Disclosure Avoidance

This document lists mandatory requirements for written agreements under the studies exception and the audit or evaluation exception, as specified in the Family Educational Rights and Privacy Act.

Letter to Senator Ron Wyden providing clarification on the applicability of the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) to college and university students’ medical records, including therapy and treatment records, held by educational institutions.

Letter to Representative Suzanne Bonamici providing clarification on the applicability of the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) to college and university students’ medical records, including therapy and treatment records, held by educational institutions. 

This brief provides best practices for data security and data management trainings for educational leaders. The brief discusses key training concepts to follow, content, delivery methods, and possible audiences for these trainings.

This brief outlines critical threats to educational data and information systems. Threats are divided into two categories: technical and non-technical. A brief description of each threat is followed by a suggestion of appropriate risk mitigation measures.

This checklist is designed to assist stakeholder organizations with establishing and maintaining a successful data governance program by summarizing the key data privacy and security components of such a program and listing specific best practice action items.

This document provides best practice recommendations for State educational agencies (SEAs) on presenting information about education data governance and sharing on a SEA website. 

This case study illustrates a scenario where a local educational agency (LEA) requests technical assistance from the Privacy Technical Assistance Center so that the LEA can come into compliance with the Family Educational Rights and Privacy Act; the illustration also clarifies the definition of an “education program.”

This case study illustrates a scenario where the Student Privacy Policy Office (SPPO) investigates an alleged violation of the Family Educational Rights and Privacy Act, resulting in SPPO imposing a 5-year ban on sharing education data with the offending party.

This case study illustrates a scenario where a State educational agency enters into an agreement to share education data with a Head Start Program.