutional services or functions as ``school 
officials'' under Sec.  99.31(a)(1)(i)(B) do not maintain, use, or 
redisclose education records except as directed by the agency or 
institution that disclosed the information.
    The ``direct control'' requirement is intended to apply only to the 
outside party's provision of specific institutional services or 
functions that have been outsourced and the education records provided 
to that outside party to perform the services or function. It is not 
intended to affect an outside service provider's status as an 
independent contractor or render that party an employee under State or 
Federal law.
    We believe that the use of the ``direct control'' standard strikes 
an appropriate balance in identifying the necessary and proper 
relationship between the school and its outside parties that are 
serving as ``school officials.'' The recommendation that we adopt a 
standard more closely aligned with the GLB standard does not appear 
workable, especially with regard to requiring that schools enter into 
formal contracts with each outside party performing services, including 
parent-volunteers. However, one way in which schools can ensure that 
parties understand their responsibilities under FERPA with respect to 
education records is to clearly describe those responsibilities in a 
written agreement or contract.
    Exercising direct control could prove more challenging in some 
situations than in others. Schools outsourcing information technology 
services, such as web-based and e-mail services, should make clear in 
their service agreements or contracts that the outside party may not 
use or allow access to personally identifiable information from 
education records, except in accordance with the requirements 
established by the educational agency or institution that discloses the 
information.
    Changes: We have revised Sec.  99.31(a)(1)(B)(2) to clarify that 
the outside party must be under the direct control of the agency or 
institution with respect to the use and maintenance of information from 
education records.

(c) Protection of Records by Outside Parties Serving as School 
Officials

    Comment: We received several comments on proposed Sec.  
99.31(a)(1)(i)(B)(3), which provides that an outside party serving as a 
``school official'' is subject to the requirement in Sec.  99.33(a), 
regarding the use and redisclosure of personally identifiable 
information from education records. One commenter stated that, while he 
supported and welcomed this clarification, the proposed regulations did 
not go far enough to clarify that these outside third parties could not 
use education records of multiple institutions for which they serve as 
a contractor to engage in activities not associated with the service or 
function they were providing.
    Some commenters suggested that the regulations should require all 
school officials who handle education records, including parties to 
whom institutional services and functions are outsourced, to 
participate in annual training and to undergo fingerprint and 
background investigations.
    Another commenter stated that any disclosures associated with the 
outsourcing of institutional services and functions should include a 
record that will serve as an audit trail. The commenter noted that both 
the Health Insurance Portability and Accountability Act (HIPAA) and the 
Privacy Act of 1974 require the maintenance of audit trails or an 
accounting of disclosures of records.
    Discussion: An agency or institution must ensure that an outside 
party providing institutional services or functions does not use or 
allow access to education records except in strict accordance with the 
requirements established by the educational agency or institution that 
discloses the information. Section 99.33(a)(2) of the FERPA regulations 
applies to employees and outside service providers alike and prohibits 
the recipient from using education records for any purpose other than 
the purposes for which the disclosure was made. This includes ensuring 
that outside parties do not use education records in their possession 
for purposes other than those specified by the institution that 
disclosed the records.
    FERPA does not specifically require that educational agencies and 
institutions provide annual training to school officials that handle 
education records, and we decline to establish such a requirement in 
these regulations. Educational agencies and institutions should have 
flexibility in determining the best way to ensure that school officials 
are made aware of the requirements of FERPA. However, for entities 
subject to the Individuals with Disabilities Education Act (IDEA), 34 
CFR 300.623(c) provides that all persons collecting or using personally 
identifiable information must receive training or instruction regarding 
their State's policies and procedures under 34 CFR 300.123 
(Confidentiality of personally identifiable information) and 34 CFR 
Part 99, the FERPA regulations. We note that while schools are 
certainly free to implement a policy requiring school officials and 
parties to whom services have been outsourced to undergo fingerprint 
and background investigations, there is no statutory authority in FERPA 
to include such a requirement in the regulations.
    We note also that the Department routinely provides compliance 
training on FERPA for school officials. Typically, presentations are 
made throughout the year to national, regional, or State educational 
association conference workshops with numerous institutions in 
attendance. Training sessions are also scheduled for State departments 
of education and local school districts in the vicinity of any 
conference.
    For a discussion of the comment that recommended that the 
regulations require that schools maintain an audit trail or an 
accounting of disclosures to school officials, including outside 
providers, see the discussion under the following section entitled 
Control of Access to Education Records by School Officials.
    Changes: None.

Control of Access to Education Records by School Officials (Sec.  
99.31(a)(1)(ii))

    Comment: Many commenters supported proposed Sec.  99.31(a)(1)(ii), 
which requires an educational agency or institution to use reasonable 
methods to ensure that school officials have access to only those 
education records in which the official has a legitimate educational 
interest. In this section, we also proposed that an educational

[[Page 74817]]

agency or institution that does not use physical or technological 
access controls must ensure that its administrative policy for 
controlling access to education records is effective and that it 
remains in compliance with the ``legitimate educational interest'' 
requirement.
    One commenter who supported the proposed regulations expressed 
concern that not all districts and institutions have the financial or 
technological resources to create or purchase an electronic system that 
provides fully automated access control and that an institution using 
only administrative controls would be required to demonstrate that each 
school official who accessed education records possessed a legitimate 
educational interest in the education records to which the official 
gained access. According to the commenter, the regulations seem to omit 
the ``reasonable methods'' concept for those schools that utilize 
administrative controls rather than physical or technological controls. 
The commenter was concerned that smaller schools that lack resources to 
create or purchase a system that fully monitors record access would be 
disadvantaged by having to meet a higher standard of ensuring a 
legitimate educational interest on the part of the school officials 
that access the records.
    One commenter expressed concern that the standard in Sec.  
99.31(a)(1)(ii) is too restrictive and asked whether the Department 
would use flexibility and deference in taking into consideration an 
institution's efforts in compliance with the requirement.
    Another commenter requested that we include in the regulations a 
requirement that contractors hosting data at offsite locations must 
institute effective access control measures. The commenter stated that 
many schools and contractors are uncertain as to whether the school or 
the contractor is responsible for ensuring that access controls are 
applied to data hosted by contractors.
    One commenter stated that the regulations created an unnecessary 
burden, as school districts already do their best to comply with FERPA 
and an occasional mistake should be excused. The commenter, however, 
was pleased that the regulations do not require the use of 
technological controls. The commenter was concerned that schools are 
unable to pre-assign risk levels to categories of records in order to 
determine appropriate methods to mitigate improper access. The 
commenter supported the use of effective administrative controls as 
determined by a district to ensure that information is available only 
to those with a legitimate educational interest.
    One commenter expressed concern that the requirement to use 
reasonable methods to ensure appropriate access was not sufficiently 
restrictive, because under the regulations, all volunteers would be 
designated as school officials. The commenter believed that the 
regulations would enable volunteers to gain access more easily to 
confidential and sensitive information in education records.
    A commenter who is a parent of a special education student also 
expressed concern that the language in the regulations was not 
adequate. The commenter described a software package used by her 
district that permits all school officials unrestricted access to the 
IEPs of all special education students.
    Discussion: Section 99.30 requires that a parent or eligible 
student provide written consent for a disclosure of personally 
identifiable information from education records unless the 
circumstances meet one of the exceptions to consent, such as the 
release of information to a school official with a legitimate 
educational interest. Thus, a district or institution that makes a 
disclosure solely on the basis that the individual is a school official 
violates FERPA if it does not also determine that the school official 
has a legitimate educational interest. The regulations in Sec.  
99.31(a)(1)(ii) are designed to clarify the responsibility of the 
educational agency or institution to ensure that access to education 
records by school officials is limited to circumstances in which the 
school official possesses a legitimate educational interest.
    We believe that the standard of ``reasonable methods'' is 
sufficiently flexible to permit each educational agency or institution 
to select the proper balance of physical, technological, and 
administrative controls to effectively prevent unauthorized access to 
education records, based on their resources and needs. In order to 
establish a system driven by physical or technological access controls, 
a school would generally first determine when a school official has a 
legitimate educational interest in education records and then determine 
which physical or technological access controls are necessary to ensure 
that the official can access only those records. The regulations 
require a school that uses only administrative controls to ensure that 
its administrative policy for controlling access to education records 
is effective and that the school is in compliance with the legitimate 
educational interest requirement in Sec.  99.31(a)(1)(i)(A). However, 
the ``reasonable methods'' standard applies whether the control is 
physical, technological, or administrative.
    The regulations permit the use of a variety of methods to protect 
education records, in whatever format, from improper access. The 
Department expects that educational agencies and institutions will 
generally make appropriate choices in designing records access 
controls, but the Department reserves the right to evaluate the 
effectiveness of those efforts in meeting statutory and regulatory 
requirements.
    The additional language that one commenter requested concerning 
outsourcing is already included in the regulations in Sec.  
99.31(a)(1). That section specifically provides that contractors are 
subject to the same conditions governing the access and use of records 
that apply to other school officials. As long as those conditions are 
met, the physical location in which the contractor provides the service 
is not relevant.
    Because the regulations permit the use of a variety of methods to 
effectively reduce the risk of unauthorized access to education 
records, we do not believe the requirement to establish ``reasonable 
methods'' for controlling access is unduly burdensome. Schools have the 
flexibility to decide the method or methods best suited to their own 
circumstances. For the many schools, districts, and institutions that 
already meet the standard, no operational changes should be necessary.
    The regulations do not designate all volunteers as school 
officials. Rather, the regulations clarify that schools may designate 
volunteers as school officials who may be provided access to education 
records only when the volunteer has a legitimate educational interest. 
Schools can and should carefully assess and limit access by any school 
official, including volunteers. This issue is discussed in more detail 
previously in this preamble under the section entitled Outsourcing.
    With regard to the parent who expressed concern that the language 
in the regulations was not adequate to address the problem of software 
that permits all school officials to access the IEPs of all special 
education students, we believe that the language in Sec.  
99.31(a)(1)(ii) is sufficient. As previously noted, FERPA prohibits 
school officials from having access to education records unless they 
have a legitimate educational interest. The commenter's point 
illustrates the need for educational agencies and institutions to 
ensure that adequate controls are in

[[Page 74818]]

place to restrict access to education records only to a school official 
with a legitimate educational interest.
    Changes: None.

Transfer of Education Records to Student's New School (Sec. Sec.  
99.31(a)(2) and 99.34(a))

    Comment: All of the comments we received on proposed Sec. Sec.  
99.31(a)(2) and 99.34(a) supported the clarification that an 
educational agency or institution may disclose a student's education 
records to officials of another school, school system, or institution 
of postsecondary education not just when the student seeks or intends 
to enroll, but after the student is already enrolled, so long as the 
disclosure is for purposes related to the student's enrollment or 
transfer. Some commenters noted that this clarification reduces legal 
uncertainty about how long a school may continue to send records or 
information to a student's new school; other commenters noted that this 
clarification will be helpful in serving students who are homeless or 
in foster care because these students are often already enrolled in a 
new school system while waiting for records from a previous enrollment.
    A few commenters asked us to clarify the requirement that the 
disclosure must be for purposes related to the student's enrollment or 
transfer. The commenters asked whether this meant that only records 
specifically related to the new school's decision to admit the student 
or records related to the transfer of course credit could be disclosed, 
or whether the agency or institution could also disclose information 
about previously undisclosed disciplinary actions related to the 
student's ongoing attendance at the new institution. One commenter 
suggested that we remove the requirement that the disclosure must be 
for purposes of the student's enrollment or transfer because it was 
confusing and unnecessary. Some commenters asked the Department to 
provide guidance about the types of records that may be sent under the 
regulations to a student's new school, noting that the preamble to the 
NPRM stated that the regulations allow school officials to disclose any 
and all education records, including health and disciplinary records, 
to the new school (73 FR 15581).
    One commenter asked us to clarify that any school, not just the 
school the student attended most recently, may disclose information 
from education records to the institution that the student currently 
attends. Another commenter asked whether the amended regulations would 
permit the disclosure of education records to an institution in which a 
student seeks information or services but not enrollment, such as when 
a charter school student requests an evaluation under the IDEA from the 
student's home school district.
    Two commenters asked whether mental health and other treatment 
records of postsecondary students, which are excluded from the 
definition of education records under FERPA, could be disclosed to the 
new school. Other commenters asked whether FERPA places any limits on 
the transfer of information about student disciplinary actions to 
colleges and universities and what information a postsecondary 
institution may ask for and receive regarding a student's disciplinary 
actions. A few commenters asked us to address the relationship between 
these regulations and guidance issued by the Department's Office for 
Civil Rights (OCR) prohibiting the pre-admission release of information 
about a student's disability under section 504 of the Rehabilitation 
Act of 1973, as amended, and Title II of the Americans with 
Disabilities Act of 1990, as amended.
    Discussion: The regulations are intended to eliminate uncertainty 
about whether, under Sec.  99.31(a)(2), an educational agency or 
institution may send education records to a student's new school even 
after the student is already enrolled and attending the new school. The 
requirement that the disclosure must be for purposes related to the 
student's enrollment or transfer is not intended to limit the kind of 
records that may be disclosed under this exception. Instead, the 
regulations are intended to clarify that, after a student has already 
enrolled in a new school, the student's former school may disclose any 
records or information, including health records and information about 
disciplinary proceedings, that it could have disclosed when the student 
was seeking or intending to enroll in the new school.
    These regulations apply to any school that a student previously 
attended, not just the school that the student attended most recently. 
For example, under Sec.  99.31(a)(2), a student's high school may send 
education records directly to a graduate school in which the student 
seeks admission, or is already enrolled. Section 99.34(b), which 
explains the conditions that apply to the disclosure of information to 
officials of another school, school system, or postsecondary 
institution, allows a public charter school or other agency or 
institution to disclose the education records of one of its students in 
attendance to the student's home school district if the student 
receives or seeks to receive services from the home school district, 
including an evaluation under the IDEA. We note, however, that the 
confidentiality of information regulations under Part B of the IDEA 
contain additional consent requirements that may also apply in these 
circumstances.
    Under section 444(a)(4)(B)(iv) of FERPA, 20 U.S.C. 
1232g(a)(4)(B)(iv), medical and psychological treatment records of 
eligible students are excluded from the definition of education records 
if they are made, maintained, and used only in connection with 
treatment of the student and disclosed only to individuals providing 
the treatment, including treatment providers at the student's new 
school. (While the comment concerned records of postsecondary students, 
we note that the treatment records exception to the definition of 
education records applies also to any student who is 18 years of age or 
older, including 18 year old high school students.) An educational 
agency or institution may disclose an eligible student's treatment 
records to the student's new school for purposes other than treatment 
provided that the records are disclosed under one of the exceptions to 
written consent under Sec.  99.31(a), including Sec.  99.31(a)(2), or 
with the student's written consent under Sec.  99.30. If an educational 
agency or institution discloses an eligible student's treatment records 
for purposes other than treatment, the treatment records are no longer 
excluded from the definition of education records and are subject to 
all other FERPA requirements, including the right of the eligible 
student to inspect and review the records and to seek to have them 
amended under certain conditions. In practical terms, this means that 
an agency or institution may disclose an eligible student's treatment 
records to the student's new school either with the student's written 
consent, or under one of the exceptions in Sec.  99.31(a), including 
Sec.  99.31(a)(2), which permits disclosure to a school where a student 
seeks or intends to enroll, or where the student is already enrolled so 
long as the disclosure is for purposes related to the student's 
enrollment or transfer.
    FERPA does not contain any particular restrictions on the 
disclosure of a student's disciplinary records. Further, Congress has 
enacted legislation to ensure that schools transfer disciplinary 
records to a student's new school in certain circumstances. In 
particular, section 444(h) of the statute, 20 U.S.C. 1232g(h), and the 
implementing regulations in Sec.  99.36(b) provide that nothing in 
FERPA prevents an educational agency

[[Page 74819]]

or institution from including in a student's records and disclosing to 
teachers and school officials, including those in other schools, 
appropriate information about disciplinary actions taken against the 
student for conduct that posed a significant risk to the safety or 
well-being of that student, other students, or other members of the 
school community. This authority is in addition to any other authority 
in FERPA for the disclosure of education records without consent, 
including the authority under Sec.  99.36(a) to disclose education 
records in connection with a health or safety emergency. In addition, 
section 4155 of the Elementary and Secondary Education Act of 1965 
(ESEA), 20 U.S.C. 7165, as amended by the No Child Left Behind Act of 
2001 (NCLB), requires a State that receives funds under the ESEA to 
have a procedure in place to facilitate the transfer of disciplinary 
records, with respect to a suspension or expulsion, by LEAs to any 
private or public elementary school or secondary school for any student 
who is enrolled or seeks, intends, or is instructed to enroll, on a 
full-or part-time basis, in the school.
    There are, however, other Federal laws, such as the IDEA, section 
504 of the Rehabilitation Act of 1973, as amended (Rehabilitation Act), 
and Title II of the Americans with Disabilities Act of 1990, as amended 
(ADA), with different requirements that may affect the release of 
student information. For example, educational agencies and institutions 
that are ``public agencies'' or ``participating agencies'' under the 
IDEA must comply with the requirements in the Part B confidentiality of 
information regulations. See, e.g., 34 CFR 300.622(b)(2) and (3). By 
way of further illustration, because educational agencies and 
institutions receive Federal financial assistance, they must comply 
with the regulations implementing section 504 of the Rehabilitation 
Act, which generally prohibit postsecondary institutions from making 
pre-admission inquiries about an applicant's disability status. See 34 
CFR 104.42(b)(4) and (c). However, after admission, in connection with 
an emergency and if necessary to protect the health or safety of a 
student or other persons as defined under FERPA and its implementing 
regulations, section 504 of the Rehabilitation Act and Title II of the 
ADA do not prohibit postsecondary institutions from obtaining 
information and education records concerning a current student, 
including those with disabilities, from any school previously attended 
by the student. See the discussion in the section entitled Health or 
Safety Emergency (Sec.  99.36).
    Changes: None.

Ex Parte Court Orders Under the USA Patriot Act (Sec.  99.31(a)(9))

    Comment: Two commenters expressed support for the proposed 
regulations, which incorporate statutory changes that allow an 
educational agency or institution to comply with an ex parte court 
order issued under the USA Patriot Act. One commenter said that it 
would be helpful to add to the regulations a statement from the 
preamble to the NPRM that an institution is not responsible for 
determining the relevance of the information sought or the merits of 
the underlying claim for the court order.
    Several commenters opposed Sec.  99.31(a)(9). One commenter said 
that the USA Patriot Act is unconstitutional and that its provisions 
will sunset in 2009. Another commenter said that the regulations harm 
its ability to preserve the confidentiality of education records, 
particularly those of foreign students. The commenter asked us to 
change the regulations to permit institutions to notify students when 
records are requested, unless the ex parte court order specifically 
states that the student should not be notified. Another commenter said 
that schools should be required to notify parents when records are 
requested and to record the disclosure.
    Discussion: The USA Patriot Act amendments to FERPA have not been 
ruled unconstitutional, and its provisions relevant to FERPA do not 
sunset in 2009. Therefore, we are implementing these provisions in our 
regulations at this time.
    Under the USA Patriot Act, the U.S. Attorney General, or a designee 
in a position not lower than an Assistant Attorney General, may apply 
for an ex parte court order to collect, retain, disseminate, and use 
certain education records in the possession of an educational agency or 
institution without regard to any other FERPA requirements, including 
in particular the recordkeeping requirements. 20 U.S.C. 1232g(j)(3) and 
(4). The USA Patriot Act amendments to FERPA also provide that an 
educational agency or institution that complies in good faith with the 
court order is not liable to any person for producing the information. 
Nothing in these amendments, including the ``good faith'' requirement, 
requires an educational agency or institution to evaluate the 
underlying merits or legal sufficiency of the court order before 
disclosing the requested information without consent. As with any court 
order or subpoena that forms the basis of a disclosure without consent 
under Sec.  99.31(a)(9), the agency or institution must simply 
determine whether the ex parte court order is facially valid. We see no 
reason to include this general requirement in the regulations.
    Section 99.31(a)(9)(ii) requires an agency or institution to make a 
reasonable effort to notify a parent or eligible student of a judicial 
order or lawfully issued subpoena in advance of compliance, except for 
certain law enforcement subpoenas if the court has ordered the agency 
or institution not to disclose the existence or contents of the 
subpoena or information disclosed. An ex parte order is by definition 
an order issued without notice to or argument from the other party, 
including the party whose education records are sought, and the USA 
Patriot Act amendments provide that the Attorney General may collect 
and use the records without regard to any FERPA requirements, including 
the recordation requirements. Under this statutory authority, the 
regulations properly provide that the agency or institution is not 
required to notify the parent or eligible student before complying with 
the order or to record the disclosure.
    We do not agree with the commenter's request that we amend the 
regulations to allow agencies and institutions to notify parents and 
students and record these disclosures. We note that FERPA does not 
prohibit an educational agency or institution from notifying a parent 
or student or recording a disclosure made in compliance with an ex 
parte court order under the USA Patriot Act. However, an agency or 
institution that does so may violate the terms of the court order 
itself and may also fail to meet the good faith requirements in the USA 
Patriot Act for avoiding liability for the disclosure. We would also 
recommend that agencies and institutions consult with legal counsel 
before notifying a parent or student or recording a disclosure of 
education records made in compliance with an ex parte court order under 
the USA Patriot Act.
    Changes: None.

Registered Sex Offenders (Sec.  99.31(a)(16))

    Comment: One commenter asked for clarification whether the proposed 
regulations authorizing the disclosure of personally identifiable 
information from education records concerning registered sex offenders 
authorize only the disclosure of information that is received from 
local law enforcement officials, or whether disclosure could

[[Page 74820]]

also include other information from a student's education records, such 
as campus of attendance. A second commenter expressed appreciation that 
the regulations clarify that school districts are not required or 
encouraged to collect or maintain information on registered sex 
offenders and that these disclosures are permissible but not required.
    Discussion: The Campus Sex Crimes Prevention Act (CSCPA) amendments 
to FERPA allow educational agencies and institutions to disclose any 
information concerning registered sex offenders provided to the agency 
or institution under section 170101 of the Violent Crime Control and 
Law Enforcement Act of 1994, 42 U.S.C. 14071, commonly known as the 
Wetterling Act. Since publication of the NPRM, we have determined that 
the proposed regulations were confusing, because they limited these 
disclosures to information that was obtained and disclosed by an agency 
or institution in compliance with a State community notification 
program. In fact, the CSCPA amendments to FERPA cover any information 
provided to an educational agency or institution under the Wetterling 
Act, including not only information provided under general State 
community notification programs, which are required under subsection 
(e) of the Wetterling Act, 42 U.S.C. 14071(e), but also information 
provided under the more specific campus community notification programs 
for institutions of higher education, which are required under 
subsection (j), 42 U.S.C. 14071(j).
    The Wetterling Act requires States to release relevant information 
about persons required to register as sex offenders that is necessary 
to protect the public, including specific State reporting requirements 
for law enforcement agencies having jurisdiction over institutions of 
higher education. The exception to the consent requirement in FERPA 
allows educational agencies and institutions to make available to the 
school community any information provided to it under the Wetterling 
Act. We interpret this to also include any additional information about 
the student that is relevant to the purpose for which the information 
was provided to the educational agency or institution--protecting the 
public. This could include, for example, the school or campus at which 
the student is enrolled.
    The proposed regulations included a sentence stating that FERPA 
does not require or encourage agencies or institutions to collect or 
maintain information about registered sex offenders. We have determined 
through further review, however, that this sentence could be confusing 
and should be removed. Participating institutions are required under 
section 485(f)(1) of the Higher Education Act of 1965, as amended, 20 
U.S.C. 1092(f)(1), to advise the campus community where it may obtain 
law enforcement agency information provided by the State under 42 
U.S.C. 14071(j) concerning registered sex offenders. Further, the 
Department does not wish to discourage educational agencies and 
institutions from disclosing relevant information about a registered 
sex offender in appropriate circumstances.
    Changes: We have revised the regulations to remove the reference to 
the disclosure of information obtained by the educational agency or 
institution in compliance with a State community notification program. 
The regulations now simply allow disclosure without consent of any 
information concerning registered offenders provided to an educational 
agency or institution under 42 U.S.C. 14071 and applicable Federal 
guidelines. We also have removed the sentence stating that neither 
FERPA nor the regulations requires or encourages agencies or 
institutions to collect or maintain information about registered sex 
offenders.

Redisclosure of Education Records and Recordkeeping by State and Local 
Educational Authorities and Federal Officials and Agencies (Sec. Sec.  
99.31(a)(3); 99.32(b); 99.33(b); 99.35(a)(2); 99.35(b))

(a) Redisclosure

    Comment: We received a number of comments on the proposed changes 
in Sec.  99.35(b) that would permit State and local educational 
authorities and Federal officials and agencies listed in Sec.  
99.31(a)(3) to redisclose personally identifiable information from 
education records on behalf of educational agencies and institutions 
without parental consent under the existing redisclosure authority in 
Sec.  99.33(b). (Section 99.33(b) allows an educational agency or 
institution to disclose personally identifiable information from 
education records with the understanding that the recipient may make 
further disclosures of the information on behalf of the agency or 
institution if the disclosure falls under one of the exceptions in 
Sec.  99.31(a) and the agency or institution has complied with the 
recordation requirements in Sec.  99.32(b).) Many commenters said that 
the proposed change would ease administrative burdens on State and 
local educational authorities, agencies, and institutions. For example, 
under the proposed regulations, a student's new school district or 
institution would be able to obtain the student's prior education 
records from a single State agency instead of contacting and waiting 
for records from separate districts or institutions. Commenters noted, 
however, that certain issues had not been addressed in the proposed 
regulations and that further clarification was required. Commenters 
also supported the new redisclosure authority to the extent that it 
facilitates the exchange of education records among State educational 
authorities, educational agencies and institutions, and educational 
researchers through consolidated, statewide systems or separate data 
sharing arrangements.
    Two commenters expressed substantial concerns that the regulations 
inappropriately expanded the situations in which personally 
identifiable information could be redisclosed without parental or 
student consent. One commenter noted that the theoretical benefits of 
maintaining large, consolidated data systems, which allow users to 
track individual students over time, do not outweigh the need to 
protect individual privacy. Another commenter stated that the 
regulations should not allow State and local educational authorities 
and the Federal officials and agencies listed in Sec.  99.31(a)(3) to 
set up and operate record systems containing personally identifiable 
information that parents and students have no right to review or amend, 
and may not even know about. Barring the withdrawal of these 
regulations, these commenters urged the Department to strengthen or at 
least preserve the safeguards and protections that accompany this new 
data sharing authority. One commenter asked us to require any State or 
Federal entity that maintains education records to provide parents and 
students with annual notification and the right to review and amend the 
students' records.
    Many commenters indicated their strong support for allowing State 
educational authorities to respond to requests for information from 
education records and redisclose personally identifiable information, 
whether for data sharing systems, transferring records to a student's 
new school, or other purposes authorized under Sec.  99.31(a), without 
involving school districts and postsecondary institutions. These 
commenters generally thought that State educational authorities and 
Federal officials listed in Sec.  99.31(a)(3) should not be required to 
consult with educational agencies and institutions when redisclosing 
information from education records. One commenter

[[Page 74821]]

asked us to clarify the role of the SEA or other State educational 
authority as the custodian of education records and its authority to 
act for educational agencies and institutions. Several commenters urged 
us to revise the regulations to make clear that the redisclosing 
official is authorized to make further disclosures under Sec.  99.31(a) 
without approval from, or further consultation with, the original 
source of the records and maintain the appropriate record related to 
the redisclosure.
    One commenter said that the regulations must allow State 
educational authorities to transfer records on behalf of LEAs and 
postsecondary institutions. One commenter strongly supported the 
changes in Sec.  99.35(b) because they would allow the State McKinney-
Vento coordinator to control transfer of education records of abused 
and homeless students to their new schools and prevent potential 
abusers from locating the student.
    Some commenters believed that current regulations impede the 
ability of States to establish and operate data sharing systems and 
that regulatory changes must allow all educational agencies, 
institutions, SEAs, and other State educational authorities to exchange 
data among themselves and work with researchers. One commenter 
recommended that we create a specific exception in Sec.  99.31(a) that 
would allow data sharing across State educational authorities in order 
to establish and operate consolidated, longitudinal data systems.
    Several commenters asked for clarification of the requirement in 
Sec.  99.35(a)(2) that authority for an agency or official listed in 
Sec.  99.31(a)(3) to conduct an audit, evaluation, or compliance or 
enforcement activity is not conferred by FERPA or the regulations and 
must be established under other Federal, State, or local law, including 
valid administrative regulations. One commenter supported data sharing 
among pre-school, K-12, and postsecondary institutions, provided that 
appropriate legal authority for the underlying audit, evaluation, or 
compliance and enforcement activity is established as required under 
Sec.  99.35(a)(2). One commenter asked whether citation to a specific 
law or regulations will be required, or whether general State laws that 
provide joint authority to evaluate programs at all levels are 
sufficient for parties to enter into data sharing agreements under the 
regulations.
    One commenter indicated that its State has no laws or regulations 
that specifically allow the State-level advisory council to audit or 
evaluate education programs, or that allow a K-12 school district to 
audit or evaluate the programs offered by postsecondary institutions, 
and vice versa, and the commenter asked whether general authority for 
these entities to act under State law would be sufficient. Two 
commenters whose States do not house their K-12 and postsecondary 
systems within the same agency expressed concern whether they will be 
able to develop consolidated databases under the regulations if their 
K-12 and postsecondary agencies do not have appropriate authority to 
audit or evaluate each other's programs.
    Discussion: We continue to believe that State and local educational 
authorities and Federal officials that receive education records under 
Sec. Sec.  99.31(a)(3) and 99.35 should be permitted to redisclose 
education records on behalf of educational agencies and institutions in 
accordance with the existing regulations governing the redisclosure of 
information in Sec.  99.33(b). We agree with the commenters that this 
change will ease administrative burdens at all levels and facilitate 
the creation and operation of statewide data sharing systems that 
support the student achievement, program accountability, transfer of 
records, and other objectives of Federal and State education programs 
while protecting the privacy rights of parents and students in 
students' education records.
    We respond first to commenters' concerns about the requirement in 
Sec.  99.33(b) that any redisclosure of personally identifiable 
information from education records must be made on behalf of the 
educational agency or institution that disclosed the information to the 
receiving party, including any requirement for consulting with or 
obtaining approval from the educational agency or institution that 
disclosed the information. The statutory prohibitions on the 
redisclosure of education records apply to education records that SEAs, 
State higher educational authorities, the Department, and other Federal 
officials receive under an exception to the written consent requirement 
in FERPA, such as Sec. Sec.  99.31(a)(3) and 99.35 (for audit, 
evaluation, compliance and enforcement purposes) and Sec.  99.31(a)(4) 
(for financial aid purposes). As explained in the preamble to the NPRM, 
Sec.  99.33(b) allows an educational agency or institution to disclose 
education records with the understanding that the recipient may make 
further disclosures on its behalf under one of the exceptions in Sec.  
99.31 (73 FR 15586-15587). In that case, the disclosing agency or 
institution must record the names of the additional parties to which 
the receiving party may redisclose the information on behalf of the 
educational agency or institution and their legitimate interests under 
Sec.  99.31.
    Under the regulatory framework for redisclosing education records 
in Sec.  99.33(b), educational agencies and institutions retain primary 
responsibility for disclosing and authorizing redisclosure of their 
education records without consent. (We note again that the only 
disclosures of education records that are mandatory under FERPA are 
those made to parents and eligible students.) The purpose of Sec.  
99.33(b), which allows redisclosure of education records 
notwithstanding the general statutory restrictions, has always been to 
ease administrative burdens on educational agencies and institutions 
that disclose education records. The legal basis for this accommodation 
is that the recipient is acting ``on behalf of'' the agency or 
institution from which it received information from education records 
and making a further disclosure that the agency or institution would 
otherwise make itself under Sec.  99.31(a). Section 99.33(b) does not 
confer on any recipient of education records independent authority to 
redisclose those records apart from acting ``on behalf of'' the 
disclosing educational agency or institution.
    The Department recognizes that the State and local educational 
authorities and Federal officials that receive education records 
without consent under Sec.  99.31(a)(3) are responsible for supervising 
and monitoring educational agencies and institutions and that many of 
them also maintain centralized data systems that constitute a valuable 
resource of information from education records. The proposed changes to 
Sec.  99.35(b) would allow these State and Federal authorities and 
officials to redisclose information received under Sec.  99.31(a)(3) 
under any of the exceptions in Sec.  99.31(a), including transferring 
education records to a student's new school under Sec.  99.31(a)(2), 
sharing information among other State and local educational authorities 
and Federal officials for audit or evaluation purposes under Sec.  
99.31(a)(3), and using researchers to conduct evaluations and studies 
under Sec.  99.31(a)(3) or Sec.  99.31(a)(6), without violating the 
statutory prohibitions on redisclosing education records provided 
certain conditions have been met. In the event that an educational 
agency or institution objects to the redisclosure of information it has 
provided, the State or

[[Page 74822]]

local educational authority or Federal official or agency may rely 
instead on any independent legal authority it has to further disclose 
the information.
    We agree that current regulations were unclear about the ability of 
States to establish and operate data sharing systems with educational 
agencies and institutions, which is why we amended Sec.  99.35(b). As 
explained in the NPRM (73 FR 15587), Sec. Sec.  99.35(a)(2) and 
99.35(b) allow SEAs, higher education authorities, and educational 
agencies and institutions, including local school districts and 
postsecondary institutions, to share education records in personally 
identifiable form with one another, provided that Federal, State, or 
local law authorizes the recipient to conduct the audit, evaluation, or 
compliance or enforcement activity in question. Accordingly, data 
sharing arrangements among State and local educational authorities and 
educational agencies and institutions generally must meet these 
requirements to be permissible under FERPA. (Data sharing with 
educational researchers is discussed below under Educational research.)
    With respect to the comments recommending that we create a specific 
exception in Sec.  99.31(a) to allow data sharing across State 
educational authorities in order to establish and operate consolidated, 
longitudinal data systems and other data sharing arrangements, there is 
no provision in FERPA that allows disclosure or redisclosure of 
education records, without consent, for the specific purpose of 
establishing and operating consolidated databases and data sharing 
systems, and, therefore, we are without authority to establish one in 
these regulations.
    In response to the questions concerning the need for Federal, 
state, or local legal authority to disclose education records for audit 
or evaluation purposes, we note that, in general, FERPA allows 
educational agencies and institutions to disclose (and authorized 
recipients to redisclose) education records without consent in 
accordance with the exceptions listed in Sec.  99.31(a), including for 
audit or evaluation purposes under Sec. Sec.  99.31(a)(3) and 99.35. It 
does not, however, provide the underlying authority for individuals and 
organizations to conduct the various activities that may allow them to 
receive education records without consent under these exceptions. For 
example, Sec.  99.31(a)(7) does not authorize an organization to 
accredit educational institutions; it allows educational institutions 
to disclose personally identifiable information from education records, 
without consent, to an organization to carry out its accrediting 
functions. If that organization is not, in fact, an accreditation 
authority for that particular institution, then disclosure under Sec.  
99.31(a)(7) is invalid and violates FERPA. Likewise, Sec.  99.31(a)(9) 
does not authorize a court or Federal grand jury to issue an order or 
subpoena; it allows an educational agency or institution to comply with 
a facially valid order or subpoena, without consent.
    We added the requirement in Sec.  99.35(a)(2) that the recipient 
have authority under Federal, State, or local law to conduct the 
activity for which the disclosure was made because there was 
significant confusion in the educational community about who may 
receive education records without consent for audit and evaluation 
purposes under Sec.  99.35. For example, in 2005 the Pennsylvania 
Department of Education (PDOE) asked the Department whether, in the 
absence of parental consent, a charter school LEA responsible under 
State law for providing a free appropriate public education to students 
with disabilities enrolled in the charter school could send the local 
school district of residence the IEP of each student with a disability. 
The school districts of residence claimed that they needed this 
information to substantiate the charter school's invoices for higher 
payments based on the student's special education status under the 
IDEA.
    Our January 2006 response to PDOE explained that in order to meet 
the requirements for disclosure of education records under Sec. Sec.  
99.31(a)(3) and 99.35, Federal, State, or local law (including valid 
administrative regulations) must authorize the relevant State or local 
educational authority to conduct the audit, evaluation, or compliance 
or enforcement activity in question. In particular, we noted that 
charter schools in Pennsylvania could disclose the IEP cover sheet 
under Sec. Sec.  99.31(a)(3) and 99.35 of the regulations if the State 
law in question authorized a local school district to ``audit or 
evaluate'' a charter school's request for payment of State funds at the 
special education rate and the school district needed personally 
identifiable information for that purpose, and that we would defer to 
the State Attorney General's interpretation of State law on the matter. 
We also explained that there appeared to be no legal authority that 
would allow charter schools in the State to disclose a student's entire 
IEP to the resident school district, as requested by the resident 
school districts.
    The Department has always interpreted Sec. Sec.  99.31(a)(3) and 
99.35 to allow educational agencies and institutions to disclose 
personally identifiable information from education records to the SEA 
or State higher education board or commission responsible for their 
supervision based on the understanding that those entities are 
authorized to audit or evaluate (or enforce Federal legal requirements 
related to) the education programs provided by the agencies and 
institutions whose records are disclosed. Under this reasoning, a K-12 
school district (LEA) may disclose personally identifiable information 
from education records to another LEA, or to a State higher education 
board or commission, without consent, if that LEA, board, or commission 
has legal authority to conduct the audit, evaluation, or compliance or 
enforcement activity with regard to the disclosing district's programs. 
States do not have to house their K-12 or P-12 and postsecondary 
systems within the same agency in order to take advantage of this 
provision. However, they may need to review and modify the supervisory 
and oversight responsibilities of various State and local educational 
authorities to ensure that there is valid legal authority for LEAs, 
postsecondary institutions, SEAs, and higher education authorities to 
disclose or redisclose personally identifiable information from 
education records to one another under Sec.  99.35(a) before 
information is released.
    It is not our intention in Sec.  99.35(a)(2) to require educational 
agencies and institutions and other parties to identify specific 
statutory authority before they disclose or redisclose education 
records for audit or evaluation purposes but to ensure that some local, 
State, or Federal legal authority exists for the audit or evaluation, 
including for example an Executive Order or administrative regulation. 
The Department encourages State and local educational authorities and 
educational agencies and institutions to seek guidance from their State 
attorney general on their legal authority to conduct a particular audit 
or evaluation. The Department may also provide additional guidance, as 
appropriate.
    Changes: None.

(b) Recordation Requirements

    Comment: In the NPRM, 73 FR 15587, we invited public comment on 
whether an SEA, the Department, or other official or agency listed in 
Sec.  99.31(a)(3) should be allowed to maintain the record of the 
redisclosures it makes on behalf of an educational agency or

[[Page 74823]]

institution as a means of relieving any administrative burdens 
associated with recording disclosures of education records. One 
commenter urged the Department not to delegate responsibility for 
recordkeeping to State and local educational authorities and Federal 
agencies and officials that redisclose education records under Sec.  
99.33(b). Another said that if a State or local educational authority 
or Federal agency or official rediscloses information ``on behalf of'' 
an educational agency or institution under Sec.  99.35(b), these 
further disclosures should be included in the student's record at the 
educational agency or institution. All other comments on this issue 
supported revising the regulations to allow State and local educational 
authorities and Federal officials and agencies listed in Sec.  
99.31(a)(3) to record any redisclosures they make under Sec.  99.33(b).
    Several commenters suggested that the recordation requirements in 
Sec.  99.32(b) would place an undue burden on State and local officials 
when State educational authorities redisclose education records because 
the State authority would need to return to each original source of the 
records to record the redisclosure. Some commenters noted that 
compliance with Sec.  99.32(b) is practically impossible if an LEA or 
postsecondary institution is required to record all authorized 
redisclosures at the time of the initial disclosure of information to 
the State or Federal authority. Two commenters suggested that we 
eliminate the recordation problem by redefining the term disclosure so 
that it does not include disclosing information under Sec.  99.31(a)(3) 
for audit, evaluation, or compliance and enforcement purposes. Another 
commenter suggested that we define ``educational agency or 
institution'' to include State educational authorities so that 
disclosures to State educational authorities would not be considered a 
disclosure under FERPA.
    One commenter said that the regulations should permit State 
educational authorities to record redisclosures as they are made and 
without having to identify each student by name. Another commenter 
asked for clarification whether the recordation requirements apply to 
redisclosures that SEAs make to education researchers and other parties 
that are not authorized to make any further disclosures, and what level 
of detail is required in the record regarding who accessed the data and 
what specific information was viewed.
    One commenter stated that if State educational authorities and 
Federal officials are authorized to record their own redisclosures of 
information, then the educational agency or institution should be 
required to retrieve these records in response to a request to review 
education records by parents and eligible students who would otherwise 
not know about the redisclosures. Other commenters suggested that the 
State educational authority or Federal official could either make the 
redisclosure record available directly to parents and students or send 
it to the LEA or postsecondary institution for this purpose.
    Discussion: We agree with commenters that in order to facilitate 
the operation of State data systems and ease administrative burdens on 
all parties, the regulations should allow State educational authorities 
and Federal officials and agencies to record further disclosures they 
make on behalf of educational agencies and institutions under Sec.  
99.33(b). We are revising the provisions of Sec.  99.32 to address 
commenters' concerns and ensure that these changes will not expand the 
redisclosure authority of a State or local educational authority or 
Federal official or agency under Sec.  99.35(b) and that parents and 
students will have notice of and access to any State or Federal record 
of further disclosures that is created.
    In response to the commenter's suggestion that we define 
``educational agency or institution'' and the term disclosure to 
address recordation issues associated with the new redisclosure 
authority in Sec.  99.35(b), we note that an educational agency or 
institution is required by statute to maintain with each student's 
education records a record of each request for access to and each 
disclosure of personally identifiable information from the education 
records of the student, including the parties who have requested or 
received information and their legitimate interests in the information. 
20 U.S.C. 1232g(b)(4)(A); 34 CFR 99.32(a). This includes each 
disclosure of personally identifiable information from education 
records that an educational agency or institution makes to an SEA or 
other State educational authority and to Federal officials and 
agencies, including the Department, for audit, evaluation, or 
compliance and enforcement purposes under Sec. Sec.  99.31(a)(3) and 
99.35, and under most other FERPA exceptions, such as the financial aid 
exception in Sec.  99.31(a)(4). (Regulatory exceptions to the statutory 
recordation requirements, which are set forth in Sec.  99.32(d), cover 
disclosures that a parent or eligible student would generally know 
about without the recordation or for which notice is prohibited under 
court order; the exceptions do not include disclosures made to parties 
outside the agency or institution for audit, evaluation, or compliance 
and enforcement purposes.)
    An educational agency or institution is required under FERPA to 
record its disclosures of personally identifiable information from 
education records even when it discloses information to another 
educational agency or institution, such as occurs under Sec.  
99.31(a)(2) when a school district transfers education records to a 
student's new school. See 20 U.S.C. 1232g(b)(4)(A); 34 CFR 99.32(a). 
Therefore, even if a State educational authority were considered an 
``educational agency or institution'' under Sec.  99.1, a school 
district or postsecondary institution would still be required to record 
its own disclosures to that State educational authority; defining a 
State educational authority as an educational agency or institution 
would not eliminate this requirement. Therefore, a school district or 
postsecondary institution is required to record its disclosures to any 
State educational authority.
    The term disclosure is defined in Sec.  99.3 to mean to permit 
access to or the release, transfer, or other communication of 
personally identifiable information contained in education records to 
any party, by any means, including oral, written, or electronic means. 
This includes releasing or making a student's education records 
available to school officials within the agency or institution, for 
which an exception to the consent requirement exists under Sec.  
99.31(a)(1). We see no legal basis for redefining the term disclosure 
to exclude the release of personally identifiable information to third 
parties outside the educational agency or institution under the audit, 
evaluation, or compliance and enforcement exception to the consent 
requirement in Sec. Sec.  99.31(a)(3) and 99.35.
    With regard to the level of detail required in the record of 
redisclosures, current Sec.  99.32(b) requires an educational agency or 
institution to record the ``names of the additional parties to which 
the receiving party may disclose the information'' on its behalf and 
their legitimate interests under Sec.  99.31. This means the name of 
the individual (if an organization is not involved) or the organization 
and the exception under Sec.  99.31(a) that would allow the 
redisclosure to be made without consent. Under current Sec.  
99.33(a)(2), the officers, employees, and agents of a party that 
receives

[[Page 74824]]

information from education records may use the information for the 
purposes for which the disclosure was made without violating the 
limitations on redisclosure in Sec.  99.33(a)(1). Therefore, we 
interpret the recordation requirement in Sec.  99.32(b) to mean that an 
educational agency or institution may record the name of an 
organization, including a research organization, to which a recipient 
may make further disclosures under Sec.  99.33(b) and is not required 
to record the name of each individual within the organization who is 
authorized to use that information in accordance with Sec.  
99.33(a)(2).
    We also recognize that sometimes an educational agency or 
institution does not know at the time of its disclosure of education 
records that the receiving party may wish to make further disclosures 
on its behalf. Therefore, we interpret Sec.  99.32(b) to allow a 
receiving party to ask an educational agency or institution to record 
further disclosures made on its behalf after the initial receipt of the 
records or information.
    These same policies apply to further disclosures made by State and 
local educational authorities and Federal officials listed in Sec.  
99.31(a)(3) that redisclose information on behalf of educational 
agencies and institutions under the new authority in Sec.  99.35(b). 
Educational agencies and institutions that disclose education records 
under Sec.  99.31(a)(3) with the understanding that the State or 
Federal authority or official may make further disclosures may continue 
to record those further disclosures as provided in Sec.  99.32(b)(1). 
Like any other recipient of education records, a State or Federal 
authority or official may also ask an educational agency or institution 
to record further disclosures made on its behalf after the initial 
receipt of the records or information. It is incumbent upon a State or 
Federal authority or official that makes further disclosures on behalf 
of an educational agency or institution under Sec.  99.33(b) to 
determine whether the educational agency or institution has recorded 
those further disclosures. If the educational agency or institution 
does not do so, then under the revisions to Sec.  99.32(b)(2)(i) in the 
final regulations, the State and local educational authority or Federal 
official or agency that makes further disclosures must maintain the 
record of those disclosures.
    We have also revised Sec.  99.32(a) to ensure that educational 
agencies and institutions maintain a listing in each student's record 
of the State and local educational authorities and Federal officials 
and agencies that may make further disclosures of the student's 
education records without consent under Sec.  99.33(b). This will help 
ensure that parents and students know that the record of disclosures 
maintained by an educational agency or institution as required under 
Sec.  99.32(a) may not contain all further disclosures made on behalf 
of the agency or institution by a State or Federal authority or 
official and alert parents and students to the need to ask for access 
to this additional information. We have also revised Sec.  99.32(a) to 
require an educational agency or institution to obtain a copy of the 
record of further disclosures maintained at the State or Federal level 
and make it available for parents and students to inspect and review 
upon request.
    In response to commenters' suggestions, the regulations in new 
Sec.  99.32(b)(2)(ii) allow a State or local educational authority or 
Federal official or agency to identify the redisclosure by the 
student's class, school, district, or other appropriate grouping rather 
than by the name of each student whose record was redisclosed. For 
example, an SEA may record that it disclosed to the State higher 
education authority the scores of each student in grades nine through 
12 on the State mathematics assessment for a particular year. We 
believe that this procedure eases administrative burdens while ensuring 
that a parent or student may access information about the redisclosure.
    We note that the recordation requirements under Sec.  
6401(c)(i)(IV) of the America COMPETES Act, Public Law 110-69, 20 
U.S.C. 9871(c)(i)(IV), are more detailed and stringent than those 
required under FERPA. In particular, a State that receives a grant to 
establish a statewide P-16 education data system under Sec.  
6401(c)(2), 20 U.S.C. 9871(c)(2), is required to keep an accurate 
accounting of the date, nature, and purpose of each disclosure of 
personally identifiable information in the statewide P-16 education 
data system; a description of the information disclosed; and the name 
and address of the person, agency, institution, or entity to whom the 
disclosure is made. The State must also make this accounting available 
on request to parents of any student whose information has been 
disclosed. The Department will issue further guidance on these 
requirements if the program is funded and implemented.
    Changes: We have made several changes to Sec.  99.32, as follows:
     New Sec.  99.32(b)(2)(i) provides that a State or local 
educational authority or Federal official or agency listed in Sec.  
99.31(a)(3) that makes further disclosures of information from 
education records must record the names of the additional parties to 
which it discloses information on behalf of an educational agency or 
institution and their legitimate interests under Sec.  99.31 in the 
information if the information was received from an educational agency 
or institution that has not recorded the further disclosures itself or 
from another State or local official or Federal official or agency 
listed in Sec.  99.31(a)(3).
     New Sec.  99.32(b)(2)(ii) provides that a State or local 
educational authority or Federal official or agency that records 
further disclosures of information may maintain the record by the 
student's class, school, district or other appropriate grouping rather 
than by the name of the student.
     New Sec.  99.32(b)(2)(iii) provides that upon request of 
an educational agency or institution, a State or local educational 
authority or Federal official or agency that maintains a record of 
further disclosures must provide a copy of the record of further 
disclosures to the educational agency or institution within a 
reasonable period of time not to exceed 30 days.
     Revised Sec.  99.32(a)(1) requires educational agencies 
and institutions to list in each student's record of disclosures the 
names of the State and local educational authorities and Federal 
officials or agencies that may make further disclosures of the 
information on behalf of the educational agency or institution under 
Sec.  99.33(b).
     New Sec.  99.32(a)(4) requires an educational agency or 
institution to obtain a copy of the record of further disclosures 
maintained by a State or local educational authority or Federal 
official or agency and make it available in response to a parent's or 
student's request to review the student's record of disclosures.

Educational Research (Sec. Sec.  99.31(a)(6) and 99.31(a)(3))

    Comment: We received a number of comments on proposed Sec.  
99.31(a)(6)(ii). In this section, we proposed that an educational 
agency or institution that discloses personally identifiable 
information without consent to an organization conducting studies for, 
or on behalf of, the educational agency or institution must enter into 
a written agreement with the organization specifying the purposes of 
the study and containing certain other elements. This exception to the 
consent requirement is often referred to as the ``studies exception.'' 
While all of the comments on this provision generally supported the 
changes, many of the commenters raised concerns about the scope and

[[Page 74825]]

applicability of the studies exception and requested clarification on 
some of the proposed changes, particularly with regard to the 
provisions relating to written agreements.
    Discussion: We address commenters' specific concerns about the key 
portions of these regulations in the following sections.
    Changes: None.

(a) Scope and Applicability of Sec.  99.31(a)(6)

    Comment: Several commenters stated that the proposed regulations 
did not clearly indicate that the studies exception applies to State 
educational authorities. Some commenters, assuming that Sec.  
99.31(a)(6) applied to State educational authorities, noted that the 
proposed regulations did not provide clear authority for State 
educational authorities such as an SEA, or a State longitudinal data 
system using State generated data (such as State assessment results), 
to enter into research agreements on behalf of educational agencies and 
institutions. One commenter stated that Sec.  99.31(a)(6) should not be 
interpreted to require that research agreements be entered into by 
individual schools or that any resulting redisclosures be recorded by 
the individual schools.
    One commenter asked for clarification regarding whether Sec.  
99.31(a)(6) permitted a school to disclose a student's education 
records to his or her previous school for the purpose of evaluating 
Federal or State-supported education programs or for improving 
instruction.
    Another commenter stated that the Department should further revise 
the regulations to provide that only individuals in the organization 
conducting the study who have a legitimate interest in the information 
disclosed be given access to the information. The commenter also stated 
that the Department should specifically limit Sec.  99.31(a)(6) to bona 
fide research projects by prohibiting organizations conducting studies 
under this exception from using record-level data for other operational 
or commercial purposes. The commenter also expressed concern about the 
duration of research projects, noting that significantly more 
restrictive access should be required for studies that track personally 
identifiable information for long periods of time. The commenter stated 
further that the Department should consider imposing a time limit on 
how long information obtained through longitudinal studies can be 
retained.
    Discussion: FERPA permits an educational agency or institution to 
disclose personally identifiable information from an education record 
of a student without consent if the disclosure is to an organization 
conducting studies for, or on behalf of, the educational agency or 
institution to (a) develop, validate, or administer predictive tests; 
(b) administer student aid programs; or (c) improve instruction. 20 
U.S.C. 1232g(b)(1)(F); 34 CFR 99.31(a)(6). Disclosures made under the 
studies exception may only be used by the receiving party for the 
purposes for which the disclosure was made and for no other purpose or 
study. As such, Sec.  99.31(a)(6) is not a general research exception 
to the consent requirement in FERPA but an exception for studies 
limited to the purposes specified in the statute and regulations.
    We first note that it may not be necessary or even advantageous for 
State educational authorities to use the studies exception in order to 
conduct or authorize educational research because of the limitations in 
Sec.  99.31(a)(6). In contrast, Sec.  99.31(a)(3)(iv), under the 
conditions set forth in Sec.  99.35, allows educational agencies and 
institutions, such as LEAs and postsecondary institutions, to disclose 
education records without consent to State educational authorities for 
audit and evaluation purposes, which can include a general range of 
research studies beyond the more limited group of studies specified 
under Sec.  99.31(a)(6). Also, as explained more fully elsewhere in 
this preamble, while a State educational authority must have the 
underlying legal authority to audit or evaluate the records it receives 
from LEAs or postsecondary institutions under Sec.  99.35, the LEA or 
postsecondary institution is not required to enter into a written 
agreement for the audit or evaluation as it is required to do under 
Sec.  99.31(a)(6). (See Redisclosure of Education Records and 
Recordkeeping by State and Local Educational Authorities and Federal 
Officials and Agencies.) The absence of an explanation of the 
authorized representatives exception (Sec.  99.31(a)(3)) in the NPRM 
created confusion, especially with regard to how State departments of 
education may utilize education records for evaluation purposes. 
Therefore, we have included that explanation here.
    The conditions for disclosing education records without consent 
under Sec. Sec.  99.31(a)(3)(iv) and 99.35 are discussed in the 
Department's Memorandum from the Deputy Secretary of Education (January 
30, 2003) available at http://www.ed.gov/policy/gen/guid/secletter/030130.html. The Deputy Secretary's memorandum explains that under this 
exception an ``authorized representative'' of a State educational 
authority is a party under the direct control of that authority, e.g., 
an employee or a contractor.
    In general, the Department has interpreted FERPA and implementing 
regulations to permit the disclosure of personally identifiable 
information from education records, without consent, in connection with 
the outsourcing of institutional services and functions. Accordingly, 
the term ``authorized representative'' in Sec.  99.31(a)(3) includes 
contractors, consultants, volunteers, and other outside parties (i.e., 
non-employees) used to conduct an audit, evaluation, or compliance or 
enforcement activities specified in Sec.  99.35, or other institutional 
services or functions for which the official or agency would otherwise 
use its own employees. For example, a State educational authority may 
disclose personally identifiable information from education records, 
without consent, to an outside attorney retained to provide legal 
services or an outside computer consultant hired to develop and manage 
a data system for education records.
    The term ``authorized representative'' also includes an outside 
researcher working as a contractor of a State educational authority or 
other official listed in Sec.  99.31(a)(3) that has outsourced the 
evaluation of Federal or State supported education programs. An outside 
researcher may conduct independent research under this provision in the 
sense that the researcher may propose or initiate research projects for 
consideration and approval by the State educational authority or other 
official listed in Sec.  99.31(a)(3) either before or after the parties 
have negotiated a research agreement. Likewise, the State educational 
authority or official does not have to agree with or endorse the 
researcher's results or conclusions. In so doing, an outside researcher 
retained to evaluate education programs by a State educational 
authority or other official listed in Sec.  99.31(a)(3) as an 
``authorized representative'' may be given access to personally 
identifiable information from education records, including statistical 
information with unmodified small data cells. However, the term 
``authorized representative'' does not include independent researchers 
that are not contractors or other parties under the direct control of 
an official or agency listed in Sec.  99.31(a)(3).
    While an educational agency or institution may not disclose 
personally identifiable information from students' education records to 
independent researchers, nothing in FERPA prohibits

[[Page 74826]]

them from disclosing information that has been properly de-identified. 
Further discussion of this issue is provided in the following 
paragraphs and under the section entitled Personally Identifiable 
Information and De-Identified Records and Information.
    An SEA or other State educational authority that has legal 
authority to enter into agreements for LEAs or postsecondary 
institutions under its jurisdiction may enter into an agreement with an 
organization conducting a study for the LEA or institution under the 
studies exception. If the SEA or other State educational authority does 
not have the legal authority to act for or on behalf of an LEA or 
institution, then it would not be permitted to enter into an agreement 
with the organization conducting the study under this exception. As 
previously mentioned, FERPA authorizes certain disclosures without 
consent; it does not provide an SEA or other State educational 
authority with the legal authority to act for or on behalf of an LEA or 
postsecondary institution.
    With regard to the request for clarification whether Sec.  
99.31(a)(6) permits a school to disclose a student's education records 
to his or her previous school for evaluation purposes, the studies 
exception only allows disclosures to organizations conducting studies 
for, or on behalf of, the educational agency or institution that 
discloses its records. The ``for, or on behalf of'' language from the 
statute does not permit disclosures under this exception so that the 
receiving organization can conduct a study for itself or some other 
party. This issue is discussed in more detail under the section of this 
preamble entitled Disclosure of Education Records to Student's Former 
Schools.
    We agree with the comment that the regulations should be revised to 
provide that only those individuals in the organization conducting the 
study that have a legitimate interest in the personally identifiable 
information from education records can have access to the records. The 
Secretary also shares the commenter's concerns about limiting Sec.  
99.31(a)(6) to bona fide research projects, prohibiting commercial 
utilization of education records, and limiting the duration of research 
projects. We address these issues in greater detail in the following 
section concerning written agreements.
    Changes: None.

(b) Written Agreements for Studies

    Comment: Several commenters expressed concern that Sec.  
99.31(a)(6) not be read so broadly as to erode parents' and students' 
privacy rights, and, therefore, supported the restrictions that the 
Secretary included in this provision. Specifically, they supported the 
new requirement that educational agencies and institutions must enter 
into a written agreement with the organization conducting the study 
that specifies: the purpose of the study, that the information from the 
education records disclosed be used only for the stated purpose, that 
individuals outside the organization may not have access to personally 
identifiable information about the students being studied, and that the 
information be destroyed or returned when it is no longer needed for 
the purpose of the study.
    Several commenters said that the Department should clarify that the 
existence of a written agreement is not a rationale in and of itself 
for the disclosure of education records. They stated that the 
regulations should provide explicitly that a written agreement does not 
modify the protections under FERPA or justify the use of the records 
transferred other than as permitted by the statute and the regulations. 
Some of these commenters stated that the written agreement should 
include a description of the specific records to be disclosed for the 
study.
    Several commenters agreed with the provision in the proposed 
regulations that specified that an educational agency or institution 
does not need to agree with or endorse the conclusions or results of 
the study. Other commenters asked that we include in the regulations 
the explanation provided in the preamble to the NPRM that the school 
also does not need to initiate the study.
    One commenter suggested that we change the references from 
``study'' to ``studies'' so that it is clear that an agency or 
institution and a research organization could enter into one agreement 
that would cover a variety of studies that support the State's or 
school district's educational objectives. One commenter suggested that 
the Department certify agreements between educational agencies and 
research organizations as meeting the requirements of FERPA.
    There were several comments on the destruction of information 
requirements in FERPA. Some suggested that we include in the 
regulations the specific time period by which information disclosed to 
a researcher must be destroyed, while others stated that ongoing access 
to data is necessary and that researchers should be permitted to retain 
information indefinitely. Some commenters suggested that the required 
time period for the destruction or return of education records, as 
deemed necessary by the parties to support the purposes of the 
authorized study or studies, be established in the written agreement.
    One commenter approved including the requirements regarding the use 
and destruction of data in the written agreement as a way of improving 
compliance with FERPA. However, the commenter questioned our 
explanation that the language in the statute providing that the study 
must be conducted ``for, or on behalf of'' the educational agency or 
institution means that the disclosing school must retain control over 
the information once it has been given to a third party conducting a 
study. The commenter believed that school districts will not be 
involved in how a study is performed and that the written agreement 
with the organization specifying the organization's obligations with 
regard to the use and destruction of data should be sufficient.
    Discussion: The Secretary shares the concerns raised by commenters 
that Sec.  99.31(a)(6) not be read so broadly as to erode parents' and 
students' privacy rights. Accordingly, we have revised Sec.  
99.31(a)(6) to address some of these concerns and believe that these 
changes will provide adequate protection of students' education records 
that may be disclosed under the studies exception.
    In the NPRM, we proposed to remove current Sec.  99.31(a)(6)(ii)(A) 
and (B) and included these requirements under the provisions for 
written agreements. These paragraphs provide that the study must be 
conducted in a manner that does not permit personal identification of 
parents and students by individuals other than representatives of the 
organization and that the information be destroyed when no longer 
needed for the purposes for which the study was conducted. We are 
including Sec.  99.31(a)(6)(ii)(A) and (B) in the final regulations. 
After reviewing comments on the proposed changes, we concluded that, by 
moving these two provisions into the new paragraph relating to written 
agreements, we would have weakened the statutory requirements 
concerning the studies exception. We believe this correction will 
alleviate commenters' concerns about weakening parents' and students' 
privacy rights under FERPA.
    We agree with the comments that the existence of a written 
agreement is not a rationale in and of itself for the disclosure of 
education records. As a privacy statute, FERPA requires that parents 
and eligible students provide written consent before educational 
agencies and institutions disclose personally identifiable information 
from students' education records. There are

[[Page 74827]]

several statutory exceptions to FERPA's general consent rule, one of 
which is Sec.  99.31(a)(6), an exception that permits disclosure of 
records for studies limited to the purposes specified in the statute 
and regulations. However, a written agreement, a memorandum of 
understanding, or a contract is not a justification for disclosure of 
education records. Rather, a disclosure must meet the requirements in 
Sec.  99.31(a)(6) or the other permitted disclosures under Sec.  99.31. 
If a disclosure meets the conditions of Sec.  99.31(a)(6), the 
disclosure may be made, and the written agreement sets forth the 
requirements that must be followed when entering into such an 
agreement.
    As noted in our earlier discussion of the scope and applicability 
of the studies exception, the Secretary concurs that the regulations 
should be revised to require that a written agreement expressly include 
the purpose, scope, and duration of the agreed upon study, as well as 
the information to be disclosed. We also agree with commenters that the 
regulations should specifically limit any disclosures of personally 
identifiable information from students' education records to those 
individuals in the organization conducting the study that have a 
legitimate interest in the information. This requirement is consistent 
with Sec.  99.32(a)(3)(ii), which requires that an educational agency 
or institution record the ``legitimate interests'' the parties had in 
obtaining information under FERPA.
    The Secretary strongly recommends that schools carefully limit the 
disclosure of students' personally identifiable information under this 
and the other exceptions in Sec.  99.31 and reminds educational 
agencies and institutions that disclosures without consent are subject 
to Sec.  99.33(a)(2), which states: ``The officers, employees, and 
agents of a party that receives information under paragraph (a)(1) of 
this section may use the information, but only for the purposes for 
which the disclosure was made.'' The recordation requirements in Sec.  
99.32 also apply to any disclosures of personally identifiable 
information made under the studies exception. (We note that a school 
does not have to record the disclosure of information that has been 
properly de-identified.)
    Although FERPA permits schools to disclose personally identifiable 
information under Sec.  99.31(a)(6) to organizations conducting studies 
for or on its behalf, the Secretary recommends that educational 
agencies and institutions release de-identified information whenever 
possible under this exception. Even when schools opt not to release de-
identified information in these circumstances, we recommend that 
schools reduce the risk of unauthorized disclosure by removing direct 
identifiers, such as names and SSNs, from records that don't require 
them, even though these records may still contain some personally 
identifiable information. This is especially important when a school 
also discloses sensitive information about students, such as type of 
disability and special education services received by the students.
    We agree with commenters that Sec.  99.31(a)(6) should be revised 
to indicate that an educational agency or institution is not required 
to initiate a study. Additionally, we have revised Sec.  99.31(a)(6) to 
include the word ``studies'' so that an educational agency or 
institution may utilize one written agreement for more than one study, 
so long as the requirements concerning information that must be in the 
agreement are met.
    While we do not have the authority under FERPA to officially 
certify agreements between educational agencies and institutions and 
organizations conducting studies, FPCO does provide technical 
assistance to educational agencies or institutions on FERPA. As such, 
if school officials have questions about whether an agreement meets the 
requirements in Sec.  99.31(a)(6), they may contact FPCO for 
assistance.
    With regard to the comments that we include in the regulations a 
specific time period by which information provided under the studies 
exception must be destroyed, we believe that the parties entering into 
the agreement should decide when information has to be destroyed or 
returned to the educational agency or institution. As we have 
discussed, we have revised Sec.  99.31(a)(6) to require that the 
written agreement include the duration of the study and the time period 
during which the organization must either destroy or return the 
information to the educational agency or institution.
    With regard to the comment that a written agreement with the 
organization conducting the study should be sufficient for an 
educational agency or institution to retain control over information 
from education records once the information is given to an organization 
conducting a study, we agree that a written agreement required under 
the regulations will help ensure that the information is used only to 
meet the purposes of the study stated in the written agreement and that 
all applicable requirements are met. However, similar to the 
requirement that an outside service provider serving as a school 
official is subject to FERPA's restrictions on the use and redisclosure 
of personally identifiable information from education records, 
educational agencies and institutions must ensure that organizations 
with which they have entered into an agreement to conduct a study also 
comply with FERPA's restrictions on the use of personally identifiable 
information from education records. (See pages 15578-15580 of the 
NPRM.) That is, the school must retain control over the organization's 
access to and use of personally identifiable information from education 
records for purposes of the study or studies, including access by the 
organization's own employees and subcontractors, as well as any school 
officials whom the organization permits to have access to education 
records.
    An educational agency or institution may need to determine that the 
organization conducting the study has reasonable controls in place to 
ensure that personally identifiable information from education records 
is protected. We note that it is common practice for some data sharing 
agreements to have a ``controls section'' that specifies required 
controls and how they will be verified (e.g., surprise inspections). We 
recommend that the agreement required by Sec.  99.31(a)(6) include a 
section that sets forth similar requirements. If a school is unable to 
verify that these controls are in place, then it should not disclose 
personally identifiable information from education records to an 
organization for the purpose of conducting a study.
    In this regard, it should be noted that educational agencies and 
institutions are responsible for any failures by an organization 
conducting a study to comply with applicable FERPA requirements. FERPA 
states that if a third party outside the educational agency or 
institution fails to destroy information in violation of 20 U.S.C. 
1232g(b)(1)(F), the studies exception in FERPA, the educational agency 
or institution shall be prohibited from permitting access to 
information from education records to that third party for a period of 
not less than five years. See 20 U.S.C. 1232g(b)(4)(B).
    Changes: We have revised Sec.  99.31(a)(6) to: (1) Retain Sec.  
99.31(a)(6)(ii)(A) and (B); (2) amend Sec.  99.31(a)(6)(ii)(A) to 
provide that the study must be conducted in a manner that does not 
permit personal identification of parents or students by anyone other 
than representatives of the organization that have legitimate interest 
in the information; (3) amend Sec.  99.31(a)(6)(ii)(C) to require that 
the written agreement specify the purpose,

[[Page 74828]]

scope, and duration of the study and the information to be disclosed; 
require the organization to use personally identifiable information 
from education records only to meet the purpose or purposes of the 
study as stated in the written agreement; limit any disclosures of 
information to individuals in the organization conducting the study who 
have a legitimate interest in the information; and require the 
organization to destroy or return to the educational agency all 
personally identifiable information when the information is no longer 
needed for the purposes of the study and specify the time period during 
which the organization must either destroy or return the information to 
the educational agency or institution; and (4) amend Sec.  99.31(a)(6) 
in new paragraph (iii) to provide that an educational agency or 
institution is not required to initiate a study.

Disclosure of Education Records to Non-Educational State Agencies

    Comment: Several commenters stated that the proposed amendments did 
not specifically address whether an educational agency or institution 
is permitted to disclose education records to non-educational State 
agencies, such as State health or labor agencies, as part of an 
agreement with those agencies, without first obtaining consent. One 
commenter said that because the Department has taken the position that 
education records may be shared with State auditors who are not 
educational officials and who are not, by definition, under the control 
of a State educational authority, there is no legal basis to prohibit 
the disclosure of education records to other non-educational State and 
local agencies.
    Some officials representing State health agencies commented that 
FERPA should be more closely aligned with the disclosure provisions of 
the HIPAA Privacy Rule. One commenter noted that there was a critical 
need for public health researchers to be able to access, without 
consent, personally identifiable information contained in student 
health records to allow for analyses, public health studies, and 
research that will benefit school-aged children, as well as the general 
population. One organization representing school nurses noted that 
public health officials need access to education records for the 
purposes of public health reporting, surveillance, and reimbursement.
    Several commenters recommended that SEAs be authorized to share 
data from education records with State social services, health, 
juvenile, and employment agencies, to serve the needs of students, 
including special needs, low-income, and at-risk students. One SEA 
commented that it did not support extending access to student data to 
non-education State agencies, except to State auditors, as specified in 
proposed Sec.  99.35(a)(3). This commenter asserted that access to and 
use of information from students' education records should be 
controlled by a limited number of education officials who are sensitive 
to the intent of FERPA and well acquainted with its safeguards.
    Discussion: There is no specific exception to the written consent 
requirement in FERPA that permits the disclosure of personally 
identifiable information from students' education records to non-
educational State agencies. Educational agencies and institutions may 
disclose personally identifiable information for audit or evaluation 
purposes under Sec. Sec.  99.31(a)(3) and 99.35 only to authorized 
representatives of the officials or agencies listed in Sec.  
99.31(a)(3)(i) through (iv). Typically, LEAs and their constituent 
schools disclose education records to State educational authorities 
under Sec.  99.31(a)(3)(iv), such as the SEA, for audit, evaluation, or 
compliance and enforcement purposes.
    There are some exceptions that might authorize disclosures to non-
educational State agencies for specified purposes. For example, 
disclosures may be made in a health or safety emergency (Sec. Sec.  
99.31(a)(10) and 99.36), in connection with financial aid (Sec.  
99.31(a)(4)), or pursuant to a State statute under the juvenile justice 
system exception (Sec. Sec.  99.31(a)(5) and 99.38), and any 
disclosures must meet the specific requirements of the particular 
exception. FERPA, however, does not contain any specific exceptions to 
permit disclosures of personally identifiable information without 
consent for public health or employment reporting purposes. That said, 
nothing in FERPA prohibits an educational agency or institution from 
importing information from another source to perform its own 
evaluations.
    We believe that any further expansion of the list of officials and 
entities in FERPA that may receive education records without the 
consent of the parent or eligible student must be authorized by 
legislation enacted by Congress.
    We explained in the NPRM on page 15577 that, with respect to State 
auditors, legislative history for the 1979 FERPA amendment indicates 
that Congress specifically intended that FERPA not preclude State 
auditors from obtaining personally identifiable information from 
education records in order to audit Federal and State supported 
education programs, notwithstanding that the statutory language in the 
amendment refers only to ``State and local educational officials.'' See 
20 U.S.C. 1232g(b)(5); H.R. Rep. No. 338, 96th Cong., 1st Sess. at 10 
(1979), reprinted in 1979 U.S. Code Cong. & Admin. News 819, 824. This 
legislative history provides a basis for drawing a distinction between 
State auditors and officials of other State agencies that also are not 
under the control of the State educational authority. (As explained 
more fully under State auditors, upon further review, we have removed 
from the final regulations the proposed regulations related to State 
auditors and audits.)
    The 1979 amendment to FERPA does not apply to other State officials 
or agencies, and there is no other legislative history to indicate that 
Congress intended that FERPA be interpreted to permit educational 
agencies and institutions, or State and local educational authorities 
or Federal officials and agencies listed in Sec.  99.31(a)(3), to share 
students' education records with non-educational State officials. In 
fact, Congress has, on numerous occasions, indicated otherwise.
    As discussed elsewhere in this preamble under the heading Health or 
Safety Emergency, the HIPAA Privacy Rule specifically excludes from 
coverage health care information that is maintained as an ``education 
record'' under FERPA. 45 CFR 160.103, Protected health information. We 
understand that the HIPAA Privacy Rule allows covered entities to 
disclose identifiable health data without written consent to public 
health authorities. However, there is no comparable exception to the 
written consent requirement in FERPA.
    As mentioned previously, in conducting an audit, evaluation, or 
compliance or enforcement activity, an educational authority may 
collaborate with other State agencies by importing data from those 
sources and conducting necessary matches. Any reports or other 
information created as a result of the data matches may only be 
released to those non-educational officials in non-personally 
identifiable form. Educational authorities may also release information 
on students to non-educational officials that has been properly de-
identified, as described in Sec.  99.31(b)(1).
    Additionally, many agencies providing services to low income or at-
risk families have parents sign a consent form authorizing disclosure 
of

[[Page 74829]]

information at intake time so that the agency can receive necessary 
information from schools. In 1993, we amended the FERPA regulations to 
help facilitate this practice. In final regulations published in the 
Federal Register on January 7, 1993 (58 FR 3188), we removed the 
previous requirement in the regulations that schools ``obtain'' consent 
from parents and eligible students so that parents and eligible 
students may ``provide'' a signed and dated consent to third parties in 
order for the school to disclose education records to those parties.
    Therefore, parents can provide consent at intake time to State and 
local social services and other non-educational agencies serving the 
needs of students in order to permit their children's schools (or the 
SEA) to disclose education records to the agency. For example, parents 
routinely provide consent to the Medicaid agency that permits that 
agency to collect information from other agencies on the family being 
served. In many cases those consents are written in a manner that 
complies with the consent requirement in Sec.  99.30, and the student's 
school may disclose information to the Medicaid agency necessary for 
reimbursement purposes for services provided the student.
    Changes: None.

Disclosure of Education Records to Student's Former Schools (Sec. Sec.  
99.31(a)(3), 99.31(a)(6), and 99.35(b))

    Comment: One commenter asked for clarification whether a school 
could disclose a student's education records to the student's previous 
school for the purpose of evaluating Federal or State supported 
education programs or for improving instruction. Several commenters 
said that there is a critical need for school districts to be able to 
access the records of their former students from the student's new 
district or postsecondary institution so that the previous institution 
can evaluate the effectiveness of its own education programs. Some 
commenters said that Sec.  99.35(a) clearly allows a K-12 data system 
to use postsecondary records to evaluate its own programs, and that a 
K-12 system does not need to have legal authority to evaluate 
postsecondary programs for the disclosure to be valid under the audit 
or evaluation exception.
    Discussion: Section 99.31(a)(2) allows an educational agency or 
institution to disclose personally identifiable information from 
education records, without consent, to a school where the student seeks 
or intends to enroll or is already enrolled if the disclosure relates 
to the student's enrollment or transfer. There is no specific authority 
in FERPA for an educational agency or institution, or a State or local 
educational authority, to disclose or redisclose personally 
identifiable information from education records to a student's former 
school without consent.
    As discussed above, Sec. Sec.  99.31(a)(3) and 99.35 allow 
educational agencies and institutions to disclose personally 
identifiable information from education records without consent to 
State and local educational authorities that are legally authorized to 
audit or evaluate the disclosing institution's programs or records. We 
encourage State and local authorities to take advantage of this 
exception and establish or modify State or local legal authority, as 
necessary, to allow K-12 and postsecondary educational authorities to 
audit or evaluate one another's programs. As noted above, the 
Department will generally defer to a State Attorney General's 
interpretation of State or local law on these matters.
    Section 99.31(a)(6) allows an educational agency or institution to 
disclose personally identifiable information from education records 
without consent to an organization conducting a study for, or on behalf 
of, the agency or institution that discloses its records. The ``for, or 
on behalf of'' language from the statute and regulations, however, does 
not allow the educational agency or institution to disclose personally 
identifiable information from education records under this exception so 
that the receiving organization can conduct a study for itself or some 
other party. Further, the Secretary does not as a policy matter support 
expanding the studies exception to permit such a disclosure because it 
would result in a vast increase in the number of parties gaining access 
to and maintaining personally identifiable information on students. As 
discussed below, educational agencies and institution and other 
parties, including State educational authorities, may always release 
information from education records to a student's former school, 
without consent, if all personally identifiable information has been 
removed.

Personally Identifiable Information and De-Identified Records and 
Information (Sec. Sec.  99.3 and 99.31(b))

(a) Definition of Personally Identifiable Information

    Comment: We received a number of comments on proposed Sec.  99.3 
regarding changes to the definition of personally identifiable 
information. One commenter applauded the Department's recognition of 
the increasing ease of identifying individuals from redacted records 
and statistical information because of the large amount of detailed 
personal information that is maintained on most Americans by many 
different organizations. This commenter and others, however, stated 
that the proposed regulations did not go far enough to ensure that 
personally identifiable information about students would not be 
released.
    One commenter expressed concern about our proposal to eliminate 
paragraphs (e) and (f) from the existing definition of personally 
identifiable information, which included a list of personal 
characteristics and other information that would make a student's 
identity easily traceable. The commenter said that this was a change to 
long-standing Department policy and represented an unwarranted invasion 
of privacy that exceeds statutory authority. This commenter also 
expressed concern that eliminating the ``easily traceable'' provisions 
for determining whether information was personally identifiable could 
prevent parents from accessing their children's education records and 
might allow school officials to circumvent FERPA requirements by using 
nicknames, initials, and other personal characteristics to refer to 
children.
    In contrast, several commenters stated that the regulations would 
be unworkable or were too restrictive and would prevent or discourage 
the release of information from education records needed for school 
accountability and other public purposes. These commenters stated that 
paragraphs (f) and (g) in the proposed definition of personally 
identifiable information, which replaces the ``easily traceable'' 
provisions, would provide school officials too much discretion to 
conceal information the public deserves to have in order to debate 
public policy. Proposed paragraph (f) provided that personally 
identifiable information includes other information that, alone or in 
combination, is linked or linkable to a specific student that would 
allow a reasonable person in the school or its community, who does not 
have personal knowledge of the relevant circumstances, to identify the 
student with reasonable certainty. Proposed paragraph (g) provided that 
personally identifiable information includes information requested by a 
person who the educational agency or institution reasonably believes 
has direct, personal knowledge of the identity of the student

[[Page 74830]]

to whom the education record relates, sometimes known as a ``targeted 
request.''
    Several commenters expressed support for the provisions in 
paragraphs (f) and (g) of the definition of personally identifiable 
information. One of these commenters said that the ``school and 
community'' limitation and the ``reasonable person'' standard in 
paragraph (f) is sufficiently clear for implementation by parties that 
release de-identified records. Another commenter said that ambiguity in 
the terms ``reasonable person'' and ``reasonable certainty'' was 
necessary so that organizations can develop their own standards for 
addressing the problem of ensuring that information that is released is 
not personally identifiable. This commenter asked the Department to 
retain the flexibility in the proposed language and provide examples of 
policies that have been implemented that meet the requirements in 
paragraphs (f) and (g) of the definition. The commenter said that most 
school districts know when they are receiving a targeted request 
(paragraph (g)) but asked that the Department provide examples to help 
districts determine whether a non-targeted request will reveal 
personally identifiable information.
    Journalism and writers' associations expressed concern about the 
``reasonable person'' standard in paragraph (f) and our statement in 
the preamble to the NPRM (73 FR 15583) that an educational agency or 
institution may not be able to release redacted education records that 
concern students or incidents that are well-known in the school 
community, including when the parent or student who is the subject of 
the record contacts the media and causes the publicity that prevents 
the release of the record. These commenters stated that FERPA should 
not prevent schools from releasing records from which all direct and 
indirect identifiers, such as name, date of birth, address, unusual 
place of birth, mother's maiden name, and sibling information, have 
been removed without regard to any outside information, particularly 
after a student or parent has waived any pretense of confidentiality by 
contacting the media. They also said that the proposed definition of 
personally identifiable information does not acknowledge the public 
interest in school accountability.
    One commenter said that the ``reasonable person in the school or 
its community'' standard in paragraph (f) was too narrow and 
inappropriate because it would allow individuals with even modest 
scientific and technological abilities to identify students based on 
supposedly de-identified information. Another commenter said that the 
reference in paragraph (f) to a ``reasonable person'' should be changed 
to ``ordinary person.'' A commenter said that if we retain the 
``reasonable person'' standard, we should remove the references to the 
school or its community and personal knowledge of the circumstances and 
simply refer to a reasonable person. Several commenters said the 
``school or its community'' standard is too vague and needs to be 
clarified, particularly in relation to the provision in paragraph (g) 
regarding targeted requests; these commenters said that school 
officials will choose to evaluate a request for information based on 
whether a reasonable person in the community, a broader standard than a 
reasonable person in the school, could identify the student and 
automatically find their own decisions to be reasonable. One commenter 
said that the phrase ``relevant circumstances'' in paragraph (f) is 
vague.
    One commenter said that the standard in paragraph (f) about whether 
the information requested is ``linked or linkable'' to a specific 
student was too vague and overly broad and could be logically extended 
to cover almost any information about a student. This commenter said 
that the regulations should focus on preventing the release of records 
that in and of themselves contain unique personal descriptors that 
would make the student identifiable in the school community and not 
refer to outside information, including what members of the public 
might know independently of the records themselves.
    Several commenters expressed concerns that the provision in 
paragraph (g) regarding targeted requests will make FERPA and the 
regulations administratively unwieldy and unnecessarily subjective. One 
of these commenters said that paragraph (g) is unclear and adds more 
confusion as opposed to providing clarity; this commenter said that 
paragraph (g) should be removed and that the requirements in paragraph 
(f) were sufficient. Another commenter said that the standard in 
paragraph (g) unfairly holds agencies and institutions responsible for 
ascertaining the requester's personal knowledge. One commenter said 
that we should delete the words ``direct, personal'' before 
``knowledge'' because these terms are unclear. According to this 
commenter, if a school reasonably believes that the requester knows the 
student's identity, the school should not disclose the records, whether 
the knowledge is ``direct'' or ``personal.''
    Other commenters expressed a more general concern that the standard 
for targeted requests in paragraph (g) places an undue burden on school 
officials to obtain information about the person requesting information 
and creates a potential conflict with State open records laws. 
According to these commenters, the regulations as proposed would 
encourage agencies and institutions to make illegitimate inquiries into 
a requester's motives for seeking information and what the requester 
intends to do with it, or require the agency or institution to read the 
mind of a party requesting information. According to the commenter, 
this would introduce a degree of subjective judgment that would 
invariably lead to abuse because the same record that could be 
considered a public record to one requester could be a confidential 
document to another. A large university that has decentralized 
administrative operations questioned how it could be expected to take 
institutional knowledge into account in evaluating whether a request 
for records is targeted and asked for confirmation that the Department 
will not substitute its judgment for that of the institution so long as 
there was a rational basis for the decision to release information.
    We received a few comments on the example of a targeted request 
that we provided in the preamble to the NPRM (73 FR 15583-15584), in 
which rumors circulate that a candidate running for political office 
plagiarized other students' work, and a reporter asks the university 
for the redacted disciplinary records of all students who were 
disciplined for plagiarism for the year in which the candidate 
graduated. We explained that the university may not release the records 
in redacted form because the circumstances indicate that the requester 
had direct, personal knowledge of the subject of the case. Two 
commenters said that confirmation that one unnamed student was 
disciplined in 1978 for plagiarism does not identify that student or 
confirm that the candidate was that student, and our explanation of the 
standard with this example showed that the regulations would prevent 
parents and the media from discharging their vital oversight 
responsibilities.
    One school district said that the targeted request provision could 
impair due process in some student discipline cases by limiting the 
release of redacted witness statements that concern more than one 
student. The commenter suggested that under its current

[[Page 74831]]

practice, if four students are involved in an altercation, the school 
redacts all personally identifiable information with regard to students 
2 through 4 when releasing the statement without parental consent to 
student 1, but under the proposed regulations, student 1's request 
would violate the requirements in paragraph (g) because of the 
student's knowledge of the identity of the other students to whom the 
record relates. This commenter said that the regulations should not be 
adopted if they do not address these due process concerns.
    Several commenters said they appreciated the addition of a 
student's date of birth and other indirect identifiers in the 
definition of personally identifiable information. Another commenter 
said that a comprehensive list of indirect identifiers would be 
helpful. One commenter asked us to define the concept of indirect 
identifiers. Another commenter asked us to clarify which personally 
identifiable data elements may be released without consent. A commenter 
asked us to define the term biometric record as used in the definition 
of personally identifiable information.
    Discussion: The Joint Statement explains that the purpose of FERPA 
is two-fold: to assure that parents and eligible students can access 
the student's education records, and to protect their right to privacy 
by limiting the transferability of their education records without 
their consent. 120 Cong. Rec. 39862. As such, FERPA is not an open 
records statute or part of an open records system. The only parties who 
have a right to obtain access to education records under FERPA are 
parents and eligible students. Journalists, researchers, and other 
members of the public have no right under FERPA to gain access to 
education records for school accountability or other matters of public 
interest, including misconduct by those running for public office. 
Nonetheless, as explained in the preamble to the NPRM, 73 FR 15584-
15585, we believe that the regulatory standard for defining and 
removing personally identifiable information from education records 
establishes an appropriate balance that facilitates school 
accountability and educational research while preserving the statutory 
privacy protections in FERPA.
    The simple removal of nominal or direct identifiers, such as name 
and SSN (or other ID number), does not necessarily avoid the release of 
personally identifiable information. Other information, such as 
address, date and place of birth, race, ethnicity, gender, physical 
description, disability, activities and accomplishments, disciplinary 
actions, and so forth, can indirectly identify someone depending on the 
combination of factors and level of detail released. Similarly, and as 
noted in the preamble to the NPRM, 73 FR 15584, the existing 
professional literature makes clear that public directories and 
previously released information, including local publicity and even 
information that has been de-identified, is sometimes linked or 
linkable to an otherwise de-identified record or data set and renders 
the information personally identifiable. The regulations properly 
require parties that release information from education records to 
address these situations.
    We removed the ``easily traceable'' standard from the definition of 
personally identifiable information because it lacked specificity and 
clarity. We were also concerned that the ``easily traceable'' standard 
suggested that a fairly low standard applied in protecting education 
records, i.e., that information was considered personally identifiable 
only if it was easy to identify the student.
    The removal of the ``easily traceable'' standard and adoption of 
the standards in paragraphs (f) and (g) will not affect a parent's 
right under FERPA to inspect and review his or her child's education 
records. Records that teachers and other school officials maintain on 
students that use only initials, nicknames, or personal descriptions to 
identify the student are education records under FERPA because they are 
directly related to the student.
    Further, records that identify a student by initials, nicknames, or 
personal characteristics are personally identifiable information if, 
alone or combined with other information, the initials are linked or 
linkable to a specific student and would allow a reasonable person in 
the school community who does not have personal knowledge about the 
situation to identify the student with reasonable certainty. For 
example, if teachers and other individuals in the school community 
generally would not be able to identify a specific student based on the 
student's initials, nickname, or personal characteristics contained in 
the record, then the information is not considered personally 
identifiable and may be released without consent. Experience has shown, 
however, that initials, nicknames, and personal characteristics are 
often sufficiently unique in a school community that a reasonable 
person can identify the student from this kind of information even 
without access to any personal knowledge, such as a key that 
specifically links the initials, nickname, or personal characteristics 
to the student.
    In contrast, if a teacher uses a special code known only by the 
teacher and the student (or parent) to identify a student, such as for 
posting grades, this code is not considered personally identifiable 
information under FERPA because the only reason the teacher can 
identify the student is because of the teacher's access to personal 
knowledge of the relevant circumstances, i.e., the key that links the 
code to the student's name.
    In response to the commenter who stated that a school should not be 
prevented from releasing information when the subject of the record has 
waived any pretense of confidentiality by contacting the media and 
making the incident well-known in the community, we have found that in 
limited circumstances a parent or student may impliedly waive their 
privacy rights under FERPA by disclosing information to parties in a 
special relationship with the institution, such as a licensing or 
accreditation organization. However, we have not found and do not 
believe that parents and students generally waive their privacy rights 
under FERPA by sharing information with the media or other members of 
the general public. The fact that information is a matter of general 
public interest does not give an educational agency or institution 
permission to release the same or related information from education 
records without consent.
    The ``reasonableness'' standards in paragraphs (f) and (g) of the 
new definition, which replace the ``easily traceable'' standard, do not 
require the exercise of subjective judgment or inquiries into a 
requester's motives. Both provisions require the disclosing party to 
use legally recognized, objective standards by referring to 
identification not in the mind of the disclosing party or requester but 
by a reasonable person and with reasonable certainty, and by requiring 
the disclosing party to withhold information when it reasonably 
believes certain facts to be present. These are not subjective 
standards, and these changes will not diminish the privacy protections 
in FERPA.
    The standard proposed in paragraph (f) regarding the knowledge of a 
reasonable person in the school or its community was not intended to 
describe the technological or scientific skill level of a person who 
would be capable of re-identifying statistical information or redacted 
records. Rather, it provided the standard an agency or

[[Page 74832]]

institution should use to determine whether statistical information or 
a redacted record will identify a student, even though certain 
identifiers have been removed, because of a well-publicized incident or 
some other factor known in the community. For example, as explained in 
the preamble to the NPRM, 73 FR 15583, a school may not release 
statistics on penalties imposed on students for cheating on a test 
where the local media have published identifiable information about the 
only student (or students) who received that penalty; that statistical 
information or redacted record is now personally identifiable to the 
student or students because of the local publicity.
    Paragraph (f) in the proposed definition provided that the agency 
or institution must make a determination about whether information is 
personally identifiable information not with regard to what someone 
with personal knowledge of the relevant circumstances would know, such 
as the principal who imposed the penalty, but with regard to what a 
reasonable person in the school or its community would know, i.e., 
based on local publicity, communications, and other ordinary 
conditions. We agree with the comment that the ``school or its 
community'' standard was confusing because it was not clear whether 
just the school itself or the larger community in which the school is 
located is the relevant group for determining what a reasonable person 
would know.
    We are changing this standard in paragraph (f) to the ``school 
community'' and by this change we mean that an educational agency or 
institution may not select a broader ``community'' standard when the 
information to be released would be personally identifiable under the 
narrower ``school'' standard. For example, it might be well known among 
students, teachers, administrators, parents, coaches, volunteers, or 
others at the local high school that a student was caught bringing a 
gun to class last month but generally unknown in the town where the 
school is located. In these circumstances, a school district may not 
disclose that a high school student was suspended for bringing a gun to 
class last month, even though a reasonable person in the community 
where the school is located would not be able to identify the student, 
because a reasonable person in the high school would be able to 
identify the student. The student's privacy is further protected 
because a reasonable person in the school community is also presumed to 
have at least the knowledge of a reasonable person in the local 
community, the region or State, the United States, and the world in 
general. The ``school community'' standard, therefore, provides the 
maximum privacy protection for students.
    We do not agree that the reference to ``reasonable person'' should 
be changed to ``ordinary person.'' ``Reasonable person'' is a legally 
recognized standard that represents a hypothetical, rational, prudent, 
average individual. It would be confusing and inappropriate to 
introduce a new term ``ordinary'' in this context.
    The standard in paragraph (f) excludes from the ``reasonable person 
in the school community'' standard persons who have personal knowledge 
of the ``relevant circumstances,'' which one commenter considered 
vague. Under this standard, an agency or institution is not required to 
take into consideration when releasing redacted or statistical 
information that someone with special knowledge of the circumstances 
could identify the student. For example, if it is generally known in 
the school community that a particular student is HIV-positive, or that 
there is an HIV-positive student in the school, then the school could 
not reveal that the only HIV-positive student in the school was 
suspended. However, if it is not generally known or obvious that there 
is an HIV-positive student in school, then the same information could 
be released, even though someone with special knowledge of the 
student's status as HIV-positive would be able to identify the student 
and learn that he or she had been suspended.
    The provisions in paragraph (g) regarding targeted requests do not 
require an educational agency or institution to ascertain or guess a 
requester's motives for seeking information from education records or 
what a requester intends to do with the information. This paragraph 
addresses a situation in which a requester seeks what might generally 
qualify as a properly redacted record but the facts indicate that 
redaction is a useless formality because the subject's identity is 
already known.
    An educational agency or institution is not required under 
paragraph (g) to make any special inquiries or otherwise seek 
information about the person requesting information from education 
records. It must use information that is obvious on the face of the 
request or provided by the requester, such as when a requester asks for 
the redacted transcripts of a particular student. Paragraph (f) also 
requires an agency or institution to use information known to a 
reasonable person in the school community, such as when a requester 
asks for the redacted transcripts of all basketball players who were 
expelled for accepting bribes after the local newspaper published a 
story about the matter. Paragraphs (f) and (g) do not require an 
educational agency or institution to inquire whether a requester has 
special knowledge not available generally in the school community that 
would make the subject of the record identifiable. We disagree with the 
comment that paragraph (f) is sufficient and paragraph (g) should be 
removed. Paragraph (g) addresses the problem of targeted requests, 
which is not addressed under paragraph (f).
    We agree with the comment that the provision in paragraph (g) under 
which an agency or institution must determine whether the information 
requested is personally identifiable information based on its 
reasonable belief that the requester has ``direct, personal'' knowledge 
of the identity of the student to whom the record relates is ambiguous 
and confusing, especially in relation to what might be considered 
indirect knowledge. Therefore, we have modified this provision so that 
an educational agency or institution must simply have a reasonable 
belief that the requester knows the identity of the student to whom the 
record relates.
    In reviewing a complaint that an educational agency or institution 
disclosed personally identifiable information from an education record 
in response to a targeted request, the Department would examine the 
request itself, the facts on which the agency or institution based its 
decision to release the information, as well as any information known 
generally in the school community that the agency or institution failed 
to take into account. The Department would also counsel an agency or 
institution about the nature of the violation in connection with the 
Department's responsibility for seeking voluntary compliance with FERPA 
before initiating any enforcement action under Sec.  99.67.
    With regard to the comment that the standard in paragraph (g) will 
impair due process in student discipline cases, it is unclear what the 
commenter means by releasing redacted witness statements under its 
current practice. Education records are defined in FERPA as records 
that are directly related to a student and maintained by an educational 
agency or institution, or by a party acting for the agency or 
institution. 20 U.S.C. 1232g(a)(4)(A); 34 CFR 99.3. Under this 
definition, a parent (or eligible student) has a right to inspect and 
review any witness statement that is directly related to the student, 
even if that statement

[[Page 74833]]

contains information that is also directly related to another student, 
if the information cannot be segregated and redacted without destroying 
its meaning.
    For example, parents of both John and Michael would have a right to 
inspect and review the following information in a witness statement 
maintained by their school district because it is directly related to 
both students: ``John grabbed Michael's backpack and hit him over the 
head with it.'' Further, in this example, before allowing Michael's 
parents to inspect and review the statement, the district must also 
redact any information about John (or any other student) that is not 
directly related to Michael, such as: ``John also punched Steven in the 
stomach and took his gloves.'' Since Michael's parents likely know from 
their son about other students involved in the altercation, under 
paragraph (g) the district could not release any part of this sentence 
to Michael's parents. We note also that the sanction imposed on a 
student for misconduct is not generally considered directly related to 
another student, even the student who was injured or victimized by the 
disciplined student's conduct, except if a perpetrator has been ordered 
to stay away from a victim.
    In order to provide maximum flexibility to educational agencies and 
institutions, we did not attempt to define or list all other ``indirect 
identifiers''. We believe that the examples listed in paragraph (3) of 
the definition of personally identifiable information--date of birth, 
place of birth, and mother's maiden name--indicate clearly the kind of 
information that could identify a student. Race and ethnicity, for 
example, could also be indirect identifiers. It is not possible, 
however, to list all the possible indirect identifiers and ways in 
which information might indirectly identify a student. Further, unlike 
the HIPAA Privacy Rule, these regulations do not attempt to provide a 
``safe harbor'' by listing all the information that may be removed in 
order to satisfy the de-identification requirements in Sec.  99.31(b). 
We have also added a definition of biometric record that is based on 
National Security Presidential Directive 59 and Homeland Security 
Presidential Directive 24.
    Changes: We added a definition of biometric record, which provides 
that the term means a record of one or more measurable biological or 
behavioral characteristics that can be used for automated recognition 
of an individual. Examples include fingerprints, retina and iris 
patterns, voiceprints, DNA sequence, facial characteristics, and 
handwriting.
    We also have revised paragraph (f) in the definition of personally 
identifiable information to change the reference ``school or its 
community'' to ``school community.'' In paragraph (g) of the definition 
of personally identifiable information, we removed the requirement that 
the requester have ``direct, personal knowledge.'' As revised, 
paragraph (g) provides that personally identifiable information means 
information requested by a person who the educational agency or 
institution reasonably believes knows the identity of the student to 
whom the record relates.

(b) De-Identified Records and Information

    Comment: We received a number of comments on Sec.  99.31(b)(1), 
which would allow an educational agency or institution, or a party that 
has received personally identifiable information from education 
records, to release the records or information without parental consent 
after the removal of all personally identifiable information, provided 
that the educational agency or institution or other party has made a 
reasonable determination that a student's identity is not personally 
identifiable because of unique patterns of information about the 
student, whether through single or multiple releases, and taking into 
account other reasonably available information. In order to permit 
ongoing educational research with the same data, Sec.  99.31(b)(2) 
allows an educational agency or institution or other party that 
releases de-identified, non-aggregated data (also known as 
``microdata'') from education records to attach a code to each record, 
which may allow the recipient to match information received from the 
same source, under three conditions--(1) the educational agency or 
institution does not disclose any information about how it generates 
and assigns a record code, or that would allow a recipient to identify 
a student based on a record code; (2) the record code is used for no 
purpose other than identifying a de-identified record for purposes of 
education research and cannot be used to ascertain personally 
identifiable information about a student; and (3) the record code is 
not based on a student's social security number or other personal 
information.
    Several commenters supported these proposed regulations and said 
that they will help facilitate valuable educational research. One of 
these commenters said that the provisions for de-identification of 
education records create clear standards that will allow researchers to 
conduct necessary research without compromising student privacy. One 
commenter appreciated being able to attach a code or linking key to 
records to facilitate matching students across data sets while 
preserving student confidentiality.
    One commenter stated that de-identified data do not support 
appropriate analytical research that will lead to improved educational 
outcomes. Further, according to this commenter, complete de-
identification of systematic, longitudinal data on every student may 
not be possible.
    Two commenters expressed concern that agencies and institutions 
redact too much information from education records and said that the 
Department should err on the side of disclosure of disaggregated data 
so that journalists and researchers can obtain accurate information 
about how students in every accountability subgroup are performing. 
These commenters said that the regulations should take into account the 
real track record of journalists and researchers in maintaining the 
confidentiality of information from education records.
    One commenter said that many institutions and individuals have the 
ability to re-identify seemingly de-identified data and that it is 
generally much easier to do than most people realize because 87 percent 
of Americans can be identified uniquely from their date of birth, five-
digit zip code, and gender. This commenter said that the regulations 
need to take into account that re-identification is a much greater risk 
for student data than other kinds of information because FERPA allows 
for the regular publication of student directories that contain a 
wealth of personal information, including address and date of birth, 
that can be used with existing tools and emerging technology to re-
identify statistical data, even by non-experts.
    Another commenter said that because the de-identification process 
is so resource-intensive, the regulations should allow the research 
entity to de-identify education records as a contractor under Sec.  
99.31(a)(1) of the regulations.
    We explained in the preamble to the NPRM (73 FR 15585) that 
educational agencies and institutions should monitor releases of coded, 
de-identified microdata from education records to ensure that 
overlapping or successive releases do not result in data sets in which 
a student's personally identifiable information is disclosed. One 
commenter said that this monitoring requirement was too burdensome 
given the vast number of

[[Page 74834]]

data requests it receives and asked us to limit the monitoring 
requirement to single or multiple releases it makes to the same party. 
An SEA asked specifically for clarification in the regulations 
regarding what steps, if any, it must take to ensure that multiple 
releases of de-identified data to the same requester over time that the 
requester intends to use for a longitudinal study do not result in 
small data cells that may reveal the identity of the student. A school 
district said that the regulations should require the destruction of 
de-identified information from education records by the receiving party 
to avoid the problem of combining successive data releases to identify 
students.
    Some commenters said that the regulations should provide objective 
standards for the de-identification of education records. One commenter 
asked the Department to prescribe a method for States to adopt to 
ensure that student confidentiality is protected. Two commenters asked 
specifically for guidance on what minimum cell size should be allowed 
when releasing statistical information. Several commenters said that 
SEAs and school districts need specific guidance regarding the release 
of student achievement data under the NCLB, including, in particular, 
reporting 100 percent achievement of certain performance levels on 
State assessments. One commenter who opposed restrictions on the 
release of de-identified data referred to instances in which some 
States have created minimum cell sizes of 100 for reporting 
disaggregated data under NCLB, which prevents the release of a great 
deal of important information. Another commenter said that our 
discussion of small cell sizes in the preamble to the NPRM, 73 FR 
15584, reflected a misunderstanding of the problem.
    One commenter said that Sec.  99.31(b) is confusing because it is 
not clear how paragraph (b)(2), which is limited to educational 
research, relates to paragraph (b)(1), which is not so limited. This 
commenter also said that the regulations impose an unnecessary burden 
on the entity receiving a request for information and that the 
requirements of paragraph (f) in the definition of personally 
identifiable information are sufficient to de-identify education 
records. Another commenter said that the language in Sec.  99.31(b)(1) 
that requires consideration of unique patterns of information about a 
student is confusing and creates ambiguity because the definition of 
personally identifiable information itself incorporates standards for 
de-identification that appear to differ from the standard in Sec.  
99.31(b).
    Discussion: As explained in the preamble to the NPRM, 73 FR 15584-
15585, we believe that the regulatory standard for de-identifying 
information from education records establishes an appropriate balance 
that facilitates the release of appropriate information for school 
accountability and educational research purposes while preserving the 
statutory privacy protections in FERPA. Unlike the HIPAA Privacy Rule, 
these regulations do not attempt to provide a ``safe harbor'' by 
listing all the direct and indirect identifiers that may be removed to 
satisfy the de-identification requirements in Sec.  99.31(b). Rather, 
they are intended to provide standards under which information from 
education records may be released without consent because all 
personally identifiable information has been removed.
    The Department recognizes that de-identified data may not be 
appropriate for all educational research purposes and that complete de-
identification of longitudinal student data may not be possible without 
sacrificing essential content and usability. In these situations, and 
as discussed elsewhere in this preamble, FERPA allows the disclosure 
and redisclosure of personally identifiable information from education 
records, without consent, to researchers under the terms and conditions 
specified in Sec. Sec.  99.31(a)(1), 99.31(a)(3), and 99.31(6). We note 
that a researcher who receives personally identifiable information 
under these provisions would, however, have to de-identify any report 
or other information in accordance with Sec.  99.31(b) before releasing 
it to the public or other parties, including other researchers.
    In response to comments that educational agencies and institutions 
may remove too much information from education records, we note that 
while we have attempted to provide a balanced standard for the release 
of de-identified data for school accountability and other purposes, 
FERPA is a privacy statute, and no party has a right under FERPA to 
obtain information from education records except parents and eligible 
students. Further, there is no statutory authority in FERPA to modify 
the prohibition on disclosure of personally identifiable information 
from education records, or the exceptions to the written consent 
requirement, based on the track record of the party, including 
journalists and researchers, in maintaining the confidentiality of 
information from education records that they have received.
    In response to the comment about allowing a researcher to de-
identify education records, educational agencies and institutions may 
outsource the de-identification process to any outside service provider 
serving as a school official in accordance with the requirements in 
Sec.  99.31(a)(1)(i)(B). (Those requirements are discussed in detail in 
the preamble to the NPRM at 73 FR 15578-15580 and elsewhere in these 
final regulations.) State and local educational authorities and Federal 
officials and agencies listed in Sec.  99.31(a)(3) may outsource the 
de-identification process to their authorized representatives under the 
conditions specified in Sec.  99.35.
    We agree that the risk of re-identification may be greater for 
student data than other information because of the regular publication 
of student directories, commercial databases, and de-identified but 
detailed educational reports by States and researchers that can be 
manipulated with increasing ease by computer technology. As noted in 
the preamble to the NPRM, 73 FR 15584, the re-identification risk of 
any given release is cumulative, i.e., directly related to what has 
previously been released, and this includes both publicly-available 
directory information, which is personally identifiable, and de-
identified data releases. For that reason, we advised in the NPRM that 
parties should minimize information released in directories to the 
extent possible because, since the enactment of FERPA in 1974, the risk 
of re-identification from such information has grown as a result of new 
technologies and methods.
    In response to comments about the need to monitor releases of 
coded, de-identified microdata to avoid re-identification of the data, 
because the risk of re-identification is cumulative, when making a new 
disclosure of coded data an educational agency or institution or other 
party must take into account all releases of information from education 
records it has made, not just releases it has made to the recipient of 
new data. We note that some of the publicly available directory 
information and de-identified data releases that need to be taken into 
account have been produced by the same agency or institution, State or 
local educational authority, or Federal official that wishes to release 
newly de-identified information. In general, FERPA poses no 
restrictions on the recipient's use of directory information and de-
identified data from education records. Therefore, it may be unclear 
whether previous data releases are available generally, have been 
shared with a limited number of

[[Page 74835]]

parties, or not shared at all. Further, unlike personally identifiable 
information that is disclosed under Sec. Sec.  99.31(a)(3) and (a)(6), 
de-identified information from education records does not have to be 
destroyed when no longer needed for the purposes for which it was 
released. We note, however, that a releasing party would reduce its 
monitoring responsibilities if it requires destruction or prohibits 
redisclosure of coded, de-identified microdata, because coded, de-
identified microdata has a higher risk of re-identification than de-
identified microdata. In the future the Department will provide further 
information on how to monitor and limit disclosure of personally 
identifiable information in successive statistical data releases.
    In response to requests for guidance on what specific steps and 
methods should be used to de-identify information (and as noted in the 
preamble to the NPRM, 73 FR 15584), it is not possible to prescribe or 
identify a single method to minimize the risk of disclosing personally 
identifiable information in redacted records or statistical information 
that will apply in every circumstance, including determining whether 
defining a minimum cell size is an appropriate means to protect the 
confidentiality of aggregated data and, if so, selection of an 
appropriate number. This is because determining whether a particular 
set of methods for de-identifying data and limiting disclosure risk is 
adequate cannot be made without examining the underlying data sets, 
other data that have been released, publicly available directories, and 
other data that are linked or linkable to the information in question. 
For these reasons, we are unable to provide examples of rules and 
policies that necessarily meet the de-identification requirements in 
Sec.  99.31(b). The releasing party is responsible for conducting its 
own analysis and identifying the best methods to protect the 
confidentiality of information from education records it chooses to 
release. We recommend that State educational authorities, educational 
agencies and institutions, and other parties refer to the examples and 
methods described in the NPRM at page 15584 and refer to the Federal 
Committee on Statistical Methodology's Statistical Policy Working Paper 
22, www.fcsm.gov/working-papers/wp22.html, for additional guidance.
    With regard to issues with NCLB reporting in particular, 
determining the minimum cell size to ensure statistical reliability of 
information is a completely different analysis than that used to 
determine the appropriate minimum cell size to ensure confidentiality. 
Further, as noted in the preceding paragraph and in the preamble to the 
NPRM, use of minimum cell sizes or data suppression is only one of 
several ways in which information from education records may be de-
identified before release. Statistical Policy Working Paper 22 
describes other disclosure limitation methods, such as ``top coding'' 
and ``data swapping,'' which may be more suitable than simple data 
suppression for releasing the maximum amount of information to the 
public without breaching confidentiality requirements. Decisions 
regarding whether to use data suppression or some other method or 
combination of methods to avoid disclosing personally identifiable 
information in statistical information must be made on a case-by-case 
basis.
    We agree with the commenter who said that the example we provided 
in the preamble to the NPRM regarding the small cell problem in 
reporting that two Hispanic females failed to graduate was misleading 
and offer the following, more complete explanation. Simply knowing that 
one out of 100 Hispanic females failed to graduate does not identify 
which of the Hispanic females it might be. But suppose this female is 
an English language learner who is also enrolled in special education 
classes. The school also publishes tables on participation in special 
education classes by race, ethnicity, and grade, and tables that 
include the graduation status of Hispanic females disaggregated in one 
table by English language proficiency status, and by participation in 
special education classes in another. Suppose that these three 
tabulations each show separately that there is one 12th grade Hispanic 
female enrolled in special education classes, that the one Hispanic 
female who did not graduate was enrolled in special education classes, 
and that the one Hispanic female who did not graduate was an English 
language learner. With this information, the discerning observer knows 
that the one Hispanic female who failed to graduate is an English 
language learner and that she was the only 12th grade Hispanic student 
enrolled in special education classes. Any number of people in the 
school would be able to identify the Hispanic female who did not 
graduate with these three pieces of information.
    Expanding the example to two individuals, the logic is similar, 
except in this case each of the Hispanic females knows her own 
characteristics and can find herself in each of the available tables, 
and thus by a process of elimination identifies the characteristics of 
the other non-graduate, perhaps learning something she did not already 
know about the other student. The published tables show that there are 
two 12th grade Hispanic females enrolled in special education classes, 
one with a learning disability and one with mental retardation. The 
tables also show that the two Hispanic females who did not graduate 
were enrolled in special education classes, and that the two Hispanic 
females who did not graduate were both English language learners. 
Others in the school community may be able to identify the two 12th 
grade Hispanic females who are English language learners enrolled in 
special education classes, but not necessarily be able to distinguish 
the student with the learning disability from the student with mental 
retardation. However, each girl knows her own disability and by the 
process of elimination now knows the other girl's disability. 
Similarly, anyone with knowledge of one of the two Hispanic females who 
did not graduate can find that girl in the tables, and then isolate the 
characteristics that belong to the other Hispanic female.
    This example can be expanded to an example with three Hispanic 
females who fail to graduate. All three of the Hispanic females who did 
not graduate are English language learners, and two Hispanic females 
who did not graduate are enrolled in special education classes--one 
with a learning disability and the other with mental retardation. In 
this case, the one Hispanic female who is an English language learner 
and did not graduate now knows that the other two Hispanic females in 
her English language learner classes and also did not graduate are in 
the special education program, but she does not know which condition 
each girl has. By the same logic, each of the two females who did not 
graduate and are in special education classes knows her own disability 
and as a result knows the disability of the other Hispanic female who 
was an English language learner enrolled in special education classes 
who did not graduate. These are some examples of situations in which 
small cell data reveals personally identifiable information from 
education records.
    The Secretary has no statutory authority to modify the regulations 
to allow LEAs and SEAs to report that 100 percent of students achieved 
specified performance levels. In that regard we note that the 
Department's Non-Regulatory Guidance for NCLB Report Cards (2003) 
provides:

    [S]chools must also ensure that the data they report do not 
reveal personally identifiable information about individual students 
* * *. States must adopt a strategy

[[Page 74836]]

for dealing with a situation in which all students in a particular 
subgroup scored at the same achievement level. One solution, 
referred to as ``masking'' the data, is to use the notation of >95% 
when all students in a subgroup score at the same achievement level.

See www.ed.gov/programs/titleiparta/reportcardsguidance.doc on page 3. 
Likewise, LEAs and SEAs must adopt a strategy for ensuring that they do 
not disclose personally identifiable information about low-performing 
students when they release information about their high-performing 
students.
    In response to the comments that paragraphs (1) and (2) in Sec.  
99.31(b) are confusing, paragraph (1) establishes a standard for de-
identifying education records that applies to disclosures made to any 
party for any purpose, including, for example, parents and other 
members of the general public who are interested in school 
accountability issues, as well as education policy makers and 
researchers. The release of de-identified information from education 
records under Sec.  99.31(b)(1) is not limited to education research 
purposes because, by definition, the information does not contain any 
personally identifiable information.
    Paragraph (2) of Sec.  99.31(b) applies only to parties conducting 
education research; it allows an educational agency or institution, or 
a party that has received education records, such as a State 
educational authority, to attach a code to each record that may allow 
the researcher to match microdata received from the same educational 
source under the conditions specified. The purpose of paragraph (2) is 
to facilitate education research by authorizing the release of coded 
microdata. The requirements in paragraph (2) that apply to a record 
code preclude matching de-identified data from education records with 
data from another source. Therefore, by its terms, the release of coded 
microdata under paragraph (2) is limited to education research.
    We agree with the commenter who stated that the reference in Sec.  
99.31(b)(1) to ``unique patterns of information about a student'' is 
confusing in relation to the definition of personally identifiable 
information and believe that it essentially restated the requirements 
in paragraph (f) of the definition. Therefore, we have removed this 
phrase from the regulations. We disagree that the definition of 
personally identifiable information and the requirements in Sec.  
99.31(b) impose an unnecessary burden on the entity receiving a request 
for de-identified information from education records and that the 
requirements in paragraph (f) in the definition are sufficient. As 
explained above, paragraph (f) does not address the problem of targeted 
requests. It also does not address the re-identification risk 
associated with multiple data releases and other reasonably available 
information, or allow for the coding of de-identified micro data for 
educational research purposes. Section 99.31(b) provides the additional 
standards needed to help ensure that educational agencies and 
institutions and other parties do not identify students when they 
release redacted records or statistical data from education records.
    Changes: We have removed the reference to ``unique patterns of 
information'' in Sec.  99.31(b).

Notification of Subpoena (Sec.  99.33(b)(2))

    Comment: We received a few comments on our proposal in Sec.  
99.33(b)(2) to require a party that has received personally 
identifiable information from education records from an educational 
agency or institution to provide the notice to parents and eligible 
students under Sec.  99.31(a)(9) before it discloses that information 
on behalf of an educational agency or institution in compliance with a 
judicial order or lawfully issued subpoena. One national education 
association supported the proposed amendment.
    One commenter asked the Department to clarify the intent of the 
proposed language. This commenter said that, when an educational agency 
or institution requests that a third party make the disclosure to 
comply with a lawfully issued subpoena or court order, it is reasonable 
to expect the educational agency or institution to send the required 
notice to the student(s). The commenter also said that it was not clear 
from the proposed change whether it is sufficient for the educational 
agency or institution to send the notice or whether it must come from 
the third party.
    Discussion: The Secretary agrees that there needs to be 
clarification about which party is responsible for notifying parents 
and eligible students before an SEA or other third party outside of the 
educational agency or institution discloses education records to comply 
with a lawfully issued subpoena or court order. We have revised the 
regulation to provide that the burden to notify a parent or eligible 
student rests with the recipient of the subpoena or court order. While 
a third party, such as an SEA, that is the recipient of a subpoena or 
court order is responsible for notifying the parents and eligible 
students before complying with the order or subpoena, the educational 
agency or institution could assist the third party in the notification 
requirement, by providing it with contact information so that it could 
provide the notice.
    In order to ensure that this new requirement is enforceable, we 
have also revised Sec.  99.33(e) so that if the Department determines 
that a third party, such as an SEA, did not provide the notification 
required under Sec.  99.31(a)(9)(ii), the educational agency or 
institution may not allow that third party access to education records 
for at least five years.
    Changes: We have amended Sec.  99.33(b)(2) to clarify that the 
third party that receives the subpoena or court order is responsible 
for meeting the notification requirements under Sec.  99.31(a)(9). We 
also have revised Sec.  99.33(e) to provide that if the Department 
determines that a third party, such as an SEA, did not provide the 
notification required under Sec.  99.31(a)(9)(ii), the educational 
agency or institution may not allow that third party access to 
education records for at least five years.

Health or Safety Emergency (Sec.  99.36)

    Comment: We received many comments in support of our proposal to 
amend Sec.  99.36 regarding disclosures of personally identifiable 
information without consent in a health or safety emergency. Most of 
the parties that commented stated that the proposed changes 
demonstrated the right balance between student privacy and campus 
safety. A number of commenters specifically supported the clarification 
regarding the disclosure of information from an eligible student's 
education records to that student's parents when a health or safety 
emergency occurs. One commenter said that the proposed amendment would 
provide appropriate protection for sensitive and otherwise protected 
information while clarifying that educational agencies and institutions 
may notify parents and other appropriate individuals in an emergency so 
that they may intervene to help protect the health and safety of those 
involved.
    Discussion: We appreciate the commenters' support for the 
amendments to the ``health or safety emergency'' exception in Sec.  
99.36(b). Educational agencies and institutions are permitted to 
disclose personally identifiable information from students' education 
records, without consent, under Sec.  99.31(a)(10) in connection with a 
health or safety emergency. Disclosures under Sec.  99.31(a)(10) must 
meet the conditions described in Sec.  99.36. We address specific 
comments

[[Page 74837]]

about the proposed amendments to this exception in the following 
paragraphs.
    Changes: None.

(a) Disclosure in Non-Emergency Situations

    Comment: Some commenters suggested that we interpret Sec.  99.36 to 
permit the sharing of information on reportable diseases to health 
officials in non-emergency situations. These commenters stated that the 
disclosure of routine immunization data should be subject to State, 
local, and regional public health laws and regulations and not FERPA. 
One of these commenters noted that the HIPAA Privacy Rule allows 
covered entities to disclose personally identifiable health data, 
without consent, to public health authorities.
    Discussion: There is no authority in FERPA to exclude students' 
immunization records from the definition of education records in FERPA. 
Further, the HIPAA Privacy Rule specifically excludes from coverage 
health care information that is maintained as an ``education record'' 
under FERPA. 45 CFR 160.103, Protected health information. We 
understand that the HIPAA Privacy Rule allows covered entities to 
disclose identifiable health data without written consent to public 
health authorities. However, there is no statutory exception to the 
written consent requirement in FERPA to permit this type of disclosure.
    As explained in the preamble to the NPRM (73 FR 15589), the 
amendment to the health or safety emergency exception in Sec.  99.36 
does not allow disclosures on a routine, non-emergency basis, such as 
the routine sharing of student information with the local police 
department. Likewise, this exception does not cover routine, non-
emergency disclosures of students' immunization data to public health 
authorities. Consequently, there is no statutory basis for the 
Department to revise the regulatory language as requested by the 
commenters.
    Changes: None.

(b) Strict Construction Standard

    Comment: Several commenters expressed concern that removing the 
language from current Sec.  99.36 requiring strict construction of the 
``health and safety emergency'' exception and substituting the language 
providing for a ``rational basis'' standard would not require schools 
to make an individual assessment to determine if there is an emergency 
that warrants a disclosure. One commenter stated that removal of the 
``strict construction'' requirement would severely weaken the 
Department's enforcement capabilities and that schools may see this 
change as an excuse to disclose sensitive student information when 
there is not a real emergency.
    A commenter stated that the removal of the ``strict construction'' 
requirement would mean that the Department would eliminate altogether 
its review of actions taken by schools under the health and safety 
emergency exception. Another commenter stated that removing the 
requirement that this exception be strictly construed could erode the 
privacy rights of individuals. The commenter noted that because parents 
and eligible students cannot bring suit in court to enforce FERPA, 
schools face virtually no liability if they violate FERPA requirements.
    A commenter asked that the Department clarify what is meant by an 
``emergency'' and how severe a concern must be to qualify as an 
emergency.
    Discussion: Section 99.36(c) eliminates the previous requirement 
that paragraphs (a) and (b) of this section be ``strictly construed'' 
and provides instead that, in making a determination whether a 
disclosure may be made under the ``health or safety emergency'' 
exception, an educational agency or institution may take into account 
the totality of the circumstances pertaining to a threat to the health 
or safety of a student or other individuals. The new provision states 
that if there is an articulable and significant threat to the health or 
safety of the student or other individuals, an educational agency or 
institution may disclose information to appropriate parties.
    As we indicated in the preamble to the NPRM, we believe paragraph 
(c) provides greater flexibility and deference to school administrators 
so they can bring appropriate resources to bear on a circumstance that 
threatens the health or safety of individuals. 73 FR 15574, 15589. In 
that regard, paragraph (c) provides that the Department will not 
substitute its judgment for that of the agency or institution if, based 
on the information available at the time of the determination there is 
a rational basis for the agency's or institution's determination that a 
health or safety emergency exists and that the disclosure was made to 
appropriate parties.
    We do not agree that removal of the ``strict construction'' 
standard weakens FERPA or erodes privacy protections. Rather, the 
changes appropriately balance the important interests of safety and 
privacy by providing school officials with the flexibility to act 
quickly and decisively when emergencies arise. Schools should not view 
FERPA's ``health or safety emergency'' exception as a blanket exception 
for routine disclosures of student information but as limited to 
disclosures necessary to protect the health or safety of a student or 
another individual in connection with an emergency.
    After consideration of the comments, we have determined that 
educational agencies and institutions should be required to record the 
``articulable and significant threat to the health or safety of a 
student or other individuals'' so that they can demonstrate (to 
parents, students, and to the Department) what circumstances led them 
to determine that a health or safety emergency existed and how they 
justified the disclosure. Currently, educational agencies and 
institutions are required under Sec.  99.32(a) to record any disclosure 
of personally identifiable information from education records made 
under Sec.  99.31(a)(10) and Sec.  99.36. We are revising the 
recordation requirements in Sec.  99.32(a)(5) to require an agency or 
institution to record the articulable and significant threat that 
formed the basis for the disclosure. The school must maintain this 
record with the education records of the student for as long as the 
student's education records are maintained (Sec.  99.32(a)(2)).
    We do not specify in the regulations a time period in which an 
educational agency or institution must record a disclosure of 
personally identifiable information from education records under Sec.  
99.32(a). We interpret this to mean that an agency or institution must 
record a disclosure within a reasonable period of time after the 
disclosure has been made, and not just at the time, if any, when a 
parent or student asks to inspect the student's record of disclosures. 
We will treat the requirement to record the significant and articulable 
threat that forms the basis for a disclosure under the health or safety 
emergency exception no differently than the recordation of other 
disclosures. In determining whether a period of time for recordation is 
reasonable, we would examine the relevant facts surrounding the 
disclosure and anticipate that an agency or institution would address 
the health or safety emergency itself before turning to recordation of 
any disclosures and other administrative matters.
    In response to concerns about the Department's enforcement of the 
provisions of Sec.  99.36, the ``rational basis'' test does not 
eliminate the Department's responsibility for oversight and 
accountability. Actions that the Secretary may take in addressing 
violations of this and other

[[Page 74838]]

FERPA provisions are addressed in the analysis of comments under the 
section in this preamble entitled Enforcement. While parents and 
eligible students do not have a right to sue for violations of FERPA in 
a court of law, the statute provides that the Secretary may not make 
funds available to any agency or institution that has a policy or 
practice of violating parents' and students' rights under the statute 
with regard to consent to the disclosure of education records. As such, 
parents and eligible students may file a complaint with the Office if 
they believe that a school has violated their rights under FERPA and 
has disclosed education records under Sec.  99.36 inconsistent with 
these regulations. In conducting an investigation, the Office will 
require that schools identify the underlying facts that demonstrated 
that there was an articulable and significant threat precipitating the 
disclosure under Sec.  99.36.
    In response to the comment about what would constitute an 
emergency, FERPA permits disclosure ``* * * in connection with an 
emergency * * * to protect the health or safety of the student or other 
persons.'' 20 U.S.C. 1232g(b)(1)(I). We note that the word ``protect'' 
generally means to keep from harm, attack, or injury. As such, the 
statutory text underscores that the educational agency or institution 
must be able to release information from education records in 
sufficient time for the institution to act to keep persons from harm or 
injury. Moreover, to be ``in connection with an emergency'' means to be 
related to the threat of an actual, impending, or imminent emergency, 
such as a terrorist attack, a natural disaster, a campus shooting, or 
the outbreak of an epidemic such as e-coli. An emergency could also be 
a situation in which a student gives sufficient, cumulative warning 
signs that lead an educational agency or institution to believe the 
student may harm himself or others at any moment. It does not mean the 
threat of a possible or eventual emergency for which the likelihood of 
occurrence is unknown, such as would be addressed in emergency 
preparedness activities.
    Changes: We have amended the recordkeeping requirements in Sec.  
99.32(a)(5) to require educational agencies and institutions to record 
the articulable and significant threat that formed the basis for a 
disclosure under the health or safety emergency exception and the 
parties to whom the information was disclosed.

(c) Articulable and Significant Threat

    Comment: One commenter stated that the word ``articulable'' in 
Sec.  99.36(c) was confusing in reference to a school's determination 
that there is an ``articulable and significant threat to the health or 
safety of a student or other individuals.'' This commenter stated that 
school officials might interpret the provision to mean that there must 
be a verbal threat or that school officials must write down the exact 
wording of the threat.
    Discussion: The requirement that there must be an ``articulable and 
significant threat'' does not mean that the threat must be verbal. It 
simply means that the institution must be able to articulate what the 
threat is under Sec.  99.36 when it makes and records the disclosure.
    In that regard, the words ``articulable and significant'' are 
adjectives modifying the key noun ``threat.'' As such, the focus is on 
the threat, with the question being whether the threat itself is 
articulable and significant. The word ``articulable'' is defined to 
mean ``capable of being articulated.'' http://www.merriam-webster.com/dictionary/articulable. This portion of the standard simply requires 
that a school official be able to express in words what leads the 
official to conclude that a student poses a threat. The other half of 
the standard is the word ``significant,'' which means ``of a noticeably 
or measurably large amount.'' http://www.merriam-webster.com/dictionary/significant. Taken together, the phrase ``articulable and 
significant threat'' means that if a school official can explain why, 
based on all the information then available, the official reasonably 
believes that a student poses a significant threat, such as a threat of 
substantial bodily harm, to any person, including the student, the 
school official may disclose education records to any person whose 
knowledge of information from those records will assist in protecting a 
person from that threat.
    Changes: None.

(d) Parties That May Receive Information Under Sec.  99.36

    Comment: A commenter recommended that the Department adopt a more 
subjective standard regarding the persons to whom education records may 
be disclosed under Sec.  99.36, suggesting that we remove the 
requirement that the disclosure must be to a person ``whose knowledge 
of the information is necessary to protect the health or safety of the 
student or other individuals.'' Conversely, another commenter expressed 
concern that the Department was sending the wrong message to 
educational agencies and institutions with these changes to Sec.  
99.36. The commenter stated that the health or safety emergency 
exception must not be perceived to permit schools to routinely disclose 
education records to parents, police, or others.
    A commenter asked who at a school may share personally identifiable 
information in a health or safety emergency, and specifically whether a 
school secretary would be allowed to tell parents that a student on 
campus made a threat to others.
    A commenter stated that school districts, especially small or rural 
districts, may not have the expertise on staff to determine whether a 
situation constitutes an ``articulable and significant threat.'' The 
commenter said that personally identifiable information on students may 
need to be disclosed to outside law enforcement and mental health 
professionals so that they can help schools determine whether a real 
threat exists. The commenter recommended that the Department change the 
proposed regulations to allow school districts to involve outside 
experts in determining whether a health or safety emergency exists. 
Noting that the NPRM addressed the disclosure of education records to 
an eligible student's parents, the organization also asked for 
clarification regarding whether the parents of a potential perpetrator 
and the potential victim at the K-12 level could be told about a 
threat.
    Several commenters stated that our proposed amendments did not go 
far enough and urged the Department to expand Sec.  99.36 to permit a 
school to notify whomever the student has listed as his or her 
emergency contact. Another commenter requested that the Secretary, 
through these regulations, direct institutions to proactively notify 
parents of students who are in acute care situations, such as illness 
or accidents, if any institutional official is aware of the emergency.
    Discussion: On its face, FERPA permits disclosure to ``appropriate 
persons if the knowledge of such information is necessary to protect 
the health or safety of the student or other persons.'' 20 U.S.C. 
1232g(b)(1)(I). FERPA does not require that the person receiving the 
information be responsible for providing the protection. Rather, the 
focus of the statutory provision is on the information itself: The 
``health or safety emergency'' exception permits the institution to 
disclose information from education records in order to gather 
information from any person who has information that would be necessary 
to

[[Page 74839]]

provide the requisite protection. Thus, for example, an educational 
institution that reasonably believes that a student poses a threat of 
bodily harm to any person may disclose information from education 
records to current or prior peers of the student or mental health 
professionals who can provide the institution with appropriate 
information to assist in protecting against the threat. Moreover, the 
institution may disclose records to persons such as law enforcement 
officials that it determines may be helpful in providing appropriate 
protection from the threat. An educational agency or institution may 
also generally disclose information under Sec.  99.36 to a potential 
victim and the parents of a potential victim as ``other individuals'' 
whose health or safety may need to be protected.
    Similarly, in order to obtain information that would inform its 
judgment on how to address the threat, the student's current 
institution may disclose information from education records to other 
schools or institutions which the student previously attended. In that 
regard, the same set of facts underlying the current institution's 
determination that an emergency existed would also permit former 
schools and institutions attended by the student to disclose personally 
identifiable information from education records to the student's 
current institution. That is, a former school would not need to make a 
separate determination regarding the existence of an articulable and 
significant threat to the health or safety of a student or others, and 
could rely instead on the determination made by the school currently 
attended by the student in making the disclosure.
    In the discussion on page 15589 of the NPRM, we noted that the 
``health or safety emergency'' exception does not permit a local school 
district to routinely share its student information database with the 
local police department. This example was meant to clarify that FERPA's 
health or safety provisions would not permit a school to disclose 
without consent education records to the local police department unless 
there was a health or safety emergency and the disclosure of the 
information was necessary to protect the health or safety of students 
or other individuals. This does not prevent schools from having working 
relationships with local police authorities and to use local police 
officers in maintaining the safety of their campuses.
    In response to the comment about which school official should be 
permitted to disclose information under Sec.  99.36, an educational 
agency or institution will need to make its own determination about 
which school officials may access a student's education records and 
disclose information to parents or other parties whose knowledge of the 
information is necessary to protect the health or safety of the student 
or other individuals. Under Sec.  99.31(a)(1), an educational agency or 
institution may disclose education records, without consent, to school 
officials whom the agency or institution has determined have legitimate 
educational interests in the information. It may be helpful for schools 
to have a policy in place concerning which school officials will have 
access to and the responsibility for disclosing information in 
emergency situations.
    We understand that some educational agencies and institutions may 
need assistance in determining whether a health or safety emergency 
exists for purposes of complying with these regulations. The Department 
encourages schools to implement a threat assessment program, including 
the establishment of a threat assessment team that utilizes the 
expertise of representatives from law enforcement agencies in the 
community. Schools can respond to student behavior that raises concerns 
about a student's mental health and the safety of the student and 
others that is chronic or escalating by using a threat assessment team, 
and then make other disclosures under the health or safety emergency 
exception, as appropriate, when an ``articulable and significant 
threat'' exists. Information on establishing a threat assessment 
program and other helpful resources for emergency situations can be 
found on the Department's Web site: http://www.ed.gov/admins/lead/safety/edpicks.jhtml?src=ln.
    An educational agency or institution may disclose education records 
to threat assessment team members who are not employees of the district 
or institution if they qualify as ``school officials'' with 
``legitimate educational interests'' under Sec.  99.31(a)(1)(i)(B), 
which is discussed elsewhere in this preamble. To receive the education 
records under the ``school officials'' exception, members of the threat 
assessment team must be under the direct control of the educational 
agency or institution with respect to the maintenance and use of 
personally identifiable information from education records. For 
example, a representative from the city police who serves on a school's 
threat assessment team generally could not redisclose to the city 
police personally identifiable information from a student's education 
records to which he or she was privy as part of the team. As noted 
above, however, the institution may disclose personally identifiable 
information from education records when and if the threat assessment 
team determines that a health or safety emergency exists under 
Sec. Sec.  99.31(a)(10) and 99.36.
    We believe that Sec.  99.36 does not need to be expanded to permit 
a school to contact whomever an eligible student has listed as his or 
her emergency contact, nor is there authority to do so. FERPA does not 
preclude institutions from contacting other parties, including parents, 
in addition to the emergency contacts provided by the student, if the 
school determines these other parties are ``appropriate parties'' under 
this exception. (An eligible student may provide consent for the 
institution to notify certain individuals in case of an emergency, 
should an emergency occur.)
    The regulations would not prevent an institution from having a 
policy of seeking prospective consent from eligible students for the 
disclosure of personally identifiable information or from having a 
policy for obtaining consent for disclosure on a case-by-case basis. 
However, FERPA does not require that a postsecondary institution 
disclose information to any party except to the eligible student, even 
if the student has consented to the disclosure. Thus, the Secretary 
does not have the statutory authority to require school officials to 
disclose information from a student's education records in compliance 
with a consent signed by the student or to otherwise require the 
institution to contact a family member.
    Changes: None.

(e) Treatment Records

    Comment: A commenter stated that while the amendments to Sec.  
99.36 provide needed clarification about when an educational agency or 
institution may disclose students' education records to avert tragedies 
like the one at Virginia Tech in April 2007, the NPRM did not provide 
clarity on the issue of information sharing between on-campus and off-
campus health care providers. The commenter also noted that the 
Virginia Tech Review Panel recommended that Congress amend FERPA to 
explain how Federal privacy laws apply to medical records held for 
treatment purposes and that the NPRM did not provide that clarity.
    Another commenter stated that if information about a student 
related to a health or safety emergency is part of the treatment 
records maintained by a university's health clinic, the treatment 
records should be treated like education

[[Page 74840]]

records so that they may be disclosed under the health and safety 
emergency exception. A commenter asked that the Department clarify that 
college health and mental health records are not education records 
under FERPA and must be treated like other health and mental health 
records in other settings.
    Discussion: While we have carefully considered the comments 
concerning ``treatment records,'' the Secretary does not believe that 
it is necessary to amend the regulations to provide clarification on 
the handling of health and medical records. The Departments of 
Education and Health and Human Services have issued joint guidance that 
explains the relationship between FERPA and the HIPAA Privacy Rule. The 
guidance addresses this issue for these records at the elementary and 
secondary levels, as well as at the postsecondary level. The joint 
guidance, which is on the Web sites of both agencies, addresses many of 
the questions raised by school administrators, health care 
professionals, and others as to how these two laws apply to records 
maintained on students. It also addresses certain disclosures that are 
allowed without consent or authorization under both laws, especially 
those related to health and safety emergency situations. The guidance 
can be found here: http://www.ed.gov/policy/gen/guid/fpco/index.html.
    As discussed elsewhere in this preamble with respect to Sec.  
99.31(a)(2), while ``treatment records'' are excluded from the 
definition of education records under FERPA, if an eligible student's 
treatment records are used for any purpose other than the student's 
treatment, or if a school wishes to disclose the treatment records for 
any purpose other than the student's treatment, they may only be 
disclosed as education records subject to FERPA requirements. 
Therefore, an eligible student's treatment records may be disclosed to 
any party, without consent, as long as the disclosure meets one of the 
exceptions to FERPA's general consent rule. See 34 CFR 99.31. One of 
the permitted disclosures under this section is the ``health or safety 
emergency'' exception.
    Changes: None.

Identification and Authentication of Identity (Sec.  99.31(c))

    Comment: Several commenters supported our proposal to require 
educational agencies and institutions to use reasonable methods to 
identify and authenticate the identity of parents, students, school 
officials, and any other parties to whom the agency or institution 
discloses personally identifiable information from education records. 
One commenter supported the provision but advocated requiring the use 
of two-factor identification for information that could be used to 
commit identity theft and financial fraud. (Two-factor identification 
requires the use of two methods to authenticate identity, such as 
fingerprint identification in addition to a PIN.)
    One commenter said that the identification and authentication 
requirement will help protect students affected by domestic violence 
who are living in substitute care situations. The commenter noted that 
many parents in situations involving domestic violence do not have 
photo identification (ID) and would be unable to meet a requirement to 
provide photo ID in order to access their children's education records.
    One commenter strongly supported the proposed amendment and said it 
will be valuable in aiding the privacy and protection of homeless 
children. Another commenter questioned whether the identification and 
authentication requirement is necessary for staff of large school 
districts with centralized offices.
    One commenter did not support the proposed regulation stating that 
it will be an additional burden on school districts. The commenter 
agreed with our statement in the preamble to the NPRM that the 
regulations should permit districts to determine their own methods of 
identification and authentication. However, the commenter stated that 
districts should not be required to have a sliding scale of control 
based on the level of potential threat and harm and that it would not 
be practical to give every person requesting access to education 
records a PIN or similar method of authentication. For example, the 
commenter stated that parents might be provided with a PIN, but 
districts would not want to provide a PIN to a reporter or other third 
party. The commenter requested additional examples of how districts may 
authenticate requests received by phone or e-mail. The commenter also 
stated that districts are sometimes concerned that government-issued 
photo IDs are fraudulent. As a result, the group requested that the 
Department adopt a ``safe harbor'' provision that requiring a 
government-issued photo ID for in-person requests is reasonable.
    One commenter expressed concern that the proposed regulations were 
too restrictive and could be too complex to administer, and that this 
would cause an institution to choose not to transfer information even 
though it is permitted to do so. This commenter asked whether the 
Department will accept an institution's efforts at compliance as 
sufficient without examining the effectiveness of those efforts.
    Discussion: The identification and authentication methods discussed 
in the NPRM (73 FR 15585) are intended as examples and should not be 
considered to be exhaustive. Because there are many methods available 
to provide secure authentication of identity, and as more methods 
continue to be developed, we do not think it appropriate at this time 
to require the use of two-factor authentication as requested by the 
commenter. Two-factor authentication can be expensive and cumbersome, 
and we believe that each educational agency or institution should 
decide whether to use its resources to implement a two-factor 
authentication method or another reasonable method to ensure that 
education records are disclosed only to an authorized party. The 
comment that a portion of the population will be disadvantaged if only 
photo ID is permitted to authenticate identity confirms that we need to 
retain flexibility in the regulations.
    We do not agree that certain types of staff should be excepted from 
the identification and authentication requirement. All staff members, 
whether in a centralized office, or in separate administrative offices 
throughout a school system, must be cognizant of and responsible for 
complying with identification and authentication requirements.
    Due to the differences in size, complexity, and access to 
technology, we believe that educational agencies and institutions 
should have the flexibility to decide the methods for identification 
and authentication of identity best suited to their own circumstances. 
The regulatory requirement is that agencies and institutions use 
``reasonable'' methods to identify and authenticate identity when 
disclosing personally identifiable information from education records. 
``Effectiveness'' is certainly one measure, but not necessarily a 
dispositive measure, of whether the methods used by an agency or 
institution are ``reasonable''. As we explained in the NPRM, an agency 
or institution is not required to eliminate all risk of unauthorized 
disclosure of education records but to reduce that risk to a level 
commensurate with the likely threat and potential harm. 73 FR 15585.
    Further in that regard, we note that a ``sliding scale'' of 
protection is not mandated per se. However, it may not be 
``reasonable'' to use the same

[[Page 74841]]

methods to protect students' SSNs or credit card numbers from 
unauthorized access and disclosure that are used to protect students' 
names and other directory information. We believe that a PIN process 
could be useful to provide access to education records for parties, 
such as parents, students, or school officials, but that it would not 
generally be useful for providing records to outside parties, such as 
reporters or parties seeking directory information. While the use of 
government-issued photo ID may be a reasonable method to authenticate 
identity, depending on the circumstances and the information being 
released, we are unable to conclude at this time that it is 
sufficiently secure to constitute a safe harbor for meeting this 
requirement.
    Changes: None.

Enforcement (Sec.  99.64)

(a) Sec.  99.64(a)

    Comment: One commenter supported our proposal to amend Sec.  
99.64(a) to provide that a complaint submitted to FPCO does not have to 
allege that a violation or failure to comply with FERPA is based on a 
policy or practice of the agency or institution. The commenter stated 
that parents often are not aware of legal and technical criteria, and 
complaints filed by parents should not be subject to technical rules 
typically applied to filings made by attorneys.
    Another commenter did not support the proposed amendment and asked 
several questions concerning the effects of the change. The commenter 
asked whether this provision means that the Office will investigate an 
allegation concerning a single and perhaps unintentional action not 
related to a policy or practice of the institution. The commenter also 
asked whether such an investigation could result in a finding of a 
violation if the finding is not based on an institution's policy or 
practice, and what enforcement actions can be taken in those 
circumstances. The commenter suggested that we modify the regulations 
to provide that, for complaints not alleging a violation based on an 
institution's policy or practice, the Office will undertake an 
investigation only when it determines that the allegations are of a 
sufficiently serious nature to warrant an inquiry.
    Discussion: The changes we proposed in this section were intended 
to clarify that it is sufficient for a complaint to allege that an 
educational agency or institution violated a requirement of FERPA, and 
that a complaint does not need to allege that the violation is a result 
of a policy or practice of an agency or institution in order for the 
Office to investigate the complaint.
    We explain in our discussion of the proposed changes to Sec.  99.67 
that the Secretary must find that an educational agency or institution 
has a policy or practice in violation of the non-disclosure 
requirements in FERPA before seeking to withhold, terminate, or recover 
program funds for that violation. However, FPCO is not limited to 
investigating complaints and finding that an educational agency or 
institution violated FERPA only if the allegations and findings are 
based on a policy or practice of an educational agency or institution.
    Moreover, we do not agree that only conduct that involves a policy 
or practice or that affects multiple students is serious enough to 
warrant an investigation of the allegations. An educational agency or 
institution may not even be aware of FERPA violations committed by its 
own school officials until the Office investigates an allegation of 
misconduct. These kinds of investigations often serve the very 
important purpose of helping ensure that single instances of misconduct 
do not become policies or practices of an agency or institution. 
Further, while an agency or institution may not think that a single, 
unintentional violation of FERPA is significant, it is often considered 
serious by the parent or student affected by the violation.
    Therefore, consistent with its current practice, the Office may 
find that an educational agency or institution violated FERPA without 
also finding that the violation was based on a policy or practice. Note 
that under Sec. Sec.  99.66(c) and 99.67, the Office may not take any 
enforcement action against an agency or institution that has violated 
FERPA until it provides the agency or institution with a reasonable 
period of time to come into compliance voluntarily.
    Changes: None.

(b) Sec.  99.64(b)

    Comment: A number of commenters supported proposed Sec.  99.64(b), 
which provided that the Office may investigate a possible FERPA 
violation even if it has not received a timely complaint from a parent 
or student or if a valid complaint is subsequently withdrawn. Several 
of these commenters stated that it is appropriate and important to 
permit persons who are not parents or eligible students, but who have 
knowledge of potential FERPA violations, to provide this information to 
the Office for consideration of a possible investigation.
    Several commenters objected to the proposed change. One commenter 
expressed serious concern that the regulations will greatly expand the 
authority of the Office to investigate any potential FERPA violation, 
even when no complaint is filed or when a complaint has been withdrawn. 
In particular, the commenter stated that an institution would not have 
an opportunity to review and respond to specific allegations when the 
investigation does not concern a particular complaint.
    Another commenter asserted that the Department has not demonstrated 
why the proposed amendment is necessary. The commenter said that unless 
there is evidence of a widespread problem, the proposed change will 
increase university costs in responding to investigations without a 
corresponding benefit to the public.
    Another commenter said that the Office should not investigate 
allegations that are not filed by a parent or eligible student because 
an institution must know the name of the filing party and the specific 
circumstances of the allegation in order to properly defend its 
actions. The commenter said that it should not be unnecessarily 
burdened by an investigation by the Office when it has already dealt 
with the situation to the satisfaction of the affected student, and 
that any student who is not satisfied with the institution's efforts 
retains the ability to file a complaint. The commenter also noted that 
a complaint filed by an affected student has more credibility than 
allegations made by other parties. The commenter was concerned that 
accepting information from other parties could result in filings from 
persons with grievances unrelated to FERPA, such as a disgruntled 
employee, or an applicant rejected for admission, or a parent or 
eligible student who missed a filing deadline of some kind.
    One commenter said that the proposed change would result in an 
ineffective use of the limited resources of the Office because it would 
be investigating allegations that may not have a sufficient basis.
    Discussion: We proposed the changes to Sec.  99.64(b) to clarify 
that the Office may initiate its own investigation that an educational 
agency or institution has violated FERPA. (The amendment also clarifies 
that if the Office determines that an agency or institution violated 
FERPA, it may also determine whether the violation was based on a 
policy or practice of the agency or institution.)
    Our experience has shown that sometimes FERPA violations are 
brought to the attention of the Office by

[[Page 74842]]

school officials, officials in other schools, or by the media. It is 
important that the Office have authority to investigate allegations of 
non-compliance in these situations. Consistent with its current 
practice, a notice of investigation issued by the Office will provide 
sufficient and specific factual information to permit the agency or 
institution to adequately investigate and respond to the allegations, 
whether or not the investigation is based on a complaint by a parent or 
eligible student.
    We do not agree that allowing the Office to initiate its own 
investigations of possible FERPA violations will lead to abuses of the 
process by persons seeking to redress other grievances with an 
institution. The Office will continue to be responsible for evaluating 
the validity of the information and allegations that come to its 
attention by means other than a valid complaint and determining whether 
to initiate an investigation. We do not anticipate that the Office will 
initiate an investigation of every allegation or information it 
receives. We believe, however, that it is important that the Office be 
able to investigate any violation of FERPA for which it receives 
notice. As stated in the NPRM, 73 FR 15591, the Department is not 
seeking to expand the scope of FERPA investigations beyond the current 
practices of the Office.
    Changes: None.

(c) Sec.  99.66

    Comment: We received one comment on the proposed change to Sec.  
99.66(c), which allows but does not require FPCO to make a finding that 
an educational agency or institution has a policy or practice in 
violation of a FERPA requirement when the Office issues a notice of 
findings in Sec.  99.66(b). The commenter stated that its review of 
FERPA and the Supreme Court decision in Gonzaga University v. Doe, 536 
U.S. 273 (2002) (Gonzaga), indicates that the Office may not issue a 
finding of a violation of FERPA and require corrective action or take 
any enforcement action without also finding that the violation 
constituted a policy or practice of the agency or institution.
    Discussion: We explain in the discussion of the changes to Sec.  
99.67 that there are circumstances in which the Office would be 
required to find that an educational agency or institution has a policy 
or practice in violation of a FERPA requirement before taking certain 
enforcement actions, such as an action to terminate funding for a 
violation of the non-disclosure requirements, 20 U.S.C. 1232g(b)(1) and 
(b)(2) and 34 CFR 99.30. However, the Office is not required to find a 
policy or practice in violation of FERPA before issuing a notice of 
findings or taking other kinds of enforcement actions.
    Changes: None.

(d) Sec.  99.67

    Comment: One commenter supported the clarification in proposed 
Sec.  99.67 that the Office may not seek to withhold payments, 
terminate eligibility for funding, or take certain other enforcement 
actions unless it determines that the educational agency or institution 
has a policy or practice that violates FERPA. Another commenter 
expressed general support for the proposed change, including the 
clarification that the Secretary may take any legally available 
enforcement action, in addition to those specifically listed in the 
current regulations. The commenter expressed concern, however, that the 
penalties are not severe enough to effectively discourage unintentional 
or willful violations by third parties, particularly in areas of 
research and data sharing with outside parties.
    Another commenter expressed concern that the proposed amendment 
would unnecessarily broaden the enforcement options available to the 
Secretary. The commenter stated that educational agencies and 
institutions will not be able to assess the risks and consequences 
associated with their actions without a limitation on the range of 
enforcement actions available to the Department when a violation of 
FERPA is found.
    One commenter asked the Department to clarify that all methods of 
enforcing FERPA that are contained in the current regulations will be 
retained in the final regulations. The commenter said that the proposed 
regulations in the NPRM (73 FR 15602) appear to remove the Secretary's 
ability to terminate funding.
    Discussion: We explained in the preamble to the NPRM (73 FR 15592) 
that there were two reasons for the proposed changes to Sec.  99.67(a). 
One was the need to clarify that the Secretary may take any enforcement 
action that is legally available and is not limited to those specified 
under the current regulations, i.e., withholding further payments under 
any applicable program; issuing a complaint to compel compliance 
through a cease-and-desist order; or terminating eligibility to receive 
funding under any applicable program. Other actions the Secretary may 
take to enforce FERPA include entering into a compliance agreement 
under 20 U.S.C. 1234f and seeking an injunction.
    This change to Sec.  99.67(a) does not broaden the Secretary's 
enforcement options, as suggested by one commenter. The General 
Education Provisions Act (GEPA) provides the Secretary with the 
authority to take certain enforcement actions to address violations of 
statutory and regulatory requirements, including general authority to 
``take any other action authorized by law with respect to the 
recipient.'' 20 U.S.C. 1234c(a)(4). The change to Sec.  99.67(a) simply 
includes, for purposes of clarity, the Secretary's existing authority 
under GEPA to take any legally available action to enforce FERPA 
requirements. (We note that before taking enforcement action the Office 
must determine that the educational agency or institution is failing to 
comply substantially with a FERPA requirement and provide it with a 
reasonable period of time to comply voluntarily. See 20 U.S.C. 
1234c(a); 20 U.S.C. 1232g(f); and 34 CFR 99.66(c).)
    We also proposed to amend Sec.  99.67(a) to clarify that the Office 
may issue a notice of violation for failure to comply with specific 
FERPA requirements and require corrective actions but may not seek to 
terminate eligibility for funding, withhold payments, or take other 
enforcement actions unless the Office determined that an agency or 
institution has a policy or practice in violation of FERPA requirements 
(73 FR 15592). Upon further review, we have decided not to adopt this 
particular change because we believe it limits the Secretary's 
enforcement authority in a manner that is not legally required.
    In support of its holding in Gonzaga that FERPA's non-disclosure 
provisions do not create rights that are enforceable under 42 U.S.C. 
1983, the Court observed that FERPA provides that no funds shall be 
made available to an educational agency or institution that has a 
policy or practice of disclosing education records in violation of 
FERPA requirements. 536 U.S. at 288; see also 20 U.S.C. 1232g(b)(1) and 
(b)(2); 34 CFR 99.30. As such, the statute and Gonzaga decision suggest 
that with respect to violations of FERPA's non-disclosure requirements, 
the Secretary must find that an educational agency or institution has a 
policy or practice in violation of FERPA requirements before taking 
actions to terminate, withhold, or recover funds for those violations. 
However, there is no requirement under the statute (or the Gonzaga 
decision) for the Secretary to find a policy or practice in violation 
of FERPA requirements on the part of an educational agency or 
institution before taking other kinds of enforcement actions for 
violations of the non-disclosure requirements, such as

[[Page 74843]]

seeking an injunction or a cease-and-desist order. We note also that 
the Gonzaga opinion does not address violations of other FERPA 
requirements, such as parents' right to inspect and review their 
children's education records and the requirement that educational 
agencies and institutions afford parents an opportunity for a hearing 
to challenge the content of a student's education records under certain 
circumstances, which do not contain the same ``policy or practice'' 
language as the non-disclosure requirements. Because we did not address 
enforcement of these other FERPA requirements in the NPRM, we have 
decided not to address in the final regulations limitations or pre-
conditions that apply solely to actions to terminate, withhold, or 
recover program funds for violations of the non-disclosure 
requirements.
    In response to the comment that the available penalties are not 
severe enough to discourage FERPA violations, we note that the 
Secretary has authority to terminate, withhold, and recover program 
funds and take other enforcement actions in accordance with part E of 
GEPA. The Secretary may not increase penalties beyond those authorized 
under FERPA and GEPA. Further, the regulations do not remove the 
Secretary's authority to terminate eligibility for program funding or 
any other enforcement authority. The changes noted by the commenter who 
was concerned that the proposed regulations removed the Secretary's 
authority to terminate funding were corrections to punctuation and 
formatting only, not substantive changes.
    Changes: We have removed the language in Sec.  99.67(a) that 
requires the Office to determine that an educational agency or 
institution has a policy or practice in violation of FERPA requirements 
before taking any enforcement action.

Department Recommendations for Safeguarding Education Records

    Comment: We received a few comments on the recommendations for 
safeguarding education records included in the NPRM. One commenter 
expressed concern that schools and school districts should exercise 
enhanced security for the records of children receiving special 
education services. According to the commenter, these children often 
have a large number of records and may receive services from a variety 
of providers, which can add to the challenge of ensuring that 
appropriate privacy controls are used.
    One commenter supported the safeguarding recommendations and 
suggested that we revise the recommendations to list non-Federal 
government sources providing guidance on methods for safeguarding 
education records. Another commenter supported the recommendations, but 
suggested that the regulations should require that a parent or eligible 
student receive notification of an unauthorized release or theft of 
information.
    Discussion: The comments on the records of students who receive 
special education services illustrate the necessity for educational 
agencies and institutions to ensure that adequate controls are in place 
so that the education records of all students are handled in accordance 
with FERPA's privacy protections. The safeguarding recommendations that 
we provided in the NPRM, and are repeated in these final regulations, 
are intended to provide agencies and institutions additional 
information and resources to assist them in meeting this 
responsibility. In addition, educational agencies and institutions 
should refer to the protections required under Sec.  300.623 of the 
confidentiality of information requirements in Part B of the IDEA, 34 
CFR 300.623 (Safeguards).
    We acknowledge that there are many sources available concerning 
information security technology and processes. The Department does not 
wish to appear to endorse the information or product of any company or 
organization; therefore, we have included only Federal government 
sources in this notice.
    The Department does not have the authority under FERPA to require 
that agencies or institutions issue a direct notice to a parent or 
student upon an unauthorized disclosure of education records. FERPA 
only requires that the agency or institution record the disclosure so 
that a parent or student will become aware of the disclosure during an 
inspection of the student's education record.
    Changes: None.
    We are republishing here, for the administrative convenience of 
educational agencies and institutions and other parties, the Department 
Recommendations for Safeguarding Education Records that were published 
in the preamble to the NPRM (73 FR 15598-15599):
    The Department recognizes that agencies and institutions face 
significant challenges in safeguarding educational records. We are 
providing the following information and recommendations to assist 
agencies and institutions in meeting these challenges.
    As noted elsewhere in this document, FERPA provides that no funds 
administered by the Secretary may be made available to any educational 
agency or institution that has a policy or practice of releasing, 
permitting the release of, or providing access to personally 
identifiable information from education records without the prior 
written consent of a parent or eligible student except in accordance 
with specified exceptions. In light of these requirements, the 
Secretary encourages educational agencies and institutions to utilize 
appropriate methods to protect education records, especially in 
electronic data systems.
    In recent years the following incidents have come to the 
Department's attention:
     Students' grades or financial information, including SSNs, 
have been posted on publicly available Web servers;
     Laptops and other portable devices containing similar 
information from education records have been lost or stolen;
     Education records, or devices that maintain education 
records, have not been retrieved from school officials upon termination 
of their employment or service as a contractor, consultant, or 
volunteer;
     Computer systems at colleges and universities have become 
favored targets because they hold many of the same records as banks but 
are much easier to access. See ``College Door Ajar for Online 
Criminals'' (May 2006), available at http://www.uh.edu/ednews/2006/latimes/200605/20060530hackers.html. and July 10, 2006, Viewpoint in 
Business Week/Online available at http://www.businessweek.com/technology/content/jul2006/tc20060710_558020.htm;
     Nearly 65 percent of postsecondary educational 
institutions identified theft of personal information (SSNs, credit/
debit/ATM card, account or PIN numbers, etc.) as a high risk area. See 
Table 7, Perceived Risks at http://www.educause.edu/ir/library/pdf/ecar_so/ers/ers0606/Ekf0606.pdf; and
     In December 2006, a large postsecondary institution 
alerted some 800,000 students and others that the campus computer 
system containing their names, addresses, and SSNs had been 
compromised.
    The Department's Office of Inspector General (OIG) noted in Final 
Inspection Alert Memorandum dated February 3, 2006, that the Privacy 
Rights Clearinghouse reported that between February 15, 2005, and 
November 19, 2005, there were 93 documented computer breaches of 
electronic files

[[Page 74844]]

involving personal information from education records such as SSNs, 
credit card information, and dates of birth. According to the reported 
data, 45 percent of these incidents have occurred at colleges and 
universities nationwide. OIG expressed concern that student information 
may be compromised due to a failure to implement or administer proper 
security controls for information systems at postsecondary 
institutions.
    The Department recognizes that no system for maintaining and 
transmitting education records, whether in paper or electronic form, 
can be guaranteed safe from every hacker and thief, technological 
failure, violation of administrative rules, and other causes of 
unauthorized access and disclosure. Although FERPA does not dictate 
requirements for safeguarding education records, the Department 
encourages the holders of personally identifiable information to 
consider actions that mitigate the risk and are reasonably calculated 
to protect such information. Of course, an educational agency or 
institution may use any method, combination of methods, or technologies 
it determines to be reasonable, taking into consideration the size, 
complexity, and resources available to the institution; the context of 
the information; the type of information to be protected (such as 
social security numbers or directory information); and methods used by 
other institutions in similar circumstances. The greater the harm that 
would result from unauthorized access or disclosure and the greater the 
likelihood that unauthorized access or disclosure will be attempted, 
the more protections an agency or institution should consider using to 
ensure that its methods are reasonable.
    One resource for administrators of electronic data systems is ``The 
National Institute of Standards and Technology (NIST) 800-100, 
Information Security Handbook: A Guide for Managers'' (October 2006). 
See http://csrc.nist.gov/publications/nistpubs/800-100/SP800-100-Mar07-2007.pdf. A second resource is NIST 800-53, Information Security, which 
catalogs information security controls. See http://csrc.nist.gov/publications/nistpubs/800-53-Rev1/800-53-rev1-final-clean-sz.pdf. 
Similarly, a May 22, 2007, memorandum to heads of Federal agencies from 
the Office of Management and Budget requires executive departments and 
agencies to ensure that proper safeguards are in place to protect 
personally identifiable information that they maintain, eliminate the 
unnecessary use of SSNs, and develop and implement a ``breach 
notification policy.'' This memorandum, although directed towards 
Federal agencies, may also serve as a resource for educational agencies 
and institutions. See http://www.whitehouse.gov/omb/memoranda/fy2007/m07-16.pdf.
    Finally, if an educational agency or institution has experienced a 
theft of files or computer equipment, hacking or other intrusion, 
software or hardware malfunction, inadvertent release of data to 
Internet sites, or other unauthorized release or disclosure of 
education records, the Department suggests consideration of one or more 
of the following steps:
     Report the incident to law enforcement authorities.
     Determine exactly what information was compromised, i.e., 
names, addresses, SSNs, ID numbers, credit card numbers, grades, and 
the like.
     Take steps immediately to retrieve data and prevent any 
further disclosures.
     Identify all affected records and students.
     Determine how the incident occurred, including which 
school officials had control of and responsibility for the information 
that was compromised.
     Determine whether institutional policies and procedures 
were breached, including organizational requirements governing access 
(user names, passwords, PINS, etc.); storage; transmission; and 
destruction of information from education records.
     Determine whether the incident occurred because of a lack 
of monitoring and oversight.
     Conduct a risk assessment and identify appropriate 
physical, technological, and administrative measures to prevent similar 
incidents in the future.
     Notify students that the Department's Office of Inspector 
General maintains a Web site describing steps students may take if they 
suspect they are a victim of identity theft at http://www.ed.gov/about/offices/list/oig/misused/idtheft.html; and http://www.ed.gov/about/offices/list/oig/misused/victim.html.
    FERPA does not require an educational agency or institution to 
notify students that information from their education records was 
stolen or otherwise subject to an unauthorized release, although it 
does require the agency or institution to maintain a record of each 
disclosure. 34 CFR 99.32(a)(1). (However, student notification may be 
required in these circumstances for postsecondary institutions under 
the Federal Trade Commission's Standards for Insuring the Security, 
Confidentiality, Integrity and Protection of Customer Records and 
Information (``Safeguards Rule'') in 16 CFR part 314.) In any case, 
direct student notification may be advisable if the compromised data 
includes student SSNs and other identifying information that could lead 
to identity theft.

Executive Order 12866

    Under Executive Order 12866, the Secretary must determine whether 
this regulatory action is ``significant'' and therefore subject to the 
requirements of the Executive Order and subject to review by OMB. 
Section 3(f) of Executive Order 12866 defines a ``significant 
regulatory action'' as an action likely to result in a rule that may 
(1) have an annual effect on the economy of $100 million or more, or 
adversely affect a sector of the economy, productivity, competition, 
jobs, the environment, public health or safety, or State, local or 
tribal governments, or communities in a material way (also referred to 
as an ``economically significant'' rule); (2) create serious 
inconsistency or otherwise interfere with an action taken or planned by 
another agency; (3) materially alter the budgetary impacts of 
entitlement grants, user fees, or loan programs or the rights and 
obligations of recipients thereof; or (4) raise novel legal or policy 
issues arising out of legal mandates, the President's priorities, or 
the principles set forth in the Executive order. The Secretary has 
determined that this regulatory action is significant under section 
3(f)(4) of the Executive order.

1. Summary of Public Comments

    The Department did not receive any comments on the analysis of the 
costs and benefits in the NPRM. However, since the publication of the 
NPRM, we have identified several information collection requirements 
that were not identified in the NPRM. We have added discussions of the 
costs and benefits of two information collection requirements in the 
following Summary of Costs and Benefits.

2. Summary of Costs and Benefits

    Following is an analysis of the costs and benefits of the most 
significant changes to the FERPA regulations. In conducting this 
analysis, the Department examined the extent to which the regulations 
add to or reduce the costs of educational agencies and institutions 
and, where appropriate, State educational agencies (SEAs) and other 
State and local educational authorities in relation to their costs of 
complying with the FERPA regulations prior to these changes.

[[Page 74845]]

    This analysis is based on data from the most recent Digest of 
Education Statistics (2007) published by the National Center for 
Education Statistics (NCES), which projects total enrollment for Fall 
2008 of 49,812,000 students in public elementary and secondary schools 
and 18,264,000 students in postsecondary institutions; and a total of 
97,382 public K-12 schools; 14,166 school districts; and 6,463 
postsecondary institutions. (Excluded are data from private 
institutions that do not receive Federal funding from the Department 
and, therefore, are not subject to FERPA.) Based on this analysis, the 
Secretary has concluded that the changes in these regulations will not 
impose significant net costs on educational agencies and institutions. 
Analyses of specific provisions follow.

Alumni Records

    The regulations in Sec.  99.3 clarify the current exclusion from 
the definition of education records for records that only contain 
information about an individual after he or she is no longer a student, 
which is intended to cover records of alumni and similar activities. 
Some institutions have applied this exclusion to records that are 
created after a student has ceased attending the institution but that 
are directly related to his or her attendance as a student, such as 
investigatory reports and settlement agreements about incidents and 
injuries that occurred during the student's enrollment. The amendment 
will clarify that this provision applies only to records created or 
received by an educational agency or institution after an individual is 
no longer a student in attendance and that are not directly related to 
the individual's attendance as a student.
    We believe that most of the more than 103,845 K-12 schools and 
postsecondary institutions subject to FERPA already adhere to this 
revised interpretation in the regulations and that for those that do 
not, the number of records affected is likely to be very small. 
Assuming that each year one half of one percent of the 68.1 million 
students enrolled in these institutions have one record each affected 
by the change, in the year following issuance of the regulations 
institutions will be required to try to obtain written consent before 
releasing 350,380 records that they would otherwise release without 
consent. We estimate that for the first year contacting the affected 
parent or student to seek and process written consent for these 
disclosures will take approximately one-half hour per record at an 
average cost of $32.67 per hour for a total cost of $5,562,068. 
(Compensation for administrative staff time is based on published 
estimates for 2005 from the Bureau of Labor Statistics' National 
Compensation Survey of $23.50 per hour plus an average 39 percent 
benefit load for Level 8 administrators in education and related 
fields.)
    In terms of benefits, the change will protect the privacy of 
parents and students by clarifying the intent of this regulatory 
exclusion and help prevent the unlawful disclosure of these records. It 
will also provide greater legal certainty and therefore some cost 
savings for those agencies and institutions that may be required to 
litigate this issue in connection with a request under a State open 
records act or other legal proceeding. For these reasons, we believe 
that the overall benefits outweigh the potential costs of this change.

Exclusion of SSNs and ID Numbers From Directory Information

    The proposed regulations in Sec.  99.3 clarified that a student's 
SSN or student ID number is personally identifiable information that 
may not be disclosed as directory information under FERPA. The final 
regulations allow an educational agency or institution to designate and 
disclose student ID numbers as directory information if the number 
cannot be used by itself to gain access to education records, i.e. , it 
is used like a name. SSNs may never be disclosed as directory 
information.
    The principal effect of this change is that educational agencies 
and institutions may not post grades by the student's SSN or non-
directory student ID number and may not include these identifiers with 
directory information they disclose about a student, such as a 
student's name, school, and grade level or class, on rosters, or on 
sign-in sheets that are made available to students and others. 
(Educational agencies and institutions may continue to include SSNs and 
non-directory student ID numbers on class rosters and schedules that 
are disclosed only to teachers and other school officials who have 
legitimate educational interests in this information.)
    A class roster or sign-in sheet that contains or requires students 
to affix their SSN or non-directory student ID number makes that 
information available to every individual who signs in or sees the 
document and increases the risk that the information may be improperly 
used for purposes such as identity theft or to find out a student's 
grades or other confidential educational information. In regard to 
posting grades, an individual who knows which classes a particular 
student attends may be able to ascertain that student's SSN or non-
directory student ID number by comparing class lists for repeat 
numbers. Because SSNs are not randomly generated, it may be possible to 
identify a student by State of origin based on the first three (area) 
digits of the number, or by date of issuance based on the two middle 
digits.
    The Department does not have any actual data on how many class or 
test grades are posted by SSN or non-directory student ID number at 
this time, but we believe that the practice is rare or non-existent 
below the secondary level. Although the practice was once widespread, 
particularly at the postsecondary level, anecdotal evidence suggests 
that as a result of consistent training and informal guidance by the 
Department over the past several years, together with the increased 
attention States and privacy advocates have given to the use of SSNs, 
many institutions now either require teachers to use a code known only 
to the teacher and the student or prohibit the posting of grades 
entirely.
    The most recent figures available from the Bureau of Labor 
Statistics (2007) indicate that there are approximately 2.7 million 
secondary and postsecondary teachers in the United States. As noted 
above, we assume that most of these teachers either do not post grades 
at all or already use a code known only to the teacher or student. We 
assume further that additional costs to deliver grades personally in 
the classroom or through electronic mail, instead of posting, will be 
minimal. For purposes of this analysis, we estimate that no more than 
five percent of 2.7 million, or 135,000 teachers, continue to post 
grades by SSN or non-directory student ID number and thus will need to 
convert to a code, which will require them to spend an average of one-
half hour each semester establishing and managing grading codes for 
students. Since we do not know how many teachers at either education 
level will continue to post grades, and wages for postsecondary 
teachers are higher than secondary teacher wages, we use postsecondary 
teacher wages to ensure that the estimate encompasses the upper limit 
of possible costs. Using the Bureau of Labor Statistics' published 
estimate of average hourly wages of $42.98 for teachers at 
postsecondary institutions and an average 39 percent load for benefits, 
we estimate an average cost of $59.74 per teacher per year, for a total 
of $8,064,900. Parents and students should incur no costs except for 
the time they might have to spend to

[[Page 74846]]

contact the school official if they forget the student's grading code.
    This change will benefit parents and students and educational 
agencies and institutions by reducing the risk of identity theft 
associated with posting grades by SSN, and the risk of disclosing 
grades and other confidential educational information caused by posting 
grades by a non-directory student ID number. It is difficult to 
quantify the value of reducing the risk of identity theft. According to 
the Federal Trade Commission, however, for the past few years over one-
third of complaints filed with that agency have been for identity 
theft. According to the Better Business Bureau, identity theft costs 
businesses nearly $57 billion in 2006, while victims spent an average 
of 40 hours resolving identity theft issues. It is even more difficult 
to measure the benefits of enhanced privacy protections for student 
grades and other confidential educational information from education 
records because the value individuals place on the privacy of this 
information varies considerably and because we are unable to determine 
how often it happens. Therefore, we have no basis to estimate the value 
of these enhanced privacy protections in relation to the expected costs 
to implement the changes.

Prohibit Use of SSN To Confirm Directory Information

    The regulations will prevent an educational agency or institution 
(or a contractor providing services for an agency or institution) from 
using a student's SSN (or other non-directory information) to identify 
the student when releasing or confirming directory information. This 
occurs, for example, when a prospective employer or insurance company 
telephones an institution or submits an inquiry through the 
institution's Web site to find out whether a particular individual is 
enrolled in or has graduated from the institution. While this provision 
will apply to educational agencies and institutions at all grade 
levels, we believe that it will affect mainly postsecondary 
institutions because K-12 agencies and institutions typically do not 
provide enrollment and degree verification services.
    A survey conducted in March 2002 by the American Association of 
Collegiate Registrars and Admissions Officers (AACRAO) showed that 
nearly half of postsecondary institutions used SSNs as the primary 
means to track students in academic databases. Since then, use of SSNs 
as a student identifier has decreased significantly in response to 
public concern about identity theft. While postsecondary institutions 
may continue to collect students' SSNs for financial aid and tax 
reporting purposes, many have ceased using the SSN as a student 
identifier either voluntarily or in compliance with State laws. Also, 
over the past several years the Department has provided training on 
this issue and published on the Office Web site a 2004 letter finding a 
postsecondary institution in violation of FERPA when its agent used a 
student's SSN, without consent, to search its database to verify that 
the student had received a degree. www.ed.gov/policy/gen/guid/fpco/ferpa/library/auburnuniv.html. Given these circumstances, we estimate 
that possibly one-quarter of the nearly 6,463 postsecondary 
institutions in the United States, or 1,616 institutions, may ask a 
requester to provide the student's SSN (or non-directory student ID 
number) in order to locate the record and respond to an inquiry for 
directory information.
    Under the regulations an educational agency or institution that 
identifies students by SSN (or non-directory student ID number) when 
releasing directory information will either have to ensure that the 
student has provided written consent to disclose the number to the 
requester, or rely solely on a student's name and other properly 
designated directory information to identify the student, such as 
address, date of birth, dates of enrollment, year of graduation, major 
field of study, degree received, etc. Costs to an institution of 
ensuring that students have provided written consent for these 
disclosures, for example by requiring the requester to fax copies of 
each written consent to the institution or its contractor, or making 
arrangements to receive them electronically, could be substantial for 
large institutions and organizations that utilize electronic 
recordkeeping systems. Institutions may choose instead to conduct these 
verifications without using SSNs or non-directory student IDs, which 
may make it more difficult to ensure that the correct student has been 
identified because of the known problems in matching records without 
the use of a universal identifier. Increased institutional costs either 
to verify that the student has provided consent or to conduct a search 
without use of SSNs or non-directory student ID numbers should be less 
for smaller institutions, where the chances of duplicate records are 
decreased. Parents and students may incur additional costs if an 
employer, insurance company, or other requester is unable to verify 
enrollment or graduation based solely on directory information, and 
written consent for disclosure of the student's SSN or non-directory 
student ID number is required. Due to the difficulty in ascertaining 
actual costs associated with these transactions, we have no basis to 
estimate costs that educational agencies and institutions and parents 
and students will incur as a result of this change.
    The enhanced privacy protections of this amendment will benefit 
students and parents by reducing the risk that third parties will 
disclose a student's SSN without consent and possibly confirm a 
questionable number for purposes of identity theft. Similarly, 
preventing institutions from implicitly confirming a questionable non-
directory student ID number will help prevent unauthorized individuals 
from obtaining confidential information from education records. In 
evaluating the benefits or value of this change, we note that this 
provision does not affect any activity that an educational agency or 
institution is permitted to perform under FERPA or other Federal law, 
such as using SSNs to identify students and confirm their enrollment 
status for student loan purposes, which is permitted without consent 
under the financial aid exception in Sec.  99.31.

User ID for Electronic Communications

    The regulations will allow an educational agency or institution to 
disclose as directory information a student's ID number, user ID or 
other electronic identifier so long as the identifier functions like a 
name; that is, it cannot be used without a PIN, password, or some other 
authentication factor to gain access to education records. This change 
will impose no costs and will provide benefits in the form of 
regulatory relief allowing agencies and institutions to use directory 
services in electronic communications systems without incurring the 
administrative costs associated with obtaining student consent for 
these disclosures.
    Costs related to honoring a student's decision to opt out of these 
disclosures will be minimal because we assume that only a small number 
of students will elect not to participate in electronic communications 
at their school. Applying this change to records of both K-12 and 
postsecondary students and assuming that one-tenth of one percent of 
parents and eligible students will opt out of these disclosures, we 
estimate that institutions will have to flag the records of 
approximately 68,000 students for opt-out purposes. We lack sufficient 
data on costs institutions currently incur to flag records for

[[Page 74847]]

directory information opt-outs for other purposes, so we are unable to 
estimate the administrative and information technology costs 
institutions will incur to process these new directory information opt-
outs resulting from this change.

Student Anonymity in the Classroom

    The final regulations will ensure that parents and students do not 
use the right to opt out of directory information disclosures to remain 
anonymous in the classroom, by clarifying that opting out does not 
prevent disclosure of the student's name, institutional e-mail address, 
or electronic identifier in the student's physical or electronic 
classroom. We estimate that this change will result in a small net 
benefit to educational agencies and institutions because they will have 
greater legal certainty about the element of classroom administration, 
and it will reduce the institutional costs of responding to complaints 
from students and parents about the release of this information.

Disclosing Education Records to New School and to Party Identified as 
Source Record

    The final regulations in Sec.  99.31(a)(2) will allow an 
educational agency or institution to disclose education records, or 
personally identifiable information from education records, to a 
student's new school even after the student is already attending the 
new school so long as the disclosure relates to the student's 
enrollment in the new school. This change will provide regulatory 
relief by reducing legal uncertainty about how long a school may 
continue to send records or information to a student's new school, 
without consent, under the ``seeks or intends to enroll'' exception.
    The amendment to the definition of disclosure in Sec.  99.3 will 
allow a school that has concerns about the validity of a transcript, 
letter of recommendation, or other record to return these documents (or 
personally identifiable information from these documents) to the 
student's previous school or other party identified as the source of 
the record in order to resolve questions about their validity. Combined 
with the change to Sec.  99.31(a)(2), discussed earlier in this 
analysis, this change will also allow the student's previous school to 
continue to send education records, or clarification about education 
records, to the student's new school in response to questions about the 
validity or meaning of records sent previously by that party. We are 
unable to determine how much it will cost educational agencies and 
institutions to return potentially fraudulent documents to the party 
identified as the sender because we do not have any basis for 
estimating how often this occurs. However, we believe that these 
changes will provide significant regulatory relief to educational 
agencies and institutions by helping to reduce transcript and other 
educational fraud based on falsified records.

Outsourcing

    The regulations in Sec.  99.31(a)(1)(i) will allow educational 
agencies and institutions to disclose education records, or personally 
identifiable information from education records, without consent to 
contractors, volunteers, and other non-employees performing 
institutional services and functions as school officials with 
legitimate educational interests. An educational agency or institution 
that uses non-employees to perform institutional service and functions 
will have to amend its annual notification of FERPA rights to include 
these parties as school officials with legitimate educational 
interests.
    This change will provide regulatory relief by permitting, and 
clarifying the conditions for, non-consensual disclosure of education 
records. Our experience suggests that virtually all of the more than 
103,000 schools subject to FERPA will take advantage of this provision. 
We have no actual data on how many school districts publish annual 
FERPA notifications for the 97,382 K-12 public schools included in this 
total and, therefore, how many entities will be affected by this 
requirement. However, because educational agencies and institutions 
were already required under previous regulations to publish a FERPA 
notification annually, we believe that costs to include this new 
information will be minimal.

Access Control and Tracking

    The regulations in Sec.  99.31(a)(1)(ii) will require an 
educational agency or institution to use reasonable methods to ensure 
that teachers and other school officials obtain access to only those 
education records in which they have legitimate educational interests. 
This requirement will apply to records in any format, including 
computerized or electronic records and paper, film, and other hard copy 
records. An educational agency or institution that chooses not to 
restrict access to education records with physical or technological 
controls, such as locked cabinets and role-based software security, 
must ensure that its administrative policy for controlling access is 
effective and that it remains in compliance with the legitimate 
educational interest requirement.
    Administrative experience has shown that schools that allow 
teachers and other school officials to have unrestricted access to 
education records tend to have more problems with unauthorized 
disclosures, such as school officials obtaining access to education 
records for personal rather than professional reasons. Preventing 
unrestricted access to education records by teachers and other school 
officials will benefit parents and students by helping to ensure that 
education records are used only for legitimate educational purposes. It 
will also help ensure that education records are not accessed or 
disclosed inadvertently.
    Information gathered by the Director of the Office at numerous 
FERPA training sessions and seminars, along with recent discussions 
with software vendors and educational organizations, indicates that the 
vast majority of mid- and large-size school districts and postsecondary 
institutions currently use commercial software for student information 
systems. These systems generally include role-based security features 
that allow administrators to control access to specific records, 
screens, or fields according to a school official's duties and 
responsibilities. These systems also typically contain transactional 
logging features that document or track a user's actual access to 
particular records, which will help ensure that an agency's or 
institution's access control methods are effective. Educational 
agencies and institutions that already have these systems will incur no 
additional costs to comply with the regulations.
    For purposes of this analysis we excluded from a total of 14,166 
school districts and 6,463 postsecondary institutions those with more 
than 1,000 students, for a total of 6,887 small K-12 districts and 
3,906 small postsecondary institutions that may not have software with 
access control security features. The discussions that the Director of 
the Office has had with numerous SEAs and local districts suggest that 
the vast majority of these small districts and institutions do not make 
education records available to school officials electronically or by 
computer but instead use some system of administrative and physical 
controls.
    We estimate for this analysis that 15 percent, or 1,619, of these 
small districts and institutions use home-built computerized or 
electronic systems that may not have the role-based security features 
of commercial software. The most recent published estimate we have for 
software costs comes from the final

[[Page 74848]]

Standards for Privacy of Individually Identifiable Health Information 
under the Health Insurance Portability and Accountability Act of 1996 
(HIPAA Privacy Rule) published by the Department of Health and Human 
Services (HHS) on December 28, 2000, which estimated that the initial 
per-hospital cost of software upgrades to track the disclosure of 
medical records would be $35,000 (65 FR 82768). We assume that costs 
will be comparable for education records, and, as discussed above, 
software that tracks disclosure history can also be used to control or 
restrict access to electronic records. Based on these assumptions, if 
1,619 small K-12 districts and postsecondary institutions decide to 
purchase student information software rather than rely on 
administrative policies to comply with the regulations, they will incur 
estimated costs of $56,665,000. We estimate that the remaining 9,174 
small districts and institutions will not purchase new software because 
they do not make education records available electronically and rely 
instead on less costly administrative and physical methods to control 
access to records by school officials. Those that provide school 
officials with open access to hard copy education records may incur new 
costs to track actual disclosures to help ensure that they remain in 
compliance with legitimate educational interests requirements. We 
assume that these districts and institutions may devote some additional 
administrative staff time to procedures such as keeping logs of school 
officials who access records. However, no reliable estimates exist for 
the average number of teachers and other school officials who access 
education records or the number of times access is sought, so we are 
unable to estimate the cost of restricting or tracking actual 
disclosures of hard copy education records to school officials.

Education Research

    The regulations in Sec.  99.31(a)(6)(ii)(C) require an educational 
agency or institution to enter into a written agreement before 
disclosing personally identifiable information from education records, 
without consent, to organizations conducting studies for, or on behalf 
of, the educational agency or institution to: (a) Develop, validate, or 
administer predictive tests; (b) administer student aid programs; or 
(c) improve instruction. The written agreement must specify the purpose 
or purposes, scope, and duration of the study or studies and the 
information to be disclosed, require the organization to conduct the 
study in a manner that does not permit personal identification of 
parents and students by anyone other than representatives of the 
organization with legitimate interests, require the destruction or 
return of the information to the educational agency or institution when 
the study is completed, and specify the time period for destruction or 
return of the information. We believe that the additional cost of 
entering into written agreements to comply with this change is unlikely 
to be significant because most educational agencies and institutions 
already specify the terms under which personally identifiable 
information can be used when it is disclosed to organizations for these 
types of studies. Although this change will create an additional 
information collection requirement, we believe the benefits of the 
written agreement outweigh the costs, because it will ensure better 
compliance with FERPA and provide clarity for both researchers and 
educational agencies and institutions about the restrictions and use of 
personally identifiable information disclosed under Sec.  99.31(a)(6) 
for studies.

Identification and Authentication of Identity

    The regulations in Sec.  99.31(c) require educational agencies and 
institutions to use reasonable methods to identify and authenticate the 
identity of parents, students, school officials and other parties to 
whom the agency or institution discloses personally identifiable 
information from education records. The use of widely available 
information to authenticate identity, such as the recipient's name, 
date of birth, SSN or student ID number, is not considered reasonable 
under the regulations.
    The regulations will impose no new costs for educational agencies 
and institutions that disclose hard-copy records through the U.S. 
postal service or private delivery services with use of the recipient's 
name and last known official address.
    We were unable to find reliable data that would allow us to 
estimate the additional administrative time that educational agencies 
and institutions will spend checking photo ID against school records or 
using other reasonable methods, as appropriate, to identify and 
authenticate the identity of students, parents, and other parties to 
whom the agency or institution discloses education records in person.
    Authentication of identity for electronic or telephonic access to 
education records involves a wider array of security options because of 
continuing advances in technologies, but is not necessarily more costly 
than authentication of identity for hard-copy records. We assume that 
educational agencies and institutions that require users to enter a 
secret password or PIN to authenticate identity will deliver the 
password or PIN through the U.S. postal service or in person. We 
estimate that no new costs will be associated with this process because 
agencies and institutions already have direct contact with parents, 
eligible students, and school officials for a variety of other purposes 
and will use these opportunities to deliver a secret authentication 
factor.
    As noted in the preamble to the NPRM, 73 FR 15585, single-factor 
authentication of identity, such as a standard form user name combined 
with a secret password or PIN, may not provide reasonable protection 
for access to all types of education records or under all 
circumstances. We lack a basis for estimating costs of authenticating 
identity when educational agencies and institutions allow authorized 
users to access sensitive personal or financial information in 
electronic records for which single-factor authentication would not be 
reasonable.

Redisclosure and Recordkeeping

    The regulations allow the officials and agencies listed in Sec.  
99.31(a)(3) (the U.S. Comptroller General, the U.S. Attorney General, 
the Secretary, and State and local educational authorities) to 
redisclose education records, or personally identifiable information 
from education records, without consent under the same conditions that 
apply currently to other recipients of education records under Sec.  
99.33(b). This change provides substantial regulatory relief to these 
parties by allowing them to redisclose information on behalf of 
educational agencies and institutions under any provision in Sec.  
99.31(a), which allows disclosure of education records without consent. 
For example, States will be able to consolidate K-16 education records 
under the SEA or State higher educational authority without having to 
obtain written consent under Sec.  99.30. Parties that currently 
request access to records from individual school districts and 
postsecondary institutions will in many instances be able to obtain the 
same information in a more cost-effective manner from the appropriate 
State educational authority or the Department.
    In accordance with the current regulations in Sec.  99.32(b), an 
educational agency or institution must record any redisclosure of 
education records made on its behalf under Sec.  99.33(b), including 
the names of the additional parties to

[[Page 74849]]

which the receiving party may redisclose the information and their 
legitimate interests or basis for the disclosure without consent under 
Sec.  99.31 in obtaining the information. The regulations require SEAs 
and other State educational authorities (such as higher education 
authorities), the Secretary, and other officials or agencies listed in 
Sec.  99.31(a)(3) that make further disclosures on behalf of an 
educational agency or institution to maintain the record of 
redisclosure required under Sec.  99.32(b) if the educational agency or 
institution has not recorded the redisclosure or if the information was 
obtained from another State or Federal official or agency listed in 
Sec.  99.31(a)(3). The regulations also require the State or Federal 
official or agency listed in Sec.  99.31(a)(3) to provide a copy of its 
record of redisclosures to the educational agency or institution upon 
request. In addition, an educational agency or institution must 
maintain with each student's record of disclosures the names of State 
and local educational authorities and Federal officials and agencies 
that may make further disclosures from the student's records without 
consent under Sec.  99.33(b) and must obtain a copy of the record of 
redisclosure, if any, maintained by the State or Federal official that 
redisclosed information on behalf of the agency or institution.
    State educational authorities and Federal officials listed in Sec.  
99.31(a)(3) will incur new administrative costs if they maintain the 
record of redisclosure for the educational agency or institution on 
whose behalf they redisclose education records under the regulations. 
We estimate that two educational authorities or agencies in each State 
and the District of Columbia (one for K-12 and one for postsecondary) 
and the Department itself, for a total of 103 authorities, will 
maintain the required records of redisclosures. (We anticipate that 
educational agencies and institutions will record under Sec.  
99.32(b)(1) any further disclosures made by the other Federal officials 
listed in Sec.  99.31(a)(3), the U.S. Comptroller General and the U.S. 
Attorney General.) We estimate further that these authorities will need 
to record two redisclosures per year from their records and that it 
will take one hour of administrative time to record each redisclosure 
electronically at an average hourly rate of $32.67, for a total annual 
administrative cost of $6,730. (Compensation for administrative staff 
time is explained earlier in this analysis.) We also assume for 
purposes of this analysis that State educational authorities and the 
Department already have software that will allow them to record these 
disclosures electronically.
    State educational authorities and Federal officials that maintain 
records of redisclosures will also have to make that information 
available to the educational agency or institution whose records were 
redisclosed, upon request, so that the agency or institution can make 
that record available to a parent or eligible student who has asked to 
inspect and review the student's record of disclosures. We assume that 
few parents and students request this information and, therefore, use 
an estimate that one tenth of one percent of a total of 68.1 million 
students will make such a request each year, or 68,076 requests. If it 
takes one-quarter of an hour to locate and print a record of 
disclosures at an average administrative hourly rate of $32.67, the 
average annual administrative cost for State and Federal officials and 
agencies to provide this service will be $556,011, plus mailing costs 
(at $.42 per letter) of $28,592, for a total of $584,603. We estimate 
that educational agencies and institutions themselves will incur 
comparable costs when they ask State and Federal officials to send them 
these records of redisclosure and then make them available to parents 
and students. We note that printing and mailing costs may be reduced to 
the extent that e-mail is used to transmit the record, and if parents 
or students pick up the record on-site, but we do not have information 
to estimate these potential savings.
    The Department believes that these changes will result in a net 
benefit to educational agencies and institutions because they will not 
have to record further disclosures made by State and Federal 
authorities and officials who redisclose information from education 
records on their behalf and will not have to ask for a copy unless a 
parent or eligible student asks to inspect and review the student's 
record of disclosures. State and Federal authorities and officials will 
also benefit because they will not have to provide their record of 
further disclosures to anyone unless the educational agency or 
institution asks for a copy. Overall, the costs to State and Federal 
authorities to record their own redisclosures will be offset by the 
savings that educational agencies and institutions will realize by not 
having to record the disclosures themselves.

Notification of Compliance With Court Order or Subpoena

    The regulations in Sec.  99.33(b)92) require any party that 
rediscloses education records in compliance with a court order or 
subpoena under Sec.  99.31(a)(9) to provide the notice to parents and 
eligible students required under Sec.  99.31(a)(9)(ii). We anticipate 
that this provision will affect mostly State and local educational 
authorities, which maintain education records they have obtained from 
their constituent districts and institutions and, under Sec.  99.35(b), 
may redisclose the information, without consent, in compliance with a 
court order or subpoena under Sec.  99.31(a)(9).
    There is no change in costs as a result of shifting responsibility 
for notification to the disclosing party under this change. However, we 
believe that minimizing or eliminating uncertainty about which party is 
legally responsible for the notification will result in a net benefit 
to all parties.

Health or Safety Emergency

    The regulations in Sec.  99.32(a)(5) require that a school that 
discloses information under the health and safety emergency exception 
in Sec.  99.36 record the articulable and significant threat that 
formed the basis for the disclosure and the parties to whom the 
education records were disclosed. Because Sec.  99.32(a) already 
requires schools to record disclosures made under Sec.  99.36, 
including the legitimate interests the parties had in requesting or 
obtaining the information, we believe these changes will not create any 
significant additional administrative costs for schools and that the 
benefit of including the legitimate interests the parties had in 
requesting or obtaining the information outweighs the costs.

Directory Information Opt Outs

    The regulations in Sec.  99.37(b) clarify that while an educational 
agency or institution is not required to notify former students under 
Sec.  99.37(a) about the institution's directory information policy or 
allow former students to opt out of directory information disclosures, 
they must continue to honor a parent's or student's decision to opt out 
of directory information disclosures after the student leaves the 
institution. Most agencies and institutions should already comply with 
this requirement because of informal guidance and training provided by 
FPCO.
    Parents and students will benefit from this clarification because 
it will help ensure that schools do not invalidate the parent's or 
student's decisions on directory information disclosures after the 
student is no longer in attendance. It will also benefit schools by 
eliminating any uncertainty they may have about whether they must 
continue to honor an opt out once the student is

[[Page 74850]]

no longer in attendance. We have insufficient information to estimate 
the number of institutions affected and the additional costs involved 
in changing systems to maintain opt-out flags on education records of 
former students.

Paperwork Reduction Act of 1995

    Following publication of the NPRM, we provided, through a notice 
published in the Federal Register (73 FR 28810, May 19, 2008) 
opportunity for the public to comment on information collections in the 
current regulations, and indicated in that notice the pendency of the 
NPRM. Additionally, based on comments received in response to the NPRM, 
we have identified several information collection requirements 
associated with these regulations. We describe these information 
collections in the following paragraphs and will be submitting these 
sections to OMB for review and approval. We note that the Paperwork 
Reduction Act of 1995 does not require a response to these information 
collection requirements unless they display a valid OMB control number. 
A valid OMB control number will be assigned to the information 
collection requirements at the end of the affected sections of the 
regulations.

(1) Sec.  99.31(a)(6)(ii)

    FERPA permits an educational agency or institution to disclose 
personally identifiable information from education records, without 
consent, to organizations conducting studies for or on behalf of the 
agency or institution for purposes of testing, student aid, and 
improvement of instruction. In the NPRM, we proposed to add Sec.  
99.31(a)(6)(ii) to require that an educational agency or institution to 
disclose personally identifiable information under Sec.  99.31(a)(6)(i) 
only if it enters into a written agreement with the organization 
specifying the purposes of the study. Under these final regulations, 
this written agreement must specify the purpose, scope, and duration of 
the study or studies and the information to be disclosed; require the 
organization to use personally identifiable information from education 
records only to meet the purpose or purposes of the study as stated in 
the written agreement; require the organization to conduct the study in 
a manner that does not permit personal identification of parents and 
students by individuals other than representatives with legitimate 
interest of the organization that conducts the study; require the 
organization to destroy the information or return to the educational 
agency or institution when it is no longer needed for the purposes for 
which the study was conducted; and specify the time period for the 
destruction or return of the information.
    The Department did not identify in the NPRM the requirement in 
Sec.  99.31(a)(6)(ii) as an information collection requirement under 
the Paperwork Reduction Act of 1995 and did not realize this would be 
an information collection requirement until a commenter brought this 
matter to our attention. The commenter pointed out that, while this 
change created another paperwork burden for school districts, the 
commenter did not object to the written agreement requirement because 
putting the requirements regarding the use and destruction of data in 
writing may improve compliance with FERPA. The Department agrees with 
the comment.

(2) Sec.  99.32(a)(1)

    Under FERPA, an educational agency or institution is required to 
record its disclosures of personally identifiable information from 
education records, even when it discloses information to its own State 
educational authority. This statutory requirement is reflected in the 
current FERPA regulations. The final regulations permit the State and 
local educational authorities and Federal officials listed in Sec.  
99.31(a)(3) to make further discloses of personally identifiable 
information from education records on behalf of the educational agency 
or institution in accordance with the requirements of Sec.  99.33(b) 
and require them to record these further disclosures of Sec.  99.33(b) 
if the educational agency or institution does not do so. We have 
included provisions in the final regulations that require educational 
agencies and institutions to maintain a listing in each student's 
record of the State and local educational authorities and Federal 
officials and agencies that may make further disclosures of the 
student's education records without consent so that parents and 
eligible students will be made aware of these further disclosures.

(3) Sec.  99.32(a)(4)

    Under this new provision, parents and eligible students will be 
able to inspect and review any further disclosures that were made by 
any of the parties listed under Sec.  99.31(a)(3) by asking the 
educational agency or institution to obtain a copy of the record of 
further disclosures. We believe that this is only a minor paperwork 
burden for schools because it would involve asking officials to whom 
they have disclosed education records for the record of further 
disclosure or, in the case of some SEAs, accessing the State database 
for this information. Also, we do not expect that a large number of 
parents and eligible students will ask to see the record of further 
disclosures.

(4) Sec.  99.32(a)(5)

    During the development of the final regulations, we identified 
another change to the recordation requirements of Sec.  99.32 that 
would require the collection of information. In response to several 
comments we received regarding changes to FERPA's ``health or safety 
emergency exception'' in Sec.  99.36, we have amended Sec.  99.32(a) to 
include a new recordation requirement. Specifically, we have added a 
paragraph to the recordation requirement that requires that for any 
disclosures under Sec.  99.36 a school must record the articulable and 
significant threat to the health or safety of a student or other 
individuals that formed the basis for the disclosure and the parties to 
whom the agency or institution disclosed information.
    The Secretary believes that this is only a minor paperwork burden 
for schools because schools are already required to record disclosures 
made under Sec.  99.36. The new language in Sec.  99.32(a)(5) simply 
clarifies the type of information that must be recorded when a school 
discloses personally identifiable information in response to a health 
or safety emergency, either for one student or for all students in a 
school.

(5) Sec.  99.32(b)(2)

    In the NPRM, we specifically noted that the Department was 
interested in relieving any administrative burdens associated with 
recording disclosures of education records and, therefore, invited 
public comment on whether an SEA, the Department, or other authority or 
official listed in Sec.  99.31(a)(3) should be allowed to maintain the 
record of the redisclosures it makes on behalf of an educational agency 
or institution under Sec.  99.32(b).
    Several commenters stated that an SEA (or other authority or 
official listed in Sec.  99.31(a)(3)) should be responsible for 
maintaining the record of disclosure required under Sec.  99.32 when it 
rediscloses information on behalf of educational agencies and 
institutions. The commenters stated that requiring each educational 
agency or institution, such as school districts, to record each 
redisclosure made by an SEA or other State educational authority on its 
behalf imposes an unacceptable recordkeeping burden on school districts 
and is impractical for State educational authorities to adhere to in 
making

[[Page 74851]]

further disclosures on behalf of the agency or institution. In response 
to these comments, we are revising Sec.  99.32 to require the State and 
local educational authorities and Federal officials listed in Sec.  
99.31(a)(3) to maintain the record of further disclosures if the 
educational agency or institution does not do so and make it available 
to the educational agency or institution upon request. We agree that by 
requiring State and Federal authorities and officials to record their 
redisclosures in these circumstances school districts will have less 
total paperwork burden because schools will not have to comply with the 
recordkeeping requirement in these instances.

Assessment of Educational Impact

    In the NPRM, and in accordance with section 411 of the General 
Education Provisions Act, 20 U.S.C. 1221e-4, we requested comments on 
whether the proposed regulations would require transmission of 
information that any other agency or authority of the United States 
gathers or makes available.
    Based on the response to the NPRM and on our review, we have 
determined that these final regulations do not require transmission of 
information that any other agency or authority of the United States 
gathers or makes available.

Electronic Access to This Document

    You may view this document, as well as all other Department of 
Education documents published in the Federal Register, in text or Adobe 
Portable Document Format (PDF) on the Internet at the following site: 
www.ed.gov/news/fedregister.
    To use PDF you must have Adobe Acrobat Reader, which is available 
free at this site. If you have questions about using PDF, call the U.S. 
Government Printing Office (GPO), toll free, at 1-888-293-6498; or in 
the Washington, DC area at (202) 512-1530.

    Note: The official version of this document is the document 
published in the Federal Register. Free Internet access to the 
official edition of the Federal Register and the Code of Federal 
Regulations is available on GPO Access at www.gpoaccess.gov/nara/index.html.

    (Catalog of Federal Domestic Assistance Number does not apply.)

List of Subjects in 34 CFR Part 99

    Administrative practice and procedure, Directory information, 
Education records, Information, Parents, Privacy, Records, Social 
Security Numbers, Students.

    Dated: December 2, 2008.
Margaret Spellings,
Secretary of Education.

0
For the reasons discussed in the preamble, the Secretary amends part 99 
of title 34 of the Code of Federal Regulations as follows:

PART 99--FAMILY EDUCATIONAL RIGHTS AND PRIVACY

0
1. The authority citation for part 99 continues to read as follows:

    Authority: 20 U.S.C. 1232g, unless otherwise noted.


0
2. Section 99.2 is amended by revising the note following the authority 
citation to read as follows:


Sec.  99.2  What is the purpose of these regulations?

* * * * *

    Note to Sec.  99.2: 34 CFR 300.610 through 300.626 contain 
requirements regarding the confidentiality of information relating 
to children with disabilities who receive evaluations, services or 
other benefits under Part B of the Individuals with Disabilities 
Education Act (IDEA). 34 CFR 303.402 and 303.460 identify the 
confidentiality of information requirements regarding children and 
infants and toddlers with disabilities and their families who 
receive evaluations, services, or other benefits under Part C of 
IDEA. 34 CFR 300.610 through 300.627 contain the confidentiality of 
information requirements that apply to personally identifiable data, 
information, and records collected or maintained pursuant to Part B 
of the IDEA.


0
3. Section 99.3 is amended by:
0
A. Adding, in alphabetical order, a definition of Biometric record.
0
B. Revising the definitions of Attendance, Directory information, 
Disclosure, and Personally identifiable information.
0
C. In the definition of Education records, revising paragraph (b)(5) 
and adding a new paragraph (b)(6).
    These additions and revisions read as follows:


Sec.  99.3  What definitions apply to these regulations?

* * * * *
    Attendance includes, but is not limited to--
    (a) Attendance in person or by paper correspondence, 
videoconference, satellite, Internet, or other electronic information 
and telecommunications technologies for students who are not physically 
present in the classroom; and
    (b) The period during which a person is working under a work-study 
program.

(Authority: 20 U.S.C. 1232g)

* * * * *
    Biometric record, as used in the definition of personally 
identifiable information, means a record of one or more measurable 
biological or behavioral characteristics that can be used for automated 
recognition of an individual. Examples include fingerprints; retina and 
iris patterns; voiceprints; DNA sequence; facial characteristics; and 
handwriting.

(Authority: 20 U.S.C. 1232g)

* * * * *
    Directory information means information contained in an education 
record of a student that would not generally be considered harmful or 
an invasion of privacy if disclosed.
    (a) Directory information includes, but is not limited to, the 
student's name; address; telephone listing; electronic mail address; 
photograph; date and place of birth; major field of study; grade level; 
enrollment status (e.g., undergraduate or graduate, full-time or part-
time); dates of attendance; participation in officially recognized 
activities and sports; weight and height of members of athletic teams; 
degrees, honors and awards received; and the most recent educational 
agency or institution attended.
    (b) Directory information does not include a student's--
    (1) Social security number; or
    (2) Student identification (ID) number, except as provided in 
paragraph (c) of this section.
    (c) Directory information includes a student ID number, user ID, or 
other unique personal identifier used by the student for purposes of 
accessing or communicating in electronic systems, but only if the 
identifier cannot be used to gain access to education records except 
when used in conjunction with one or more factors that authenticate the 
user's identity, such as a personal identification number (PIN), 
password, or other factor known or possessed only by the authorized 
user.

(Authority: 20 U.S.C. 1232g(a)(5)(A))

* * * * *
    Disclosure means to permit access to or the release, transfer, or 
other communication of personally identifiable information contained in 
education records by any means, including oral, written, or electronic 
means, to any party except the party identified as the party that 
provided or created the record.

(Authority: 20 U.S.C. 1232g(b)(1) and (b)(2))

* * * * *
Education Records
* * * * *
    (b) * * *
    (5) Records created or received by an educational agency or 
institution after

[[Page 74852]]

an individual is no longer a student in attendance and that are not 
directly related to the individual's attendance as a student.
    (6) Grades on peer-graded papers before they are collected and 
recorded by a teacher.
* * * * *
Personally Identifiable Information
    The term includes, but is not limited to--
    (a) The student's name;
    (b) The name of the student's parent or other family members;
    (c) The address of the student or student's family;
    (d) A personal identifier, such as the student's social security 
number, student number, or biometric record;
    (e) Other indirect identifiers, such as the student's date of 
birth, place of birth, and mother's maiden name;
    (f) Other information that, alone or in combination, is linked or 
linkable to a specific student that would allow a reasonable person in 
the school community, who does not have personal knowledge of the 
relevant circumstances, to identify the student with reasonable 
certainty; or
    (g) Information requested by a person who the educational agency or 
institution reasonably believes knows the identity of the student to 
whom the education record relates.

(Authority: 20 U.S.C. 1232g)

* * * * *

0
4. Section 99.5 is amended by redesignating paragraph (a) as paragraph 
(a)(1) and adding a new paragraph (a)(2) to read as follows:


Sec.  99.5  What are the rights of students?

    (a)(1) * * *
    (2) Nothing in this section prevents an educational agency or 
institution from disclosing education records, or personally 
identifiable information from education records, to a parent without 
the prior written consent of an eligible student if the disclosure 
meets the conditions in Sec.  99.31(a)(8), Sec.  99.31(a)(10), Sec.  
99.31(a)(15), or any other provision in Sec.  99.31(a).
* * * * *

0
5. Section 99.31 is amended by:
0
A. Redesignating paragraph (a)(1) as paragraph (a)(1)(i)(A) and adding 
new paragraphs (a)(1)(i)(B) and (a)(1)(ii).
0
B. Revising paragraph (a)(2).
0
C. Redesignating paragraphs (a)(6)(iii) and (a)(6)(iv) as paragraphs 
(a)(6)(iv) and (a)(6)(v), respectively.
0
D. Revising paragraph (a)(6)(ii).
0
E. Adding a new paragraph (a)(6)(iii).
0
F. In paragraph (a)(9)(ii)(A), removing the word ``or'' after the 
punctuation ``;''.
0
G. In paragraph (a)(9)(ii)(B), removing the punctuation ``.'' and 
adding in its place the word ``;or''.
0
H. Adding paragraph (a)(9)(ii)(C).
0
I. Adding paragraph (a)(16).
0
J. Revising paragraph (b).
0
K. Adding paragraphs (c) and (d).
0
L. Revising the authority citation at the end of the section.
    The additions and revisions read as follows:


Sec.  99.31  Under what conditions is prior consent not required to 
disclose information?

    (a) * * *
    (1)(i)(A) * * *
    (B) A contractor, consultant, volunteer, or other party to whom an 
agency or institution has outsourced institutional services or 
functions may be considered a school official under this paragraph 
provided that the outside party--
    (1) Performs an institutional service or function for which the 
agency or institution would otherwise use employees;
    (2) Is under the direct control of the agency or institution with 
respect to the use and maintenance of education records; and
    (3) Is subject to the requirements of Sec.  99.33(a) governing the 
use and redisclosure of personally identifiable information from 
education records.
    (ii) An educational agency or institution must use reasonable 
methods to ensure that school officials obtain access to only those 
education records in which they have legitimate educational interests. 
An educational agency or institution that does not use physical or 
technological access controls must ensure that its administrative 
policy for controlling access to education records is effective and 
that it remains in compliance with the legitimate educational interest 
requirement in paragraph (a)(1)(i)(A) of this section.
    (2) The disclosure is, subject to the requirements of Sec.  99.34, 
to officials of another school, school system, or institution of 
postsecondary education where the student seeks or intends to enroll, 
or where the student is already enrolled so long as the disclosure is 
for purposes related to the student's enrollment or transfer.

    Note: Section 4155(b) of the No Child Left Behind Act of 2001, 
20 U.S.C. 7165(b), requires each State to assure the Secretary of 
Education that it has a procedure in place to facilitate the 
transfer of disciplinary records with respect to a suspension or 
expulsion of a student by a local educational agency to any private 
or public elementary or secondary school in which the student is 
subsequently enrolled or seeks, intends, or is instructed to enroll.

    (6)(i) * * *
    (ii) An educational agency or institution may disclose information 
under paragraph (a)(6)(i) of this section only if--
    (A) The study is conducted in a manner that does not permit 
personal identification of parents and students by individuals other 
than representatives of the organization that have legitimate interests 
in the information;
    (B) The information is destroyed when no longer needed for the 
purposes for which the study was conducted; and
    (C) The educational agency or institution enters into a written 
agreement with the organization that--
    (1) Specifies the purpose, scope, and duration of the study or 
studies and the information to be disclosed;
    (2) Requires the organization to use personally identifiable 
information from education records only to meet the purpose or purposes 
of the study as stated in the written agreement;
    (3) Requires the organization to conduct the study in a manner that 
does not permit personal identification of parents and students, as 
defined in this part, by anyone other than representatives of the 
organization with legitimate interests;

and
    (4) Requires the organization to destroy or return to the 
educational agency or institution all personally identifiable 
information when the information is no longer needed for the purposes 
for which the study was conducted and specifies the time period in 
which the information must be returned or destroyed.
    (iii) An educational agency or institution is not required to 
initiate a study or agree with or endorse the conclusions or results of 
the study.
* * * * *
    (9) * * *
    (ii) * * *
    (C) An ex parte court order obtained by the United States Attorney 
General (or designee not lower than an Assistant Attorney General) 
concerning investigations or prosecutions of an offense listed in 18 
U.S.C. 2332b(g)(5)(B) or an act of domestic or international terrorism 
as defined in 18 U.S.C. 2331.
* * * * *
    (16) The disclosure concerns sex offenders and other individuals 
required to register under section 170101 of the Violent Crime Control 
and Law Enforcement Act of 1994, 42 U.S.C. 14071, and the information 
was provided to the educational agency or institution under 42 U.S.C. 
14071 and applicable Federal guidelines.
    (b)(1) De-identified records and information. An educational agency 
or

[[Page 74853]]

institution, or a party that has received education records or 
information from education records under this part, may release the 
records or information without the consent required by Sec.  99.30 
after the removal of all personally identifiable information provided 
that the educational agency or institution or other party has made a 
reasonable determination that a student's identity is not personally 
identifiable, whether through single or multiple releases, and taking 
into account other reasonably available information.
    (2) An educational agency or institution, or a party that has 
received education records or information from education records under 
this part, may release de-identified student level data from education 
records for the purpose of education research by attaching a code to 
each record that may allow the recipient to match information received 
from the same source, provided that--
    (i) An educational agency or institution or other party that 
releases de-identified data under paragraph (b)(2) of this section does 
not disclose any information about how it generates and assigns a 
record code, or that would allow a recipient to identify a student 
based on a record code;
    (ii) The record code is used for no purpose other than identifying 
a de-identified record for purposes of education research and cannot be 
used to ascertain personally identifiable information about a student; 
and
    (iii) The record code is not based on a student's social security 
number or other personal information.
    (c) An educational agency or institution must use reasonable 
methods to identify and authenticate the identity of parents, students, 
school officials, and any other parties to whom the agency or 
institution discloses personally identifiable information from 
education records.
    (d) Paragraphs (a) and (b) of this section do not require an 
educational agency or institution or any other party to disclose 
education records or information from education records to any party.

(Authority: 20 U.S.C. 1232g(a)(5)(A), (b), (h), (i), and (j)).



0
6. Section 99.32 is amended by:
0
A. Revising paragraph (a)(1).
0
B. Adding new paragraphs (a)(4) and (a)(5).
0
C. Redesignating paragraphs (b)(1) and (b)(2) as paragraphs (b)(1)(i) 
and (b)(1)(ii) and redesignating paragraph (b), introductory text, as 
paragraph (b)(1).
0
D. Revising newly redesignated paragraph (b)(1).
0
E. Adding a new paragraph (b)(2).
0
F. Revising paragraph (d)(5).
    The additions and revisions read as follows:


Sec.  99.32  What recordkeeping requirements exist concerning requests 
and disclosures?

    (a)(1) An educational agency or institution must maintain a record 
of each request for access to and each disclosure of personally 
identifiable information from the education records of each student, as 
well as the names of State and local educational authorities and 
Federal officials and agencies listed in Sec.  99.31(a)(3) that may 
make further disclosures of personally identifiable information from 
the student's education records without consent under Sec.  99.33(b).
* * * * *
    (4) An educational agency or institution must obtain a copy of the 
record of further disclosures maintained under paragraph (b)(2) of this 
section and make it available in response to a parent's or eligible 
student's request to review the record required under paragraph (a)(1) 
of this section.
    (5) An educational agency or institution must record the following 
information when it discloses personally identifiable information from 
education records under the health or safety emergency exception in 
Sec.  99.31(a)(10) and Sec.  99.36:
    (i) The articulable and significant threat to the health or safety 
of a student or other individuals that formed the basis for the 
disclosure; and
    (ii) The parties to whom the agency or institution disclosed the 
information.
    (b)(1) Except as provided in paragraph (b)(2) of this section, if 
an educational agency or institution discloses personally identifiable 
information from education records with the understanding authorized 
under Sec.  99.33(b), the record of the disclosure required under this 
section must include:
* * * * *
    (2)(i) A State or local educational authority or Federal official 
or agency listed in Sec.  99.31(a)(3) that makes further disclosures of 
information from education records under Sec.  99.33(b) must record the 
names of the additional parties to which it discloses information on 
behalf of an educational agency or institution and their legitimate 
interests in the information under Sec.  99.31 if the information was 
received from:
    (A) An educational agency or institution that has not recorded the 
further disclosures under paragraph (b)(1) of this section; or
    (B) Another State or local educational authority or Federal 
official or agency listed in Sec.  99.31(a)(3).
    (ii) A State or local educational authority or Federal official or 
agency that records further disclosures of information under paragraph 
(b)(2)(i) of this section may maintain the record by the student's 
class, school, district, or other appropriate grouping rather than by 
the name of the student.
    (iii) Upon request of an educational agency or institution, a State 
or local educational authority or Federal official or agency listed in 
Sec.  99.31(a)(3) that maintains a record of further disclosures under 
paragraph (b)(2)(i) of this section must provide a copy of the record 
of further disclosures to the educational agency or institution within 
a reasonable period of time not to exceed 30 days.
* * * * *
    (d) * * *
    (5) A party seeking or receiving records in accordance with Sec.  
99.31(a)(9)(ii)(A) through (C).
* * * * *

0
7. Section 99.33 is amended by revising paragraphs (b), (c), (d), and 
(e) to read as follows:
* * * * *


Sec.  99.33  What limitations apply to the redisclosure of information?

* * * * *
    (b)(1) Paragraph (a) of this section does not prevent an 
educational agency or institution from disclosing personally 
identifiable information with the understanding that the party 
receiving the information may make further disclosures of the 
information on behalf of the educational agency or institution if--
    (i) The disclosures meet the requirements of Sec.  99.31; and
    (ii)(A) The educational agency or institution has complied with the 
requirements of Sec.  99.32(b); or
    (B) A State or local educational authority or Federal official or 
agency listed in Sec.  99.31(a)(3) has complied with the requirements 
of Sec.  99.32(b)(2).
    (2) A party that receives a court order or lawfully issued subpoena 
and rediscloses personally identifiable information from education 
records on behalf of an educational agency or institution in response 
to that order or subpoena under Sec.  99.31(a)(9) must provide the 
notification required under Sec.  99.31(a)(9)(ii).
    (c) Paragraph (a) of this section does not apply to disclosures 
under Sec. Sec.  99.31(a)(8), (9), (11), (12), (14), (15), and (16), 
and to information that postsecondary institutions are required

[[Page 74854]]

to disclose under the Jeanne Clery Disclosure of Campus Security Policy 
and Campus Crime Statistics Act, 20 U.S.C. 1092(f) (Clery Act), to the 
accuser and accused regarding the outcome of any campus disciplinary 
proceeding brought alleging a sexual offense.
    (d) An educational agency or institution must inform a party to 
whom disclosure is made of the requirements of paragraph (a) of this 
section except for disclosures made under Sec. Sec.  99.31(a)(8), (9), 
(11), (12), (14), (15), and (16), and to information that postsecondary 
institutions are required to disclose under the Clery Act to the 
accuser and accused regarding the outcome of any campus disciplinary 
proceeding brought alleging a sexual offense.
    (e) If this Office determines that a third party outside the 
educational agency or institution improperly rediscloses personally 
identifiable information from education records in violation of this 
section, or fails to provide the notification required under paragraph 
(b)(2) of this section, the educational agency or institution may not 
allow that third party access to personally identifiable information 
from education records for at least five years.
* * * * *

0
8. Section 99.34 is amended by revising paragraph (a)(1)(ii) to read as 
follows:


Sec.  99.34  What conditions apply to disclosure of information to 
other educational agencies and institutions?

    (a) * * *
    (1) * * *
    (ii) The annual notification of the agency or institution under 
Sec.  99.7 includes a notice that the agency or institution forwards 
education records to other agencies or institutions that have requested 
the records and in which the student seeks or intends to enroll or is 
already enrolled so long as the disclosure is for purposes related to 
the student's enrollment or transfer;
* * * * *

0
9. Section 99.35 is amended by revising paragraphs (a) and (b)(1) to 
read as follows:


Sec.  99.35  What conditions apply to disclosure of information for 
Federal or State program purposes?

    (a)(1) Authorized representatives of the officials or agencies 
headed by officials listed in Sec.  99.31(a)(3) may have access to 
education records in connection with an audit or evaluation of Federal 
or State supported education programs, or for the enforcement of or 
compliance with Federal legal requirements that relate to those 
programs.
    (2) Authority for an agency or official listed in Sec.  99.31(a)(3) 
to conduct an audit, evaluation, or compliance or enforcement activity 
is not conferred by the Act or this part and must be established under 
other Federal, State, or local authority.
    (b) * * *
    (1) Be protected in a manner that does not permit personal 
identification of individuals by anyone other than the officials or 
agencies headed by officials referred to in paragraph (a) of this 
section, except that those officials and agencies may make further 
disclosures of personally identifiable information from education 
records on behalf of the educational agency or institution in 
accordance with the requirements of Sec.  99.33(b); and
* * * * *

0
10. Section 99.36 is amended by revising paragraphs (a) and (c) to read 
as follows:


Sec.  99.36  What conditions apply to disclosure of information in 
health and safety emergencies?

    (a) An educational agency or institution may disclose personally 
identifiable information from an education record to appropriate 
parties, including parents of an eligible student, in connection with 
an emergency if knowledge of the information is necessary to protect 
the health or safety of the student or other individuals.
* * * * *
    (c) In making a determination under paragraph (a) of this section, 
an educational agency or institution may take into account the totality 
of the circumstances pertaining to a threat to the health or safety of 
a student or other individuals. If the educational agency or 
institution determines that there is an articulable and significant 
threat to the health or safety of a student or other individuals, it 
may disclose information from education records to any person whose 
knowledge of the information is necessary to protect the health or 
safety of the student or other individuals. If, based on the 
information available at the time of the determination, there is a 
rational basis for the determination, the Department will not 
substitute its judgment for that of the educational agency or 
institution in evaluating the circumstances and making its 
determination.
* * * * *

0
11. Section 99.37 is amended by:
0
A. Revising paragraph (b).
0
B. Adding new paragraphs (c) and (d).
    The revision and additions read as follows:


Sec.  99.37  What conditions apply to disclosing directory information?

* * * * *
    (b) An educational agency or institution may disclose directory 
information about former students without complying with the notice and 
opt out conditions in paragraph (a) of this section. However, the 
agency or institution must continue to honor any valid request to opt 
out of the disclosure of directory information made while a student was 
in attendance unless the student rescinds the opt out request.
    (c) A parent or eligible student may not use the right under 
paragraph (a)(2) of this section to opt out of directory information 
disclosures to prevent an educational agency or institution from 
disclosing or requiring a student to disclose the student's name, 
identifier, or institutional e-mail address in a class in which the 
student is enrolled.
    (d) An educational agency or institution may not disclose or 
confirm directory information without meeting the written consent 
requirements in Sec.  99.30 if a student's social security number or 
other non-directory information is used alone or combined with other 
data elements to identify or help identify the student or the student's 
records.
* * * * *

0
12. Section 99.62 is revised to read as follows:


Sec.  99.62  What information must an educational agency or institution 
submit to the Office?

    The Office may require an educational agency or institution to 
submit reports, information on policies and procedures, annual 
notifications, training materials, and other information necessary to 
carry out its enforcement responsibilities under the Act or this part.

(Authority: 20 U.S.C. 1232g(f) and (g))

Sec.  99.63  [Amended]

0
13. Section 99.63 is amended by removing the mail code designation 
``4605'' before the punctuation ``.''

0
14. Section 99.64 is amended by:
0
A. Revising the section heading.
0
B. Revising paragraphs (a) and (b).
    The revisions read as follows:


Sec.  99.64  What is the investigation procedure?

    (a) A complaint must contain specific allegations of fact giving 
reasonable cause to believe that a violation of the Act or this part 
has occurred. A complaint does not have to allege that a violation is 
based on a policy or practice of the educational agency or institution.

[[Page 74855]]

    (b) The Office investigates a timely complaint filed by a parent or 
eligible student, or conducts its own investigation when no complaint 
has been filed or a complaint has been withdrawn, to determine whether 
an educational agency or institution has failed to comply with a 
provision of the Act or this part. If the Office determines that an 
educational agency or institution has failed to comply with a provision 
of the Act or this part, it may also determine whether the failure to 
comply is based on a policy or practice of the agency or institution.
* * * * *

0
15. Section 99.65 is revised to read as follows:


Sec.  99.65  What is the content of the notice of investigation issued 
by the Office?

    (a) The Office notifies the complainant, if any, and the 
educational agency or institution in writing if it initiates an 
investigation under Sec.  99.64(b). The notice to the educational 
agency or institution--
    (1) Includes the substance of the allegations against the 
educational agency or institution; and
    (2) Directs the agency or institution to submit a written response 
and other relevant information, as set forth in Sec.  99.62, within a 
specified period of time, including information about its policies and 
practices regarding education records.
    (b) The Office notifies the complainant if it does not initiate an 
investigation because the complaint fails to meet the requirements of 
Sec.  99.64.

(Authority: 20 U.S.C. 1232g(g))



0
16. Section 99.66 is amended by revising paragraphs (a), (b), and the 
introductory text of paragraph (c) to read as follows:


Sec.  99.66  What are the responsibilities of the Office in the 
enforcement process?

    (a) The Office reviews a complaint, if any, information submitted 
by the educational agency or institution, and any other relevant 
information. The Office may permit the parties to submit further 
written or oral arguments or information.
    (b) Following its investigation, the Office provides to the 
complainant, if any, and the educational agency or institution a 
written notice of its findings and the basis for its findings.
    (c) If the Office finds that an educational agency or institution 
has not complied with a provision of the Act or this part, it may also 
find that the failure to comply was based on a policy or practice of 
the agency or institution. A notice of findings issued under paragraph 
(b) of this section to an educational agency or institution that has 
not complied with a provision of the Act or this part--
* * * * *

0
17. Section 99.67 is amended by revising paragraph (a) to read as 
follows:


Sec.  99.67  How does the Secretary enforce decisions?

    (a) If an educational agency or institution does not comply during 
the period of time set under Sec.  99.66(c), the Secretary may take any 
legally available enforcement action in accordance with the Act, 
including, but not limited to, the following enforcement actions 
available in accordance with part E of the General Education Provisions 
Act--
* * * * *
 [FR Doc. E8-28864 Filed 12-8-08; 8:45 am]
BILLING CODE 4000-01-P