Human Subjects Protection

The Juvenile Justice Professional's Guide to
Human Subjects Protection and the IRB Process

Family Educational Rights and Privacy Act (FERPA)

The following scenario is a typical example of a request for information about juveniles to be used in a research study. If you were Karen’s supervisor, how would you respond to Karen? The information that follows should help you with your decision.

Karen is a school-based probation officer. She receives a telephone call from a local university professor who is studying the impact of school-based probation on school-related behaviors. As part of this research study, he asks Karen to share information about student grades, attendance, and behavior for all youth assigned to her. In compliance with a court order, the school provides Karen with this information on each youth under her supervision. Since the information is already documented in her school-based probation records, Karen sees no harm in sharing the information with the professor, but decides that she should first ask her supervisor.

Should Karen share this information with the professor?
Is there a potential for harm if Karen shares this information?
How would you decide?

The Family Educational Rights and Privacy Act (FERPA) regulates the disclosure of personally identifiable information from youth educational records, files, documents, and other student materials in all public elementary and secondary schools, school districts, intermediate education agencies, state education agencies, and any public or private agency or institution that uses funds from the U.S. Department of Education. The purpose of FERPA is to protect all student and parent information maintained in an educational record.

Under FERPA guidelines, both parental/guardian and eligible student consent are required for almost all student education record disclosures or information sharing with an agency outside of the school, the district, or the state education agency. Statutory exceptions are specific, and the originating educational agency must document the purpose of the information release and the name of the receiving group. All release information must be documented in the student record and maintained on file until the educational agency destroys the record. If a third party recipient does permit access without written parental consent (except for compliance with a subpoena or a court order) the originating educational agency cannot permit that third party access to personally identifiable information from education records for a minimum of five years.

Juvenile justice professionals who share and receive youth information from educational institutions must be familiar with all valid disclosures or exceptions to the prior consent requirement. However, four of these statutory exceptions are directly applicable to routine information sharing among the juvenile justice system, schools, and other human service agencies that deliver prevention services or that serve juveniles currently in the system:

Law Enforcement Unit Records Exception:
Law Enforcement Unit Records are defined by FERPA as “records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement.” FERPA permits the law enforcement unit to share their records with law enforcement agencies, human service programs, and other interested persons without parental or eligible student consent.

Any information from the education record that is shared with the law enforcement unit does not become part of the law enforcement unit record. Without prior parental consent, the law enforcement unit cannot disclose information that originates from the educational record (grades, absenteeism, disciplinary actions) to an unauthorized agency that does not fit into one of the FERPA statutory exceptions, such as the Health or Safety Emergency Exception.

State Law Juvenile Justice System Exception:
To the extent a State statute allows,
FERPA permits educators to share information with juvenile justice system agency officials about youth who are at risk of involvement or have become involved in the juvenile justice system, prior to adjudication.

If State law permits disclosure of school record information to a State or local juvenile justice system agency without prior parental or eligible student consent, juvenile justice professionals who receive this information from schools must certify in writing that all personally identifiable youth information will not be disclosed to a third party unless permissible by State law.

Health or Safety Emergency Exception:
When a health or safety emergency exists, FERPA permits schools to share relevant information about students without prior parental consent to appropriate school and law enforcement agencies in order to protect the health and safety of the student and/or other persons.

FERPA permits disclosure of disciplinary records for actions taken against the student for “conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community.”

Judicial Order/Lawful Subpoena Exception:
FERPA permits an educational agency or institution to disclose information in compliance with a judicial order or lawfully issued subpoena only after the agency makes a reasonable effort to notify the parent or eligible student of the order or subpoena. Notification in advance of compliance enables the parent or eligible student to seek protective action.

An educational institution may disclose student information without parental or eligible student consent when the disclosure is in compliance with: 1) a Federal grand jury subpoena and the court has ordered that the existence or the contents of the subpoena or the information furnished in response to the subpoena not be disclosed; or 2) any other subpoena issued for a law enforcement purpose and the court or other issuing agency has ordered that the existence or the contents of the subpoena or the information furnished in response to the subpoena not be disclosed.

If you were Karen’s supervisor, how would you respond to Karen?

Should Karen share this information with the professor? Is there a potential for harm if Karen shares this information? How would you decide?
Karen was right in questioning what she should do in this situation. Karen’s supervisor reminded her that student grade reports, attendance records, and school behavior information are collected for court-related decision-making, and remain an education record. Karen would be in violation of FERPA if she disclosed information from the school about the youth on her caseload to the professor (an unauthorized third party). Karen should not share the information with the university professor.

The U.S. Department of Education's Family Policy Compliance Office (FPCO) is charged with ensuring student and parental rights in education under the FERPA. http://www2.ed.gov/policy/gen/guid/fpco/index.html

HIPPA Privacy Rule excludes from its coverage those records that are protected by FERPA.
Most schools are not required to comply with the HIPAA Privacy Rule because health records maintained by a school are typically "education records" or "treatment records" of eligible students under FERPA, both of which are excluded from coverage under the HIPAA Security and Privacy Rules. Because student health information in education records is protected by FERPA, the HIPAA Privacy Rule excludes such information from its coverage. However, when a school provides health care to students in the normal course of the school day, such as an on-site health clinic, the school is also a "health care provider" as defined by HIPAA. Joint guidance on the Application of FERPA and HIPAA to student health records is available at http://www2.ed.gov/policy/gen/guid/fpco/doc/ferpa-hipaa-guidance.pdf

OJJDP Home | NCJJ Home | National Juvenile Court Data Archive | Site Map