What FERPA counts as PII, and where it hides in student records

FERPA protects the personally identifiable information in students' education records, and its regulations define that term in seven parts. Five are identifiers: the student's name, the names of parents and other family members, the student's or family's address, personal identifiers such as a Social Security or student number and indirect identifiers such as a date or place of birth. The other two are tests: any information that would let a reasonable person in the school community identify the student, and any information requested by someone the school reasonably believes already knows who the record is about.

The definition is short. Applying it is harder, because a student can still be recognized after every name is gone.

The seven parts of the definition

They come from 34 CFR 99.3, which says the term "includes, but is not limited to" the following.

1. The student's name. Initials and nicknames count too when people at the school would know who they mean, which the Department of Education says is often the case.
2. The names of the student's parents and other family members, a sibling or grandparent included.
3. The address of the student or the student's family.
4. Personal identifiers, such as a Social Security number, student number or biometric record. The regulation's examples of biometric records include fingerprints, voiceprints, facial characteristics and handwriting.
5. Other indirect identifiers, such as date of birth, place of birth and mother's maiden name. The Department adds race and ethnicity as examples.
6. Information that is linked or linkable to a specific student, alone or in combination, that would let a reasonable person in the school community, without personal knowledge of the circumstances, identify the student with reasonable certainty.
7. Information requested by someone the school reasonably believes knows the student's identity. The Department calls this a targeted request.

Linkable information and targeted requests

The Department explained the last two parts when it added them in its 2008 FERPA rule. Removing names and ID numbers, it said, doesn't necessarily stop a record from identifying a student: address, race, gender, physical description, disability, activities and disciplinary actions can do it in combination.

The yardstick is a reasonable person in the school community, not the wider town. In the Department's example, if the high school's students, teachers, parents and coaches all know that a student was caught bringing a gun to class, the district can't disclose that a student was suspended for it, even if most of the town couldn't say who. Local news coverage counts too, and the Department has said families generally don't waive FERPA by talking to the media.

Paragraph (g) covers what (f) doesn't. Asked for the redacted transcript of a particular student, a school gains nothing by removing the name, because the requester already knows whose transcript it is. The school needn't investigate anyone's motives, only act on what the request makes obvious or the requester says.

Directory information, and the students who opted out

A school may designate some PII as directory information, such as name, address, photograph, date and place of birth, grade level and sports, and disclose it without consent. First it must give public notice of what it designates and how parents and eligible students (those who are 18 or attend a postsecondary institution) can opt out, under 34 CFR 99.37. Two limits matter when redacting:

• A Social Security number can never be directory information. A student ID number can be only if it can't open education records without a PIN, password or similar factor.
• A student who opted out keeps that information protected, and an opt-out made while the student attended still holds after they leave.

Records about more than one student

When a record covers several students, a parent may inspect only the information about their own child (34 CFR 99.12(a)). The 2008 rule shows where that line falls. "John grabbed Michael's backpack and hit him over the head with it" relates directly to both boys, so both sets of parents may see it. A second sentence, about John punching a third student, isn't directly related to Michael, and because Michael's parents likely heard about it from their son, no part of it goes to them, even with the names removed. John's sanction generally isn't directly related to Michael either, unless it orders John to stay away from him.

Video works the same way. The Department's guidance on photos and videos treats a surveillance video of two students fighting, kept to discipline them, as the education record of both. Where the other student can reasonably be redacted without destroying the meaning, the school must do it, and can't charge the parent for it.

Where student identities leak

Student records are written in teachers', counselors' and nurses' own words, and many describe several children at once.

Incident reports and rosters

A discipline referral names the student referred, the student on the receiving end and the classmates who saw it: "During B lunch, Jordan shoved Malik Turner into the vending machine. Sofia Reyes and lunch aide Ms. Patel saw it." Each family is entitled to a different version of that page. Malik's parents, for example, can't be shown Sofia's name or Jordan's suspension.

Descriptions that point to one child

Notes identify students without naming them: "the only seventh grader on varsity", "the boy in Room 12 who uses a wheelchair", "picked up by her grandmother, Elena; dad is the assistant fire chief". Whether a detail like that identifies a student depends on what people at that school know, so it takes someone who knows the school to judge.

Scanned forms and handwriting

Accommodation plans, permission slips and older cumulative folders often exist only as scans, and a text search finds nothing on them until OCR reads the page. Parents' signatures spell out family names. Handwriting is also one of the regulation's examples of a biometric record, so a page in the student's own hand can identify them with the name removed.

Photos and video stills

Student photos turn up on rosters, health forms and ID badges, and discipline files can carry stills from hallway cameras. A photo the school keeps is an education record of each student it's directly related to, such as the students it was used to discipline or the student who is its focus. Students caught only in the background generally aren't.

The file itself

A filename such as ellis_jordan_referral.pdf names the student before anyone opens it. Document properties, comments, tracked changes and fillable form fields can carry what you removed from the page.

A checklist before a record leaves the district

• Every student the record mentions has been found, not only the one it's about.
• Other students' information is removed wherever that leaves the record's meaning intact.
• Family names, addresses, ID numbers and dates and places of birth are gone.
• Nicknames and descriptions have been read by someone who knows what the school community would recognize.
• Scanned pages have been read by OCR, and handwriting, signatures and photos have been checked.
• Directory information goes out only for students who haven't opted out.
• No redacted copy has gone to an outside requester who already knows whose record it is.
• The filename, document properties and comments are clean, and redacted text is removed, not covered.

Where DocArmor fits

DocArmor's Educational Records (FERPA) template covers student names and IDs, family and guardian names, grades, accommodations, disciplinary records and financial aid or lunch status. For a parent's request, add a plain-English instruction such as "every student except Jordan Ellis", and every other student on the roster or incident report is redacted. OCR reads scanned forms, visual detection finds signatures and photos, and every finding goes to a reviewer before export, because whether a detail points to one child in your school community is a judgment a person has to make.

This post is general information about FERPA, not legal advice. Check your state's student privacy and public records laws, and your district's own policies.