What is FERPA?
FERPA is the Family Educational Rights and Privacy Act, a US law governing the privacy of education records held by schools and other educational institutions that receive federal education funding.
FERPA and HIPAA get confused constantly, and the confusion is understandable: both protect sensitive information about children, and both restrict who may see it. They attach to entirely different institutions and protect entirely different categories of record.
FERPA governs the education record, which the regulation defines as records directly related to a student and maintained by an educational agency or institution or by a party acting for it. Its architecture assumes a school, a student and a parent with rights to inspect and request amendment. It contains no concept of a covered entity, no concept of a business associate, and no requirement for the kind of contract HIPAA demands before a vendor may hold your data.
The enforcement models differ too, and the difference is instructive. HIPAA carries civil money penalties enforced by the Office for Civil Rights. FERPA’s remedies are institutional: the Department of Education can withhold or terminate federal education funding, or issue a cease and desist order. There is no private right of action under either, but a school’s exposure and a clinic’s exposure are not the same shape.
This matters at procurement because parent communication vendors built for schools describe their compliance in FERPA terms, accurately and in good faith. A vendor that names FERPA and COPPA on its compliance page and omits HIPAA is telling you which sector it built for, and the omission is the answer.
In an ABA clinic specifically.
A behavioural health clinic does not hold education records, so FERPA compliance in a vendor is not a partial substitute for HIPAA. It is a signal that the product was designed for a different institution.
Questions people ask about FERPA.
What does FERPA stand for?
The Family Educational Rights and Privacy Act, enacted in 1974 and codified at 20 U.S.C. 1232g, with the implementing regulations at 34 CFR Part 99. It is sometimes called the Buckley Amendment after the senator who introduced it.
What does FERPA protect?
Education records: records directly related to a student and maintained by an educational agency or institution, or by a party acting for it. It gives parents — and students once they turn 18 or enter postsecondary education — the right to inspect and review those records, to seek amendment of records they believe are inaccurate or misleading, and to control disclosure of personally identifiable information from them.
What is an example of an education record under FERPA?
Grades and transcripts, class schedules, disciplinary records, special education records including an IEP, and health records the school itself maintains about a student. Notable exclusions: notes kept in the sole possession of the maker as a personal memory aid, law enforcement unit records, employment records, and treatment records for students 18 or over made and used only in connection with treatment.
What is a FERPA waiver?
The term is used two ways. Formally, FERPA lets a student waive the right to inspect confidential letters of recommendation — the box on a college application. Colloquially, "FERPA waiver" usually means the written consent a parent or eligible student signs before a school discloses information from an education record: the regulation requires it to be signed and dated, and to specify the records, the purpose and the party receiving them.
What are the consequences for a school that fails to comply with FERPA?
The Department of Education can withhold further payments under any applicable program, issue a complaint to compel compliance through a cease and desist order, or terminate the institution’s eligibility for federal education funding. A third party found to have improperly redisclosed information can be cut off from education records for at least five years. There are no civil money penalties and no private right of action.
What does FERPA require schools to give parents each year?
An annual notification of their rights: to inspect and review the student’s education records, to seek amendment of records they believe are inaccurate or misleading, to consent to disclosures except where the rule authorises disclosure without consent, and to file a complaint with the Department. The notice must also explain the procedures for inspecting records and requesting amendment.
Does FERPA apply to an ABA clinic?
No, unless the clinic is itself an educational agency or institution receiving federal education funding, or is acting for one. A clinic delivering billed behavioural health treatment holds medical records, not education records, and is governed by HIPAA. If your staff work inside a school district under contract, the same child can be the subject of both an education record held by the school and a treatment record held by you — governed by different statutes, with different rules about who may see them.
Is FERPA compliance enough for a parent communication app in a clinic?
No. FERPA imposes no business associate agreement requirement, no Security Rule safeguards and no breach notification duty of the kind HIPAA sets out, so a FERPA-compliant product can be entirely compliant with the law it was built for and still be unusable for PHI. The relevant question for a clinic is not whether a vendor names FERPA but whether it will sign a BAA.
Written by Abdihafid, a behavior technician working in an in-person ABA clinic. This is a plain-language explanation for people evaluating software, not legal advice, and it is not a substitute for your own compliance counsel.
Other terms
Sources
The definitions on this page are quoted from the regulation itself rather than from a summary of it, linked below with the date we last read them there. This is a plain-language explanation for people evaluating software, not legal advice.
- [1] 34 CFR 99.3 — Definitions — “Education records” · checked August 31, 2026
- [2] 34 CFR 99.30 — Under what conditions is prior consent required to disclose information? · checked August 31, 2026
- [3] 34 CFR 99.7 — What must an educational agency or institution include in its annual notification? · checked August 31, 2026
- [4] 34 CFR 99.67 — How does the Secretary enforce decisions? · checked August 31, 2026
Show us what you are using now.
Fifteen minutes. If what you have works for your caseload, we will tell you to keep it.