FERPA and Student Records for Non-Teaching Staff

Start with the FERPA definition of an education record

FERPA generally covers records that are directly related to a student and maintained by the school or a party acting for it. That can include much more than report cards: schedules, discipline records, special-education documents, many emails, attendance information, and information stored in student systems. The format does not decide whether something is an education record.

Do not assume that writing information in a casual email or spreadsheet makes it less sensitive. Use the district’s approved systems and retention rules for student information.

Employment at the school does not create unlimited access

The Department of Education’s Student Privacy Policy Office states that school officials may receive records without consent under the school-official exception when they have a legitimate educational interest as defined by the school’s annual FERPA notice and policy. Schools must use reasonable methods to limit access accordingly.

For a front-office employee, that may mean accessing attendance and contact information to perform assigned duties. It does not mean opening a student’s counseling, discipline, or special-education information out of curiosity.

Use a three-part access test before opening the record

Ask three questions in order: Am I a school official under this district’s FERPA notice or policy? Do I have a legitimate educational interest tied to the professional responsibility I am performing right now? Am I opening only the record information needed for that task? The U.S. Department of Education is explicit that FERPA does not permit every employee to see every student record simply because the person works for the school.

This matters at the front desk because role familiarity can feel like permission. A clerk may legitimately need attendance or dismissal information for one student while having no work reason to browse another student’s disciplinary file. A staff member helping with a threat-assessment function may have access under specific conditions, but that does not convert the information into general office knowledge. When the reason for access is not clear, stop and ask the district’s privacy or records lead.

Divorced parents are not a front-desk guessing game

Under FERPA, custodial and noncustodial parents generally both retain rights to their child’s education records unless the school has been provided with a court order, state law, or other legally binding document that specifically says otherwise. That means staff should not decide access based on which parent usually picks up the child or which parent sounds more convincing.

Follow the district’s custody-document and identity-verification process. If the record is unclear or a parent presents new legal paperwork, involve the administrator or records official rather than interpreting the order yourself.

Use the ‘need it for my job’ test before opening or sharing a record

The U.S. Department of Education’s Student Privacy Policy Office is explicit that a school employee does not automatically receive every education record without consent. Under the school-official exception, access is tied to legitimate educational interest—generally, needing the record to fulfill a professional responsibility. For a front-office employee, that may justify access to information needed for attendance, enrollment, an authorized dismissal, or another assigned function. Curiosity about a student’s discipline history is not the same thing.

Custody situations require process, not instinct. FERPA generally gives parents rights to education records unless the school has evidence of a court order, state law, or other legally binding document that specifically affects those rights. Front-office staff should verify identity and follow the district’s custody-document procedure rather than deciding access based on who lives with the child or who seems more persuasive at the counter.

Directory information is another trap. A district may designate categories as directory information and must provide the required notice, but families can have opt-out rights under FERPA. Do not assume a student’s schedule, address, team membership, or presence at school is shareable because some basic information appears in a public program or yearbook.

Directory information is an opt-out system, not a free-for-all

A district may designate certain information as directory information and disclose it without prior consent only after providing the required notice and an opportunity for parents or eligible students to restrict disclosure. The district decides what categories it has designated within FERPA’s framework. Staff should check the current notice and opt-out status before treating a name, photo, team roster, or other item as releasable.

Do not assume that because information appears in a yearbook or on a team page, every related student detail is public.

Use scenarios to practice the disclosure decision

A grandparent calls for grades: verify whether the school has authorization or another FERPA basis before disclosing. A reporter asks whether a student was suspended: refer the request; public rumor does not make the education record public. A teacher asks for a record needed to support a student in class: access may fit legitimate educational interest if the district’s policy covers the role and purpose.

A vendor requests a spreadsheet: do not send it because the company works with the district. Contracts, direct control, use restrictions, and the school-official criteria matter. Route vendor disclosure questions through the district privacy or data office.

Retain and destroy records through the system, not personal cleanup

Follow district retention schedules and approved destruction procedures. Do not take records home to “finish later,” store student documents in a personal cloud account, or delete official records because your desk is full. Some disclosures also require recordkeeping under FERPA, with exceptions; the staff member responsible for records should know the district process.

When in doubt, pause the disclosure rather than trying to solve federal privacy law at the counter. The privacy officer, administrator, records custodian, or district counsel can address unusual cases.