No-18-01 (PDF)

CYNTHIA H. COFFMAN Attorney General MELANIE J. SNYDER Chief Deputy Attorney General LEORA JOSEPH Chief of Staff FREDERICK R. YARGER Solicitor General [LOGO] # STATE OF COLORADO DEPARTMENT OF LAW RALPH L. CARR COLORADO JUDICIAL CENTER 1300 Broadway, 10th Floor Denver, Colorado 80203 Phone (720) 508-6000 Office of the Attorney General | FORMAL | ) | | --- | --- | | OPINION | ) | | | ) | | of | ) | | | ) | | CYNTHIA H. COFFMAN | ) | | Attorney General | ) | No. 18-01 January 11, 2018 This Opinion provides general guidance regarding the Family Educational Rights Privacy Act, 20 U.S.C. § 1232g (“FERPA”), a federal statute governing privacy of student records. The Opinion addresses misconceptions about FERPA’s scope to assure teachers, administrators, and other school staff that they may proactively respond to safety concerns, including threats of school violence, without violating students’ and families’ privacy rights. The Opinion also explains what information Colorado schools may obtain from juvenile courts and law enforcement agencies to assist in evaluating school safety risks. For answers to specific questions regarding FERPA compliance, including questions beyond the scope of this Opinion, schools and districts should consult counsel. This Opinion focuses on the K-12 school environment. FERPA questions specific to higher education are beyond the scope of this Opinion. ## OVERVIEW Reports analyzing recent campus shootings observe that educators in Colorado and elsewhere often misunderstand the scope and meaning of FERPA. Teachers and administrators fear that by responding proactively to threats of school violence, they may run afoul of federal privacy laws. This Opinion seeks to dispel these misunderstandings and to prevent unfounded 1 privacy concerns from hampering school violence prevention. When deciding whether to share student information with other school staff or outside agencies, educators should remember the following guidelines, which are discussed and analyzed more fully in the body of this Opinion: - Not all student information is an “education record” subject to FERPA’s privacy restrictions. For example, without implicating FERPA, educators may share the following information with other educators and with law enforcement personnel: - observations and other personal knowledge about a student’s behavior (for example, behavior a teacher sees or overhears); - reports, whether written or spoken, about a student from a student’s friends or peers; - threats of violence or other information shared on social media platforms like Facebook or Twitter; and - records created and kept by school security personnel. - Even “education records” may be disclosed without parental consent in certain circumstances. For example: - FERPA does not prevent school staff from sharing education records with other school personnel who have “legitimate educational interests” in the information. - In response to health or safety emergencies, schools may share FERPA-protected education records with those outside the school who can help protect the school and its students. - Educators can and should err on the side of safety. - Neither a school nor a school employee can be sued for claimed violations of FERPA. Only federal officials have the right to enforce FERPA and, in doing so, they must focus on systemic violations, not good-faith mistakes. - Amendments to FERPA regulations have broadened the emergency exception, making clear that federal regulators will defer to the reasonable judgment of educators confronted with potential safety risks. 2 - Colorado law encourages law enforcement agencies and school districts to share information. Schools may obtain a variety of information from state law enforcement and juvenile justice agencies to help keep their campuses safe. Included at the end of this Opinion is a list of “Frequently Asked Questions” about FERPA, designed to help school officials understand how FERPA operates in practice. ## BACKGROUND Congress enacted FERPA to “protect [students’] right to privacy by limiting the transferability of their records.” United States v. Miami Univ., 294 F.3d 797, 817 (6th Cir. 2002) (internal quotation marks omitted; alteration in original). To serve this purpose, FERPA generally prohibits schools from releasing information in a student’s “education records” without obtaining written consent from the student’s parents. 20 U.S.C. § 1232g(b)(1).¹ This general rule against disclosure is not absolute, however. Not all information that comes into the hands of an educator, administrator, or other school staff member is an “education record” subject to FERPA’s restrictions. And even education records may be disclosed without parental consent under certain circumstances, including when schools are presented with health or safety emergencies. These exceptions to FERPA are critically important: they ensure that FERPA’s goal of protecting student privacy does not prevent educators from appropriately responding to significant risks.² Yet FERPA’s exceptions are not always well understood. Some educators believe, incorrectly, that FERPA applies to any information about a student, including a teacher’s personal knowledge and observations. Some believe that they will be subject to lawsuits if they disclose student information, even in the ¹ This Opinion uses the term “education records” to refer both to education records themselves and to “personally identifiable information contained [in education records].” 20 U.S.C. § 1232g(b)(1). Both categories of information are equally subject to FERPA’s restrictions, and the distinction between the two is not relevant to the guidance in this Opinion. ² Experts have emphasized that information sharing is important in preventing school violence. See Report of Governor Bill Owens’ Columbine Review Commission 88 n.202, 108–10 (May 2001) Available at https://schoolshooters.info/sites/default/files/Columbine%20-%20Governor’s%20Commission%20Report.pdf (last visited Aug. 13, 2016) (“It is clear to the Commission … that police and school authorities must work cooperatively in assessing actual or potential threats to the safety of students and school personnel.”). 3 face of safety concerns. These misunderstandings have caused educators to question whether they can proactively respond to potential threats of school violence, as two recent tragedies demonstrate. In 2007, the Governor of Virginia commissioned a panel of experts to study a mass shooting at Virginia Polytechnic Institute and State University (“Virginia Tech”), in which 32 students lost their lives. Report of the Virginia Tech Review Panel Presented to Timothy M. Kaine, Governor, Commonwealth of Virginia, *Mass Shootings at Virginia Tech April 16, 2007* at 2 (August 2007).$^{3}$ While the study identified many factors as potentially contributing to the tragedy, confusion about FERPA was among them. The study highlighted “widespread confusion about what federal ... privacy laws allow,” including a failure to realize that “federal laws and their state counterparts afford ample leeway to share information in potentially dangerous situations.” *Id.* The report observed that, in the case of the Virginia Tech shooting, this confusion hampered effective information sharing, limiting opportunities to identify the gunman as a safety risk before he committed his acts of violence. In 2016, a report analyzing the circumstances leading to a shooting at Arapahoe High School in Centennial, Colorado, likewise cited misunderstandings about FERPA. Sarah Goodrum and William Woodward, *Report on the Arapahoe High School Shooting: Lessons Learned on Information Sharing, Threat Assessment, and Systems Integrity* (Jan. 18, 2016).$^{4}$ For example, school staff believed that under FERPA “they would be more liable if they had shared information about [the gunman’s] concerning behaviors, than if they had not.” *Id.* at 8–9. These mistaken assumptions included the belief that staff could not share information with others within the school itself. Staff believed that “they could not discuss a student’s concerning behaviors with other teachers or staff prior to the shooting because ... FERPA guidelines prohibited it.” *Id.* at 39. As one staff member put it, “[t]he school [was] somewhat confused on what FERPA is.” *Id.* $^{3}$ Available at http://www.governor.virginia.gov/TempContent/techPanelReport-docs/FullReport.pdf (last visited August 13, 2016). $^{4}$ Available at http://www.colorado.edu/cspv/publications/AHS-Report/Report_on_the_Arapahoe_High_School_Shooting_FINAL.pdf (last visited August 13, 2016). 4 # DISCUSSION AND GUIDANCE # I. FERPA restricts disclosure of information only if it qualifies as an “education record.” FERPA does not apply to any and all information about a student. It covers only “education records,” which are defined as “records, files, documents, and other materials” that “contain information directly related to a student” and are “maintained by an education agency or institution.” 20 U.S.C. § 1232g(a)(4). While this definition is broadly worded, it is not boundless in scope. The United States Supreme Court has held that FERPA is concerned mainly with “institutional records kept by a single central custodian, such as a registrar,” which would typically be “kept in a filing cabinet in a records room at the school or on a permanent secure database.” Owasso Indep. Sch. Dist. v. Flavo, 534 U.S. 426, 432–3, 434–35 (2002). In practice, this means that a significant amount of information relevant to school safety is outside the scope of FERPA and may be freely shared among educators and outside agencies, including law enforcement. Two particularly important categories of information are outside the scope of FERPA’s definition of “education records”: first, information an educator learns through personal observation, peer reports, or social media; and, second, records of a school’s security personnel, which are governed by a specific exception to FERPA. # A. Information about student behavior that an educator learns through observation, discussions with students, or social media is not subject to FERPA. Educators receive a significant amount of information in day-to-day interactions with students. This may include information relevant to evaluating present or future safety threats. Without implicating FERPA, educators may disclose this information to school staff, law enforcement agencies, or parents. Personal Observations. Information “obtained through [a] school official’s personal knowledge or observation” is not an “education record.” U.S. Dep’t of Educ., Addressing Emergencies on Campus 4 (June 2011).⁵ Nor are opinions about the significance or dangerousness of a student’s behavior. See Letter from Kathleen Wolan, Program Analyst, U.S. Dep’t of Educ., Office of ⁵ Available at http://rems.ed.gov/docs/ED_AddressingEmergenciesOnCampus.pdf (last visited Aug. 13, 2016). 5 Innovation and Improvement, Family Policy Compliance Office, to Anonymous 2 (Apr. 5, 2007) (hereinafter “FPCO Letter (Apr. 5, 2007)”). This includes a broad range of information, illustrated by the following examples. - “[A] teacher overhears a student making threatening remarks to other students.” U.S. Dep’t of Educ., Addressing Emergencies on Campus 4. - A school staff member finds a letter, drawing, or other document created by a student that indicates a possible safety threat—for example, a “hit list” written on the cover of a text book. Risica ex rel. Risica v. Dumas, 466 F. Supp. 2d 434, 437, 441–42 (D. Conn. 2006). - A student pulls an education aide’s hair, and the aide believes the student’s “behaviors [are] escalating,” that the student is “very strong,” and that the student will “continue[ ] to hurt people.” FPCO Letter 2 (Apr. 5, 2007). - A teacher notices a disturbing change in a student’s behavior or observes the student become withdrawn and uncommunicative. Cf. id.; Risica, 466 F. Supp. 2d at 441–42; U.S. Dep’t of Educ., Addressing Emergencies on Campus 4. In each of these circumstances, information about the student may be shared with others, including law enforcement officials, without implicating FERPA. Information Learned from a Student’s Peers. Students themselves may report information about other students, and that information may sometimes be relevant to assessing school safety. Because students are not “agents of [a] school” and do not “act[ ] for” an educational institution, peer reports, whether written or spoken, are not “education records.” Cf. Owasso Indep. Sch. Dst., 534 U.S. at 434–35 (holding that when students grade each other’s work, those grades are not subject to FERPA). Thus, if a student shares information with an educator that concerns another student and is potentially relevant to school safety, the educator may disclose that information without implicating FERPA. Social Media. “Almost every middle school [and] high school … student in the United States engages in some form of social media” such as Facebook and Twitter. Nat’l Center for Campus Pub. Safety, Guide to Social Media in 6 *Educational Environments* 2–3 (2016).$^{6}$ Students engage with online social media platforms constantly—sometimes “more than 100 times a day, ... even during school hours.” *Id.* at 2. Social media posts are often publicly viewable and include observations about students’ school experiences. Students “post things they’d never say in person,” and may even post information that foreshadows “threats of mass violence on campuses or proposed violence toward specific individuals or groups.” *Id.* at 2, 5. Social media posts are not restricted from disclosure under FERPA. They fall outside the definition of “education records” because they are not “maintained” by schools and are created by students, not school staff. *Cf. Owasso Indep. Sch. Dist.*, 534 U.S. at 434–35. Thus, a school official may disclose the existence and content of social media posts. # **B. FERPA contains a specific exclusion for records maintained by school security personnel, which may be disclosed without parental consent.** Many schools employ staff tasked with maintaining campus security. Under FERPA, investigative reports and other records created and maintained by a school’s security staff are specifically excluded from the definition of “education records.” 20 U.S.C. § 1232g(a)(4)(ii)(B)(II). These records are therefore exempt “from the privacy requirements of FERPA” and may be disclosed without parental consent. U.S. Dep’t of Educ., *Addressing Emergencies on Campus* 5. To qualify as a FERPA-exempt “law enforcement record,” the record must be (1) created by a “law enforcement unit”; (2) created for a “law enforcement purpose,” and (3) maintained by the law enforcement unit. 34 C.F.R. § 99.8(b)(1). The term “law enforcement unit” is not limited to a formal department staffed by commissioned police officers or school resource officers (“SROs”). It may simply be a “component” of the school staffed by “security guards” or others designated to “maintain the physical security and safety of the [school].” 34 C.F.R. §99.8(a)(1). Taken together, these provisions mean that if school security personnel conduct an investigation into an event—for example, an allegation that a student possessed a weapon—and create a report, that report may be disclosed without implicating FERPA. Only if a copy of the report becomes part of an education record (a disciplinary file, for instance) does it become subject to FERPA’s privacy restrictions. *Compare Bryner v. Canyons Sch. Dist.*, 351 P.3d $^{6}$ Available at http://www.nccpsafety.org/assets/files/library/NCCPS_Guide_to_Social_Media.pdf (last visited Aug. 13, 2016). 7 852, 858–59 (Utah App. 2015) (holding that a video recording of a student fight was an education record because it was maintained by the school district for disciplinary reasons as part of student education records), *with In re Rome City Sch. Dist. v. Grifasi*, 806 N.Y.S.2d 381, 383 (N.Y. Supp. Ct. 2005) (holding that a surveillance video was exempt from FERPA because it “was recorded to maintain the physical security and safety of the school building and [did] not pertain to the educational performance of the students captured on th[e] tape”). Even then, only the copy maintained as an education record (for example, as a student disciplinary record) is subject to FERPA. 34 C.F.R. § 99.8(b)(2)(i). The original report, if maintained by the school’s law enforcement unit, may still be disclosed without parental consent. ## II. Even “education records” may be disclosed in certain circumstances. While not all information is an education record under FERPA, even education records themselves may be disclosed without parental consent under certain circumstances. Two of FERPA’s exceptions assist schools in sharing information regarding threats to school safety and are relevant here: the “emergency” exception and the “school official” exception. Additionally, schools should be aware that they are required to share certain student information with law enforcement agencies under Colorado law. They should also understand that health records in a school’s possession are subject to FERPA, not federal medical privacy laws. ### A. Schools may disclose protected information to respond to a health or safety emergency. School officials may disclose education records without parental consent “to appropriate persons” if the disclosure “is necessary to protect the health or safety of the student or other persons” and is “in connection with an emergency.” 20 U.S.C. § 1232g(b)(1)(I); 34 C.F.R. § 99.36. This emergency exception is “flexible” and allows “school administrators to ... bring appropriate resources to bear on the situation.” U.S. Dep’t of Educ., *Addressing Emergencies on Campus 4*. In applying this exception, schools should not adopt an overly restrictive approach to determining what qualifies as an “emergency.” Federal regulations make clear that a school’s actions will not be second-guessed based on information and understandings that may become clear only later. The school need only “articula[te]” a “significant threat to the health or safety of a student or other individuals,” and it may make its judgment “based on the information available at the time.” 34 C.F.R. § 99.36(c). The school may “take 8 into account the totality of the circumstances” to reach its decision. Id. Further, a school needs only a “rational basis” for the decision to disclose records; the federal government “will not substitute its judgment” for the school’s. Id. In plain terms, this means “simply ... that a school official [must] be able to express in words what leads the official to conclude that a student poses a threat.” Family Educational Rights and Privacy, 73 Fed. Reg. 74,806, 74,838 (Dec. 9, 2008).7 Schools also should not delay disclosure until an emergency has materialized. School officials “must be able to release information from education records in sufficient time ... to keep persons from harm or injury.” Id. An “emergency” may thus arise not just from an immediate, ongoing incident, but from less immediately urgent circumstances, such as a change in a student’s behavior: [a]n emergency could ... be a situation in which a student gives sufficient, cumulative warning signs that lead an educational agency or institution to believe the student may harm himself or others at any moment. Id. Neither a “red alert” nor a “gun in the hall” is required; schools may take steps early enough to prevent a dangerous situation from arising. Finally, disclosure need not be limited to those “responsible for providing the protection” necessary to respond to an immediate danger. Id. Under the emergency exception, schools may “disclose ... education records in order to gather information from any person who has information that would be necessary to provide the requisite protection.” Id. at 74,838–39. This includes: - disclosures to current or former peers of the student or mental health professionals “who can provide ... appropriate information to assist in protecting against the threat”; - disclosures to law enforcement officials who “may be helpful” in providing protection; or 7 For example, if a student has had a medical procedure such as hand surgery, it is permissible for a school’s physical therapist to share information with a student’s doctor to assist in ensuring adequate follow-up medical care. Letter from Ellen Campbell, Acting Director, U.S. Dep’t of Educ., Family Policy Compliance Office, to Anonymous 2 (Dec. 20, 2010). 9 - disclosures to “a potential victim or the parents of a potential victim ... whose health or safety may need to be protected.” Id. at 74,839. ### B. Education records may be shared among school staff with a legitimate educational interest in the information. FERPA does not require parental consent when schools share education records among “school officials” who have a “legitimate educational interest” in the information. 34 C.F.R. § 99.31(a)(1)(i)(A). The meaning of these terms is broad, making this exception an important tool for addressing concerns relevant to school safety. The term “school officials” is not limited to administrators and teachers. It includes all staff members who “need access to students’ education records to perform their duties” or need the information “in order to perform ... required institutional services and functions for the school.” Family Educational Rights and Privacy, 73 Fed. Reg. at 74,814. Thus, school security staff fall within the exception and may receive information helpful in maintaining campus safety and security. Id. at 74,815 (“As school officials, [security personnel] may be given access to personally identifiable information from those students’ education records in which the school has determined they have legitimate educational interests.”). “School officials” may also include those who are not formally employed by a school, such as “parents and other volunteers who assist schools in various capacities, such as serving on official committees, serving as teachers’ aides, and working in administrative offices.” Id. at 74,814. If a school uses a threat assessment team, members of the team may likewise receive education records in carrying out their school safety functions. Id. at 74,839. This exemption is subject to two notable qualifications. First, “school officials” may “access ... only those education records in which they have legitimate educational interests.” 34 C.F.R. § 99.31(a)(1)(ii). But, again, “educational interests” include maintaining the safety of students and the security of campus. See Family Educational Rights and Privacy, 73 Fed. Reg. at 74,815. Second, each year, schools must notify parents of their rights under FERPA, and this annual notification must include criteria for determining who qualifies as a “school official” with access to education records. 34 C.F.R. § 99.7(a)(1). 10 ### C. Colorado schools must share education records with law enforcement agencies conducting criminal investigations. FERPA allows schools to share education records with criminal justice agencies if authorized by state law and if the “disclosure concerns the juvenile justice system and such system’s ability to effectively serve the student whose records are released.” 20 USC § 1232g(b)(1)(E). Colorado’s Children’s Code includes provisions allowing for the reciprocal sharing of information between schools and juvenile justice system in juvenile delinquency or dependency and neglect cases as needed to facilitate services and support. § 19-1-303(1)(a), C.R.S. (2015). The Colorado statute requires schools to share “disciplinary and truancy information” upon the request of a criminal justice agency, if the agency is investigating a criminal case or a truancy matter. § 19-1-303(2)(c), C.R.S. (2015). The criminal justice agency may use the information only for the performance of its legal duties and must maintain its confidentiality. Id. ### D. Health information maintained by a school is part of the student’s education record and subject to FERPA, not to HIPAA. Some educators mistakenly believe that the federal Health Insurance Portability and Accountability Act (“HIPAA”) applies to all medical records in a school’s possession and therefore imposes special privacy restrictions on those records. In fact, medical records in a school’s possession are treated as education records and are subject to FERPA’s disclosure framework. See 45 C.F.R. § 160.103 (defining “protected health information” as excluding health information contained in education records covered by FERPA). Thus, according to the Department of Education, “[medical] treatment records may be disclosed to any party, without consent, as long as the disclosure meets one of the exceptions to FERPA’s general consent rule.” U.S. Dep’t of Educ., Addressing Emergencies on Campus 10. ### III. When faced with potential safety risks, schools may, consistent with FERPA, err on the side of proactive disclosure. In attempting to balance FERPA’s policy of promoting student privacy against the need to address school safety concerns, educators should err on the side of disclosure. The United States Department of Education has made clear through revised regulations that it will not second-guess judgments made on the ground in the face of a potential emergency. 34 C.F.R. § 99.36(c). Additionally, FERPA does not give students or parents the right to file a lawsuit and it applies only to systemic violations of student privacy, not good-faith mistakes in judgment. 11 A. Under current FERPA regulations, schools are entitled to deference when they decide to disclose education records in the face of safety concerns. The United States Department of Education previously took the position that FERPA's emergency exception was to be "strictly construed" and that emergency disclosures were to be "narrowly tailored." See, e.g., U.S. Dep't of Educ., Recent Amendments to Family Educational Rights and Privacy Act Relating to Anti-Terrorism Activities 3 (Apr. 12, 2002). This position shifted in the wake of the Virginia Tech shooting. In 2008, the Department of Education issued new rules "to eliminate[ ] the previous requirement that [the emergency exception] be 'strictly construed.'" Family Educational Rights and Privacy, 73 Fed. Reg. at 74,837. The amendment recognizes that school officials must "act quickly and decisively when emergencies arise" and accordingly "provides greater flexibility and deference to school administrators." Id. The current version of the regulation specifically requires the Department to defer to schools: "the Department will not substitute its judgment for that of the [school] in evaluating the circumstances and making its determination [that an emergency existed]." 34 C.F.R. § 99.36(c). B. Schools and school officials cannot be sued by parents or students for FERPA violations. One apparent misconception about FERPA is that a good-faith but technically unauthorized disclosure of information can lead to significant liability on the part of schools or individual teachers. But parents and students may not sue under FERPA for an unauthorized disclosure of protected information. Gonzaga Univ. v. Doe, 536 U.S. 273, 287 (2002). Only the United States Department of Education may enforce FERPA, and it must do so within FERPA's administrative framework. Further, that framework focuses on "systemic" violations of student privacy, not isolated mistakes. Jensen v. Reeves, 45 F. Supp. 2d 1265, 1276 (D. Utah 1999). Enforcement proceedings are reserved for educational institutions which have a "policy or practice" of disclosing information without consent. 20 U.S.C. § 1232g(a)(1)(b). Educators should not fail to act out of an unreasonable concern that technical violations of FERPA will lead to severe legal consequences. 12 #### IV. Colorado law gives schools access to criminal justice information which can assist in risk assessment. In 2000, the Colorado General Assembly passed the Exchange of Information Related to Children Act⁸ (the “Information Act”) as an amendment to the Colorado Children’s Code. § 19-1-301, C.R.S. (2015). The Information Act authorizes schools and school districts to obtain information from law enforcement and criminal justice agencies, based on the assumption that schools “are often better able to ... preserve school safety when they are equipped with knowledge concerning a child’s history and experiences.” § 19-1-302(1)(b), C.R.S. (2015). Under the Information Act, schools may receive information about a student, except mental health or medical records, relating to an incident that “rise[s] to the level of a public safety concern.” § 19-1-303(2)(b)(I), C.R.S. (2015). The disclosing criminal justice agency has discretion to determine what constitutes a public safety concern, but the Information Act specifies some examples: - “information or records of threats made by the [student],” - “any arrest or charging information,” - records of “municipal ordinance violations,” - and records relating to arrests or charges that, “if committed by an adult, would constitute misdemeanors or felonies.” Id. The Information Act also makes available to school principals and superintendents information such as juvenile delinquency records, arrest records, and probation records. § 19-1-304, C.R.S. (2015). #### CONCLUSION As this Opinion demonstrates, FERPA and its accompanying regulations allow educators flexibility in responding to potential school safety threats. Schools should become familiar with FERPA’s framework and adopt policies that avoid well-intentioned but overly restrictive application of student privacy laws. Schools should also be aware that Colorado law makes available to them ⁸ The law was renamed the Children’s Code Records and Information Act. 13 criminal justice information that may assist them in maintaining a safe campus. Issued this 11th of January, 2018. Cynthia H. Coffman CYNTHIA H. COFFMAN Colorado Attorney General 14 # FREQUENTLY ASKED QUESTIONS (FOR SCHOOL STAFF) I am concerned about the behavior of one of my students. Can I share my observations with others? Yes. Observations and opinions do not fall under FERPA. A teacher may always discuss observations about a student with other school officials and, if necessary, law enforcement. A student told me her friend planned to do something violent on Friday. Can I do anything other than call the student's parents? Yes. A report from a fellow student is not protected information under FERPA. This information may be shared with those inside and outside the school to determine the best response to the threat. I learned that one of my students posted a threatening statement towards another student on Facebook. Is a student's Facebook post protected by FERPA? No. Information posted on a student's personal social media account is not maintained by the school. The information may be shared with those inside and outside the school to determine the best response to the threat. We found an anonymous bomb threat in the library. Can we give local police the library surveillance video so that they can investigate who did it? Yes. The threat itself would trigger the "emergency" exception, so providing information to an outside agency that can assist is permitted by FERPA. Also, if your security video system is maintained by your security staff or SRO for law enforcement purposes, footage would be a "law enforcement record" exempt from FERPA. Based on information we learned from students, we believe that two groups of students are going to fight after school. Does this situation qualify as a "health or safety emergency"? Yes. FERPA defers to the judgment of school officials when making the determination that a "health or safety emergency" exists. So long as the school can articulate facts indicating a "significant threat to the health or safety of a 15 student” at the time the decision was made, the U.S. Department of Education will not second guess your judgment. ## In a health or safety emergency, with whom can I share student information? This depends on the circumstances. FERPA-protected information may be shared with anyone who needs the information to help respond to the threat. Information may be shared with law enforcement officials, emergency responders, and social service agencies. In appropriate circumstances, otherwise-confidential information may be shared with a student’s doctor, therapist, or other person deemed “necessary” to assist with the emergency. ## In the event of an emergency, is there a limit to what student information I can share? Again, the answer to this question depends on the circumstances. A school may disclose any information that would help others assess and respond to the emergency. Appropriate information may include discipline records, attendance history, or medical information, if needed. ## A student was expelled last week. May the principal tell the school resource officer about the expulsion? Yes, because the SRO is a school official and needs the information to do his job. In this case, the SRO would have a reasonable need to know that the student should not be on campus. ## A student has been behaving strangely on campus. Can our Threat Assessment Team review our in-school nurse’s records regarding his prescription medications? Yes. Records at the school, even if they are medical in nature, are “education records” that may be disclosed in appropriate circumstances under FERPA. Because members of a threat assessment team are “school officials,” they may obtain access to student information relevant to performing their function. ## A principal called police and shared confidential student information, believing she was faced with an emergency. The “emergency” turned out to be a prank. Can the student or his family sue the school or the principal? 16 No. FERPA does not provide a basis for private lawsuits. Also, the release is not a violation of FERPA if the administrator used reasonable judgment based on the information she had at the time, even if hindsight suggests the disclosure was an error. **We believe one of our students was arrested for domestic violence last weekend. Do we have any right to know the details?** Yes. If the student has been involved in an incident which suggests a public safety concern or has been arrested for a crime which, if committed by an adult, would be a misdemeanor or felony, the school may obtain the details of the offense so that school officials can evaluate what risk, if any, the student presents on campus. 17