Legal References

This document is intended for state educational agencies (SEAs) and/or their contracted companies to use to inform the contractors’ staff about their responsibilities to protect students’ personally identifiable information acquired under FERPA’s audit or evaluation exception.

This version is a tri-fold brochure for Microsoft Word that leaves space to amend applicable state or local privacy laws. 

This document lists mandatory requirements for written agreements under the studies exception and the audit or evaluation exception, as specified in the Family Educational Rights and Privacy Act.

Letter to Senator Ron Wyden providing clarification on the applicability of the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) to college and university students’ medical records, including therapy and treatment records, held by educational institutions.

Letter to Representative Suzanne Bonamici providing clarification on the applicability of the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) to college and university students’ medical records, including therapy and treatment records, held by educational institutions. 

This brief provides best practices for data security and data management trainings for educational leaders. The brief discusses key training concepts to follow, content, delivery methods, and possible audiences for these trainings.

This brief outlines critical threats to educational data and information systems. Threats are divided into two categories: technical and non-technical. A brief description of each threat is followed by a suggestion of appropriate risk mitigation measures.

This checklist is designed to assist stakeholder organizations with establishing and maintaining a successful data governance program by summarizing the key data privacy and security components of such a program and listing specific best practice action items.

This document provides best practice recommendations for State educational agencies (SEAs) on presenting information about education data governance and sharing on a SEA website. 

This case study illustrates a scenario where a local educational agency (LEA) requests technical assistance from the Privacy Technical Assistance Center so that the LEA can come into compliance with the Family Educational Rights and Privacy Act; the illustration also clarifies the definition of an “education program.”

This case study illustrates a scenario where the Student Privacy Policy Office (SPPO) investigates an alleged violation of the Family Educational Rights and Privacy Act, resulting in SPPO imposing a 5-year ban on sharing education data with the offending party.