FERPA and threat assessment records: FERPA and School Threat Assessment Records: A Plain-Language Overview

This is general information, not legal advice. FERPA is complex, its application depends on the facts, and state laws add their own requirements. Review your district's threat assessment records practices with education counsel. Citations are to the FERPA regulations at 34 CFR Part 99.

Threat assessment teams handle some of the most sensitive information a school keeps. Teams also need to share information quickly to keep people safe. The Family Educational Rights and Privacy Act (FERPA) shapes how both happen. Fear of FERPA should never delay a safety report, and understanding what it allows helps teams act with confidence.

What FERPA covers

FERPA protects the privacy of education records: records directly related to a student and maintained by an educational agency or institution, or by a party acting for it (34 CFR 99.3). In general, schools need written consent from a parent (or an eligible student, 18 or older) before disclosing personally identifiable information from those records, unless an exception applies (34 CFR 99.30, 99.31).

Threat assessment documentation that the school or district maintains about a student, such as reports, interview notes, worksheets, and management plans, is generally an education record.

FERPA covers records, not observations

FERPA governs information from education records. It doesn't prohibit a teacher from telling the team, or police, what they personally saw or heard. A staff member who hears a student threaten a classmate can report it.

Sharing within the team: school officials

FERPA permits disclosure without consent to school officials with a legitimate educational interest (34 CFR 99.31(a)(1)). The district's annual FERPA notification must describe who counts as a school official and what counts as a legitimate educational interest.

Outside parties, such as a contracted psychologist or a law enforcement officer on the team, can qualify as school officials when they perform a service the school would otherwise use employees for, are under the school's direct control regarding the records, and follow FERPA's limits on re-disclosure (34 CFR 99.31(a)(1)(i)(B)).

Practical step: make sure your annual notification covers threat assessment team members, including any outside members.

Emergencies: the health or safety exception

FERPA permits disclosure to appropriate parties, such as law enforcement, public health officials, trained medical personnel, and parents, in connection with a health or safety emergency, if knowing the information is necessary to protect the health or safety of the student or others (34 CFR 99.31(a)(10), 99.36).

• The school considers the totality of the circumstances. If there is an articulable and significant threat to the health or safety of a student or others, it may disclose to anyone whose knowledge is necessary to protect against the threat.
• If there was a rational basis for the school's determination based on the information available at the time, the U.S. Department of Education won't substitute its judgment (34 CFR 99.36(c)).
• The school must record the articulable and significant threat and the parties it disclosed to (34 CFR 99.32(a)(5)).

Practical step: have a place in the case record to document emergency disclosures, what the threat was, and who received the information.

Law enforcement unit records

Records created and maintained by a school's law enforcement unit for a law enforcement purpose aren't education records (34 CFR 99.8). Copies of those records shared with other school officials, and records the unit keeps only for a non-law-enforcement purpose such as discipline, may be education records.

Practical step: if your district has an SRO or school police on the team, decide with counsel which records live where.

Parent access

Parents (and eligible students) generally have the right to inspect and review education records (34 CFR 99.10), which can include threat assessment records. Plan documentation accordingly: factual, respectful, and written knowing it may be read by the family.

Records kept in the sole possession of their maker, used only as a personal memory aid, and not shared are excluded from the definition of education records (34 CFR 99.3). Once notes are shared with the team or added to the case file, that exclusion doesn't apply.

Other laws to check

• State law. Many states have specific requirements for threat assessment teams and their records, including retention and information sharing.
• IDEA and Section 504. Special education records carry additional requirements, and assessments involving students with disabilities may affect the student's services.
• HIPAA generally doesn't apply to education records, but may apply to records held by outside health providers.
• 42 CFR Part 2 can apply to certain substance use treatment records.

A records checklist for teams

• Annual FERPA notification covers all team members, including outside members.
• Access to threat assessment records is limited to people who need it.
• Emergency disclosures are recorded with the threat and recipients.
• Law enforcement unit records are handled separately, as advised by counsel.
• Documentation is factual and appropriate for a parent to read.
• Retention follows your state's records schedule.

Sources

• Family Educational Rights and Privacy Act, 20 U.S.C. 1232g, and regulations at 34 CFR Part 99.
• U.S. Department of Education, Student Privacy Policy Office, studentprivacy.ed.gov.