FERPA Awareness eLearning Training

FERPA stands for the Family Educational Rights and Privacy Act. It is a U.S. federal law enacted in 1974 that protects the privacy of student education records.

The Family Educational Rights and Privacy Act (FERPA) was enacted by the U.S. Congress in 1974 amid growing national concern about privacy and government record-keeping practices. In the early 1970s, investigations revealed that many schools were maintaining extensive student records - including personal and behavioral information - without clear safeguards or parental access. At the same time, the Watergate scandal (1972–1974) heightened public awareness about misuse of personal information and government overreach, contributing to broader privacy reforms during that era (including the Privacy Act of 1974). 

Senator James L. Buckley introduced FERPA as an amendment to a larger education bill to give parents - and later eligible students aged 18 or older - the right to access their education records and control disclosure of personally identifiable information. FERPA was signed into law on August 21, 1974, and applies to all educational institutions receiving funding from the U.S. Department of Education, establishing federal protections for student educational privacy.

FERPA compliance begins with employee awareness. Most violations occur due to misunderstanding of what constitutes education records, who can access them, and when disclosure is permitted. This training equips staff with practical knowledge to handle student data correctly and reduces the risk of regulatory investigations and funding consequences.

Any employee or service provider who collects, accesses, stores, shares, or manages student education records - across academic, administrative, IT, student services, HR, finance, and vendor roles - should complete this training to ensure institution-wide compliance.  

No. FERPA applies to all education records, regardless of format. This includes emails, digital files, databases, portals, biometric records, printouts, and other electronic or physical records maintained as part of the education process.

Any information about a student that is maintained by the educational institution as part of the education process is considered an Education Record. This can be records, files, documents, and other materials that contain information like the personally identifiable information such as the student’s name, date and place of birth, names of the student's parent or other family members, address of the student or student’s family, student number, social security number, biometric records etc. The information can be in the form of emails, computer files, printouts, tapes, disks and films. 

Some information is excluded from the education record. They are:

• Staff’s private notes about the students
• Campus police records
• Medical records
• Statistical data that does not contain the personally identifiable information of any student and
• Directory Information

FERPA allows educational institutions to consider some parts of the education record as directory information. Information like: Student's name, college and home addresses, telephone numbers, attendance dates, graduation dates, participation in sports, most recent college attended etc., are considered directory information. 

Educational institutions are allowed to disclose directory information without the written consent of the student. However, a student may request for non-disclosure of directory information by filling a directory information exclusion form.

Non-directory information refers to all data contained in a student’s education record that is not classified as directory information. This category includes sensitive details such as grades, academic performance and progress, disciplinary records, Social Security numbers, medical information, and financial data, all of which are protected under FERPA and require appropriate authorization before disclosure.

The training clearly explains directory vs. non-directory information, consent requirements, and disclosure exceptions. Scenario-based examples and knowledge checks help employees recognize when information can be shared, when written authorization is required, and when requests must be escalated to the Office of the Registrar. 

An Eligible Student is a student who is 18 years or older or enrolled in a college or university, whereas a Non-Eligible Student is a minor studying in a school (K-12). This distinction determines who controls access to education records. 

For an Eligible Student, FERPA rights belong to the student. 
For a Non-Eligible Student, FERPA rights belong to the parent or legal guardian. 

In the Eligible Student scenario, parents do not have automatic access to records. 

In the Non-Eligible Student scenario, parents do have automatic access to their child’s education records. 

Parents may access an Eligible Student’s records only if: 

The student provides written consent, or 

The student is declared a dependent in the parent’s tax return. 

Eligible Students do not need parental permission to access their records. 

Non-Eligible Students cannot independently exercise FERPA rights; access is managed by parents. 

In the Eligible Student document, the student can request corrections. 

In the Non-Eligible Student document, the parent can request corrections on behalf of the child. 

For Eligible Students, student consent is required before releasing non-directory information. 

For Non-Eligible Students, parental consent is required before releasing non-directory information. 

The Eligible Student training applies primarily to colleges and universities. 

The Non-Eligible Student training applies primarily to schools educating minors (K-12).

The responsibilities are the same, but the risk focus differs: 

In the Eligible Student version, staff must avoid unauthorized parental disclosures. 

In the Non-Eligible Student version, staff must avoid improper denial of parental access. 

No. 
FERPA exceptions (health and safety emergencies, audits, judicial orders, transfers, etc.) apply equally in both cases, but who must be notified or give consent differs based on student eligibility. 

When a student turns 18 or enrolls in a post-secondary institution, FERPA rights automatically transfer from the parent to the student, making them an Eligible Student. 

The course explains the transfer of rights from parents to students once they become eligible students, including access, consent, amendment, and authorization rights, along with the limited circumstances under which parents may still access records.  

Yes. The training highlights institutional responsibility for ensuring that vendors and service providers who access student data are aware of FERPA confidentiality obligations and handle education records appropriately.

Completion records and assessments provide documented evidence that the institution has taken reasonable steps to train employees on FERPA obligations that is an expectation commonly reviewed during audits, complaints, and regulatory inquiries.  

The training covers secure use of systems and credentials, safe handling of digital and paper records, cybersecurity awareness, proper storage and disposal of student data, and escalation procedures when uncertainty arises.  

HR plays a key role in ensuring that faculty, administrators, and student-facing staff understand who legally controls access to student records. Incorrect disclosures, especially to parents, sponsors, or third parties, can expose the institution to regulatory scrutiny, complaints, and reputational damage. 

Yes. Employees must successfully complete the final assessment to receive course credit and certification, helping institutions track completion and demonstrate compliance readiness. 

The delivery is fully flexible. If you have an in-house LMS, we can provide the course as a SCORM-compliant package. If not, we offer a seamless SaaS-based hosting option for easy access and deployment.