Protecting Student Records—FERPA 101 for Clinical Educators
4-5 Minute Read
Author: Judy Hanrahan, JD, MA
Editors: Marin Gillis, PhD, LPh & Julpohng Vilai, MD
Purpose
To inform clinical educators about the basic requirements of and common pitfalls with the Family Educational Rights and Privacy Act (FERPA).
Learning Objective
1. Describe FERPA’s basic requirements regarding educational records;
2. Distinguish educational records from non-educational records; and
3. Describe two best practices to avoid an inadvertent FERPA violation.
What is FERPA and who does it apply to?
FERPA is a federal law that requires educational institutions to obtain written consent from post-secondary students before disclosing their educational records or the personally identifiable information (PII) contained in them unless the disclosure is pursuant to a recognized FERPA exception.(1) FERPA further provides students the right to inspect educational records, request amendments to those records, and to place an addendum in the record that must be produced every time the record is disclosed.(1)
If you are a medical educator in the United States, then FERPA applies to your institution because it applies to all educational institutions that receive federal funds, including by accepting student loan payments and Medicare reimbursements.
What’s Considered an Educational Record?
Since FERPA gives students the right to inspect their educational records, it is important to understand what counts as an educational record. Under FERPA, an educational record is basically any piece of information that relates to a student that is maintained in a record by the institution or someone acting on behalf of the institution, with certain exceptions.(2) Educational records can be kept in a variety of formats including, but not limited to, handwritten or printed pages, computer files, or audio or video recordings.
Examples of Educational Records
Assessments and grades
Notes about specific students, shared with other educators, including via email
Voicemails left with others about a specific student
Patient logs
OSCE Videos
Not Educational Records Under FERPA
Treatment Records
You may notice the “treatment records” exclusion in the graphic and assume that HIPAA rather than FERPA applies to those records, but you would be wrong! Treatment records are not considered educational records under FERPA; however, treatment records maintained by an educational institution, including clinical entities operated by an educational institution, are covered by FERPA and not HIPAA.(3) FERPA is more permissive about disclosures from records, especially in emergency situations, to learn more about the interplay between FERPA and HIPAA read the joint guidance authored by the Departments of Education and Health and Human Services.
Personal Memory Aids
Personal memory aids are also not considered educational records, unless they are shared with others. So, if for example, you jot down observations about a student’s oral presentation to help you remember what feedback to give the student, that is a personal memory aid, and is not subject to FERPA. If, however, you show that note to another preceptor or the clerkship director, it becomes an educational record that must be kept according to FERPA regulations.
Legitimate Educational Interest
In addition to the exceptions listed above, FERPA allows educators to share students records and the PII contained in them within an institution if there is a legitimate educational interest in sharing the information or record. The whole educational systems in the United States would grind to a halt, if we had to seek permission from students before every discussion or disclosure of students records within the institution. So, for example, as a preceptor you do not need to seek a student’s permission before submitting your assessment of their performance with the clerkship director or designated staff member; however, you should be cautious when “feeding forward” information about a particular student with other preceptors. Most schools have “feed forward” policies that outline when and how information about a particular student’s academic performance can be shared among clinical educators. Some policies aim to limit the potential of biasing future preceptors for or against a student.
Applying FERPA
Let’s dive into some situations you might encounter as a clinician supervising medical students and how FERPA applies to each one.
Scenario 1: A Chat About a Student’s Behavior
Imagine you’re talking with the clerkship director about a student who’s been struggling with professionalism. You mention that the student was late to a shift and didn’t follow up on a patient case. As long as this conversation is not recorded, FERPA doesn’t apply yet because there’s no written or recorded documentation. However, the moment you write an email or file a report about the incident, it becomes part of the student’s educational record and must be handled according to FERPA.
Scenario 2: Feedback Emails
You send an email to the clerkship director after the rotation ends, praising a student’s clinical skills or pointing out areas they need to improve. That email is now part of the student's educational record.
Avoiding Common FERPA Violations
FERPA should not feel overwhelming. It is easy to avoid violations if you follow a few simple tips:
Lock it up: Whether you’re keeping paper records or digital files, make sure they’re secure. Never leave a student’s evaluation lying around in a public area, and always lock your computer when stepping away.
Watch those group emails: If you need to email a group of students, use BCC to keep their identities private. FERPA violations often happen unintentionally when a group of students is sent the same message about missing work or poor performance.
Get consent for letters of recommendation: If you’re writing a letter of recommendation that includes anything other than your own personal observations (like grades or evaluations), make sure you get the student’s written permission first.
Keep personal notes personal: If you maintain notes for yourself, keep them private. Sharing them—even with the best of intentions—can transform them into an official record subject to FERPA.
Conclusion
FERPA might sound like another bureaucratic hurdle, but at the end of the day, it’s all about protecting students’ privacy. As clinicians who mentor, teach, and evaluate medical students, your role in maintaining confidentiality is critical. The key is knowing when you’re dealing with an educational record and being mindful of how that information is shared.■
References
(1) Family Educational Rights and Privacy Act. 20 USC § 1232g (1974).
(2) Family Educational Rights and Privacy Act Regulations. Definitions. 34 CFR § 99.3
(3) US Department of Education, US Department of Health and Human Services. Joint Guidance on the application of FERPA and HIPAA to student health records. Published December 2019. Access October 16, 2024.