Confidentiality of a special education student’s personally identifiable information is protected under both the Family Educational Rights and Privacy Act (“FERPA”), 20 U.S.C. § 1232g; 34 CFR Part 99 and the IDEA.
FERPA and the IDEA provide parents and eligible (or adult) students the right to have access to the student’s education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the student’s education records. Under FERPA and the IDEA, all education records related to the identification, evaluation, educational placement, or provision of a FAPE to a student with a disability are confidential.
The District must protect the confidentiality of a student’s personally identifiable information at the collection, storage, disclosure, and destruction stages. Personally identifiable information includes, but is not limited to:
The student’s name;
The name of the student’s parent or other family members;
The address of the student or student’s family;
A personal identifier, such as the student’s social security number, student identification number, or biometric record;
Other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name;
A list of personal characteristics or other information that would make it possible to identify the child with reasonable certainty;
Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or
Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.
A parent or eligible student must provide consent before District Personnel may disclose personally identifiable information from the student’s education records, unless one of the exceptions to FERPA’s general consent rule applies. See [CONSENT FOR DISCLOSURE OF CONFIDENTIAL INFORMATION] and [WHEN CONSENT IS NOT REQUIRED TO DISCLOSE INFORMATION].
Additionally, the District is required to maintain a current listing of the names and positions of District and Campus Personnel who may have access to a student’s personally identifiable information for public inspection. The District must assign one official from within the District to assume responsibility for ensuring the confidentiality of all students’ personally identifiable information.
Further, all individuals collecting or using a student’s personally identifiable information must receive training or instruction regarding the state’s policies and procedures to protect the confidentiality of the student’s personally identifiable information collected, used, or maintained by the District. This training must include training under the IDEA’s confidentiality provisions as well as FERPA.
Covered student information created by, provided to, or gathered by an operator of a website, online service, online application, or mobile application which is used primarily for a school purpose and was designed and marketed for a school purpose must be kept confidential by the operator. Specifically, an operator must implement and maintain reasonable security procedures and practices designed to protect any covered information from unauthorized access, deletion, use, modification, or disclosure. An operator also may not knowingly engage in targeted advertising on any website, online service, online application, or mobile application where the target of the advertising is based on any information, including covered information and persistent unique identifiers, that the operator has acquired through the use of the operator’s website, online service, online application, or mobile application for a school purpose. Likewise, an operator may not knowingly use information, including persistent unique identifiers, created or gathered by the operator’s website, online service, online application, or mobile application, to create a profile about a student—unless the profile is created for a school purpose. Finally, an operator may not knowingly sell or rent any student’s covered information, unless it involves:
The purchase, merger, or any other type of acquisition of an operator by any entity, if the operator or successor entity complies regarding previously acquired student information; or
A national assessment provider if the provider secured the express affirmative consent of the student or the student’s parent, given in response to clear and conspicuous notice, and if the information is used solely to provide access to employment, educational scholarships, financial aid, or postsecondary educational opportunities.
So long as the operator complies with rules regarding the redisclosure of records, an operator may use or disclose covered information for the following purposes:
To further a school purpose on the website, online service, online application, or mobile application, and the recipient of the covered information does not further disclose the information—unless the disclosure is to allow or improve operability and functionality of the operator’s website, online service, online application, or mobile application;
To ensure legal and regulatory compliance;
To protect against liability;
To respond to or participate in the judicial process;
To protect the safety and integrity of users of the website, online service, online application, or mobile application;
To satisfy a school, education, or employment purpose requested by the student or the student’s parent, and the information is not used or disclosed for any other purpose;
For a legitimate research purpose, a school purpose, or postsecondary educational purpose;
For a request by the District for a school purpose;
If the provision of federal or state law requires the operator to disclose the information;
To a third party if the operator has contracted with the third party to provide a service for a school purpose for or on behalf of the operator, so long as the contract prohibits the third party from using any covered information for any purpose other than providing the contracted service. The operator must require the third party to implement and maintain reasonable procedures and practices designed to prevent disclosure of covered information;
To recommend to a student additional services or content relating to an educational, learning, or employment opportunity within a website, online service, online application, or mobile application if the recommendation is not determined by payment or other consideration from a third party;
For development and improvement of educational websites, online services, online applications, or mobile applications, if the covered information is not associated with an identified student;
By authority of a law enforcement agency to obtain any information from an operator as authorized by law or under a court order;
For adaptive learning or customized student learning purposes; or
For maintaining, developing, supporting, improving, or diagnosing the operator’s website, online service, online application, or mobile application.
See [REDISCLOSURE OF RECORDS].
“Eligible student” means a student who has reached 18 years of age or is attending an institution of postsecondary education.
“Operator” is, to the extent operating in this capacity, the operator of a website, online service, online application, or mobile application who has actual knowledge that the website, online service, online application, or mobile application is used primarily for a school purpose and was designed and marketed for a school purpose.
“Covered information” is personally identifiable information or information that is linked to personally identifiable information, in any media or format, that is not publicly available and is:
Created by or provided to an operator by a student or the student’s parent in the course of the student’s or parent’s use of the operator’s website, online service, online application, or mobile application for a school purpose;
Created by or provided to an operator by an employee of a school district or school campus for a school purpose; or
Gathered by an operator through the operation of the operator’s website, online service, online application, or mobile application for a school purpose and personally identifies a student, including the student’s educational record, electronic mail, first and last name, home address, telephone number, electronic mail address, information that allows physical or online contact, discipline records, test results, special education data, juvenile delinquency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, student identifiers, search activity, photographs, voice recordings, or geological information.
“School purpose” is a purpose that is directed by or customarily takes place at the direction of a school district, school campus, or teacher or assists in the administration of school activities, including instruction in the classroom or at home, administrative activities, and collaboration between students, school personnel, or parents, or is otherwise for the use and benefit of the school.
“Targeted advertising” means presenting an advertisement to a student in which the advertisement is selected for the student based on information obtained or inferred over time from the student’s online behavior, usage of applications, or covered information. Targeted advertising does not include advertising to a student at an online location based on the student’s visit to that location at that time, or in response to the student’s request for information or feedback, without the retention of the student’s online activities or requests over time for the purpose of targeting subsequent advertisements.
Generally, education records under FERPA are those records, files, documents, and other materials which contain information directly related to a student and are maintained by the District or by a party acting for the District. Education records include but are not limited to grades, transcripts, class work, course schedules, health records, enrollment records, special education records, and communications (emails, texts, notices) about a student.
The term “education records” does not include:
Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the record;
Records maintained by a law enforcement unit of the District that were created by that law enforcement unit for the purpose of law enforcement (this exclusion does NOT include records maintained by school personnel for disciplinary or other purposes, even if such records were created by the law enforcement unit and it does NOT include records maintained and/or created by the law enforcement unit for disciplinary purposes);
Records relating to an individual who is employed by the District that are made and maintained in the normal course of business of the District, related exclusively to the individual in that individual’s capacity as an employee, and are not available for use for any other purpose;
Records on a student who is 18 years of age or older that are made or maintained by a physician, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assisting in a paraprofessional capacity; made, maintained, or used only in connection with treatment of the student; and disclosed only to individuals providing the treatment. However, “treatment” does not include remedial educational activities or activities that are part of the program of instruction at the District;
Records created or received by the District after an individual is no longer a student in attendance and that are not directly related to the individual’s attendance as a student; or
Grades on peer-graded papers before they are collected and recorded by a teacher.
Education records means any information recorded in any manner, including, but not limited to handwriting, print, computer media, video or audio recording, film, microfilm, or microfiche.
The District must provide parents of special education students or adult students on request a list of the types of education records collected, maintained or used by the District.
The confidentiality of personally identifiable student information is protected in the District. Such records are collected and maintained only for the purpose indicated, and all District Personnel are trained to use personal data with the greatest respect of parent and student rights. All education records regarding the identification, evaluation, placement or the provision of FAPE for a student are regarded and treated by all District Personnel as confidential under state and federal law.
Campus Personnel must ensure that all personally identifiable information of a student with a disability is retained in accordance with applicable state and federal laws. District or Campus Special Education Personnel will maintain in the student’s eligibility folder a current listing of the names and positions of all District and Campus Personnel who have accessed the student’s eligibility folder.
Furthermore, District and Campus Personnel must understand that they are expected to exercise extreme caution to ensure that the names of students receiving special education services are not displayed and that these students are not specifically identified as students who receive special education services.
To best ensure confidentiality, a student’s full name should not be used in the subject line of an email.
District or Campus Personnel will ensure that a parent or representatives of the parent have the right to view all records, including:
The right to a response from District or Campus Personnel having possession of such records;
The right to a reasonable explanation or interpretation of the records;
The right to request copies of school records;
The right to know who has seen their records;
The right to restrict access to their student’s records by withholding consent to release records; and
The right to examine, within 45 days of their request, any records relating to the education of their student unless the school district has been advised that the parent does not have authority under applicable laws governing such matters as guardianship, foster parent placement, separation, and student custody.
The District must comply with all requirements under Part B of the IDEA, including those Part B Confidentiality of Information regulations that restate or paraphrase FERPA requirements. Part B Confidentiality of Information regulations contain several provisions that are tailored specifically to the special education environment. Public agencies and other participating agencies, as defined under Part B of the IDEA, are subject to the Part B Confidentiality of Information regulations, even FERPA is not applicable to such agencies.
The Texas Education Agency is responsible for implementing and enforcing Part B of the IDEA, including the Confidentiality of Information provisions. Thus, the Texas Education Agency sets forth the State complaint procedures for resolving complaints related to such provisions.
All District or Campus Personnel using or collecting personally identifiable information must receive training regarding the District’s and state’s policies and procedures to ensure protection of the confidentiality of any personally identifiable information collected, used, or maintained under the IDEA. District Administration will ensure that all District and Campus Personnel are informed of these confidentiality requirements.
To promote student safety, the District shall comply with written requests for video and audio surveillance from authorized individuals of certain self-contained special education classrooms in accordance with Texas Education Code 29.022 and District policy. District Personnel are not required to obtain the consent of a student’s parent or adult student before the employee may make a videotape of a student or authorize the recording of a student’s voice if the videotape or voice recording is to be used for a purpose related to the promotion of student safety under Texas Education Code Section 29.022.
An authorized individual who may request video surveillance for a specific classroom includes a parent of a student who receives special education services in that classroom, a staff member assigned to work in that classroom, or the principal or assistant principal for that campus. In addition, the board of trustees or governing body may request that video surveillance be provided to one or more specified schools or campuses at which one or more children receive special education services in self-contained classrooms or other special education settings.
Upon written request from an authorized individual, the District shall provide equipment, including a video camera, to the campus specified in the request. A campus that receives such equipment shall place, operate, and maintain one or more video cameras in self-contained classrooms and other special education settings in which a majority of the students in regular attendance are provided special education and related services and are assigned to one or more self-contained classrooms or other special education settings for at least 50 percent of the instructional day, so long as:
The campus that receives equipment as a result of the request by a parent or staff member is required to place equipment only in classrooms or settings in which the parent’s student is in regular attendance or to which the staff member is assigned; and
The campus that receives equipment as part of the request by the Board of Trustees, Campus Principal, or Campus Assistant Principal is required to place equipment only in classrooms or settings identified by the requestor, if the requestor limits the request to specific classrooms or settings or settings subject to Education Code 29.022.
A campus shall operate and maintain the camera in the classroom or setting as long as the classroom or setting continues to satisfy the above requirements, for the remainder of the school year in which the campus received the request, unless the requestor withdraws the request in writing.
Before a campus activates a video camera in a classroom or special education setting, the campus shall provide written notice of the placement to all campus staff and to the parents of each student attending class or engaging in school activities in the classroom or setting. If for any reason a campus will discontinue operation of a video camera during a school year, not later than the fifth school day before the date the operation of the video camera will be discontinued, the campus must notify the parents of each student in regular attendance in the classroom or setting that operation of the video camera will not continue unless requested by a person eligible to make a request. Not later than the tenth school day before the end of each school year, the campus must notify the parents of each student in regular attendance in the classroom or setting that operation of the video camera will not continue during the following school year unless a person eligible to make a request for the next school year submits a new request.
Video recordings made in accordance with Section 29.022 shall be confidential and shall only be accessed or viewed by authorized individuals and only under the limited circumstances permitted by law. The District may not allow regular or continual monitoring of video records under Section 29.022 or use video for teacher evaluation or for any purpose other than the promotion of safety of students receiving special education services.
The District may only release a recording for viewing when an “incident” defined by law is alleged to have occurred. An “incident” is defined as “an event or circumstance that involved alleged abuse or neglect as described in Texas Family Code 261.001, of a student by a staff member of the district or alleged physical abuse or sexual abuse, as described in Texas Family Code 261.410, of a student by another student.”
If an incident is determined to have occurred, the District shall release a recording of the incident for viewing by:
(1) An employee who is involved in an alleged incident that is documented by the recording and has been reported to the District or school, on request of the employee;
(2) A parent of a student who is involved in an alleged incident that is documented by the recording and has been reported to the District or school, on request of the parent;
(3) Appropriate Department of Family and Protective Services Personnel as part of an investigation of alleged or suspected abuse or neglect of a child under Family Code 261.406;
(4) A peace officer, school nurse, or District or Campus Administrator trained in de-escalation and restraint techniques as provided by Commissioner rule, or Human Resources Personnel designated by the District’s Board of Trustees in response to a report of an alleged incident or an investigation of District or Campus Personnel or a report of alleged abuse committed by a student; or
(5) Appropriate agency of State Board of Educator Certification Personnel or agents as part of an investigation.
A contractor or employee performing job duties relating to the installation, operation, or maintenance of video equipment or the retention of video recordings who incidentally views a video is not in violation of these confidentiality provisions. However, even if the individual is eligible to view the recordings, the District may not release the recordings for viewing if prohibited to do so under FERPA.
Moreover, if an authorized individual listed in (3), (4) or (5) above who views the recording believes that the recording documents a possible violation of District or Campus policy, the person may allow access to the recording to appropriate legal and human resources personnel to the extent not limited by FERPA or other law. A recording believed to document a possible violation of District or Campus policy relating to the neglect or abuse of a student may be used as part of a disciplinary action against District or Campus Personnel and shall be released at the request of the student’s parent in a legal proceeding.
This does not limit the access of the student’s parent to a record regarding the student under FERPA. While these video recordings are generally considered surveillance videos and do not constitute a student’s education record subject to disclosure in response to a request made under FERPA, if the alleged incident is documented on the video recording or the student otherwise becomes the focus of the recording, such video is a student record under FERPA.
FERPA does not require the District to notify a parent or eligible student that information from the student’s education records was stolen or otherwise subject to unauthorized release. However, the District must maintain a record of each disclosure. The District should consider informing the parent or eligible student if data, including the student’s Social Security Number and other identifying information that could lead to identity theft, is accidentally released.
A failure to take reasonable and appropriate steps to protect education records could result in the release or disclosure of personally identifiable information from education records. This may constitute a policy or practice of permitting the release or disclosure of education records in violation of FERPA. Should the U.S. Department of Education investigate a complaint against the District or other indications of noncompliance by the District, the District must be able to show the steps it has taken in response to a data breach or other unauthorized access to, release, or other disclosure of education records.
Protection of Personally Identifiable Information
List of Types and Locations of Education Records
Procedures for Collecting, Storing, and Maintaining Student Records
List of District and Campus Personnel Who May Access Records
Designated Official to Ensure Confidentiality of Personally Identifiable Information
Records of Training Related to Confidentiality
Access Audit Logs in Student Information System
Access Logs for Special Education Folders
Requests for Viewing Recordings
District or Campus Websites
Authorized Disclosures by Operators
Record Request Form
Consent for Disclosure of Information
Protecting Student Privacy - U.S. Department of Education
OSEP Letter to Anonymous (Apr. 9, 2012) - U.S. Department of Education
OSEP Letter to Copenhaver (Apr. 17, 2008) - U.S. Department of Education
OSEP Letter to Anderson (March 7, 2008) - U.S. Department of Education
Student Records FAQ's - Texas Education Agency
FPCO Letter to Tobias (May 8, 2015) - U.S. Department of Education
Information Security Handbook: A Guide for Managers - National Institute of Standards and Technology
Identity Theft - U.S. Department of Education
Board Policy FL and EHBAF; 20 USC 1232g; 34 CFR 99.2, 99.3; 99.32, 300.32; 300.610, 300.623, 300.626; Texas Education Code 29.022, 32.151–32.157; Texas Administrative Code 103.1301