The Family Educational Rights and Privacy Act (FERPA) requires educational institutions to maintain a record of certain requests for and disclosures of personally identifiable information (PII) from a student's education records. These recordkeeping requirements (34 C.F.R. § 99.32) help ensure transparency and enable the university to respond to student requests regarding who has accessed or received their educational information.
When Recordkeeping Is Required
GW offices, faculty, and staff are required to assist the Registrar Office in maintaining records of all disclosures of personally identifiable information from students' education record made to third parties, unless certain FERPA exceptions apply.
The disclosure record will be maintained by the Registrar with the student's education record for as long as the education record itself is maintained.
Disclosures that must be recorded and submitted to the Registrar Office include:
- disclosures made to other schools where the student seeks or intends to enroll.
- disclosures made to state and federal education authorities under the audit/evaluation exception.
- disclosures made to accrediting organizations
- disclosures made to financial aid entities.
- disclosures made to research organizations conducting studies
- disclosures made pursuant to a subpoena or court order.
- disclosures made under the health or safety emergency exception.
- disclosures made under the crime of violence / non-forcible sex offense disciplinary proceeding exception
FERPA's recordkeeping requirement does not apply to every disclosure. FERPA exempts certain disclosures from the recordkeeping requirement, such as:
- disclosures made to the student.
- disclosures made in response to a request from the student to inspect or review the student's education records.
- disclosures made with the student's written consent.
- disclosures of directory information, if the disclosure is made in accordance with the university's definition of FERPA directory information.
- disclosures to school officials with legitimate educational interests.
Recording a Disclosure of Information from Student Records
To support compliance with FERPA recordkeeping requirements (34 C.F.R. § 99.32) and university policy, GW staff and faculty are required to submit complete details about their disclosures of student records / information from student records, to the Office of the Registrar.
Information That Must Be Documented
A record of disclosure should include:
- The name of the individual, organization, or entity that requested or received the information.
- The legitimate interest or purpose for requesting or obtaining the information.
- The date of the disclosure.
- A description of the information disclosed.
- Any supporting documentation related to the disclosure, when applicable.
In the context of an accidental disclosure of FERPA protected student information, staff and faculty are required to report the disclosure as a data incident to the GW Privacy Office, and the disclosure report should include details of:
- What information was disclosed.
- To whom it was disclosed.
- How the disclosure occurred.
- Steps taken to mitigate the disclosure.
- Measures implemented to prevent recurrence.
If education records are disclosed under FERPA's health or safety emergency exception, the university must also document the articulable and significant threat that formed the basis for the disclosure.
These practices help satisfy FERPA's recordkeeping obligations and demonstrate institutional compliance.
Student Access to Disclosure Records
Under FERPA, an eligible student has a right to inspect and review their education records, including the record of disclosures that the university is required to maintain under 34 C.F.R. § 99.32. That record must identify the party who received the information and the legitimate interest for obtaining it.
However, the regulation does not expressly require the institution to disclose the recipient's contact information. The student's right is to inspect the disclosure record; it is not a specific right to obtain all identifying or contact details of the recipient.
Students may contact the Office of the Registrar to request access to records of disclosure of their student information to third parties.
Questions?
For further guidance regarding FERPA disclosures, recordkeeping obligations, or educational records management, contact Office of the Registrar or %20privacy
gwu [dot] edu (GW Privacy Office).
Note: This guidance is intended for GW faculty and staff. Students seeking information regarding their FERPA rights, access to educational records, or privacy preferences should refer to the Office of the Registrar's FERPA resources.