Private school administrators hear a lot about FERPA, and many assume it applies to them the same way it applies to public schools. Often it doesn’t. But that doesn’t mean student records are free of obligations, and it certainly doesn’t mean families expect less protection.
This post explains when FERPA actually applies to a private K-12 school, which other rules may still come into play, and the practical steps any school can take to protect student information.
What FERPA Is
The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. It gives parents the right to review their child’s records, request corrections, and control many disclosures. Those rights transfer to the student at age 18.
When FERPA Applies to a Private School
FERPA applies to schools that receive funds under programs administered by the U.S. Department of Education. Most private and religious K-12 schools don’t receive those funds directly, and the Department of Education has explained that FERPA generally doesn’t apply to them.
A few points often cause confusion:
- Services provided through a public school district. When students at a private school receive federally funded services through the local public school district, the funding typically goes to the district, not the private school.
- Other federal programs. Participation in programs run by other agencies doesn’t automatically make a school subject to FERPA, which is tied to Department of Education funding.
- Students placed by a public agency. In some situations, such as when a public school district places a student with a disability at a private school, certain records may be subject to FERPA or related requirements.
Every school’s situation is different. If you aren’t sure whether FERPA applies to yours, ask your attorney to review your funding sources and arrangements.
Other Rules That May Still Apply
Even when FERPA doesn’t apply, other obligations often do.
Iowa’s Data Breach Law
Iowa Code Chapter 715C requires organizations to notify affected Iowa residents when certain personal information, such as Social Security numbers or financial account numbers, is compromised. Schools often hold exactly that kind of information for students, parents, and staff.
Payment Card Rules
If your school accepts tuition, fees, or donations by credit card, you’re expected to follow the Payment Card Industry Data Security Standard (PCI DSS). That includes protecting cardholder data and training staff who handle it.
Health and Special Education Records
Records from a school nurse, counselor, or outside provider may carry their own confidentiality requirements depending on who created them and how they’re kept.
Your Own Promises to Families
Enrollment agreements, handbooks, and privacy notices often make commitments about how student information will be handled. Families expect a school to keep those promises, and a breach can damage trust quickly.
What Student Records Schools Typically Hold
Whether or not FERPA applies, most private schools manage a large amount of sensitive information:
- Grades, transcripts, and attendance
- Disciplinary and counseling notes
- Health information and emergency contacts
- Learning plans and evaluations
- Family financial information for tuition and aid
- Parent and guardian contact details, including custody arrangements
Much of this lives in a student information system, email, cloud file storage, and tuition management platforms. Each of those systems is a place where information can be exposed.
Where Schools Commonly Run Into Trouble
The most common problems aren’t dramatic hacks. They’re everyday gaps:
- Too much access. Staff, volunteers, or coaches who can see far more in the student information system than their role requires.
- Email habits. Sensitive student details sent to large distribution lists or kept in shared mailboxes many people can open.
- Compromised accounts. A staff member falls for a phishing email, and an attacker gains access to their mailbox and everything in it.
- Vendor agreements. Platforms that store student data under contracts that don’t clearly limit how that data can be used or require notice of a breach.
- Custody and release questions. Staff unsure who is allowed to receive a student’s information.
Practical Steps for Any Private School
These steps make sense whether or not FERPA applies to your school.
1. Confirm your obligations. Have your attorney review whether FERPA or other laws apply based on your funding and programs.
2. Write a student records policy. Define what records you keep, who can access them, how requests from parents are handled, and how information may be shared.
3. Limit system access by role. Review who can see what in your student information system and email, and remove access that isn’t needed.
4. Turn on multi-factor authentication. Require it for every staff account that can reach student or family information.
5. Review vendor contracts. Make sure agreements limit how vendors use student data and require them to notify you of a breach.
6. Train your staff. Cover phishing, handling student information by email, and when to ask before sharing.
7. Plan for an incident. Know who you’d call and what steps you’d take if student or family information were exposed.
Protecting Student Information With Limited Staff
Most private schools don’t have a full-time IT department, and administrative teams already carry a lot. The good news is that the steps above are manageable with the right support.
CyberCore Technologies works with private and independent schools across Des Moines and central Iowa to secure student information systems, email, and devices, and to put practical safeguards in place. If you’d like help understanding where your school stands, we offer a free assessment and are happy to talk whenever it works for your schedule.
This post is general information, not legal advice. Consult your attorney about your school’s specific obligations.
