Family Education and Right to Privacy Act, 20 USC 1232 (G) and 34 CFR 99,

and other related statutory provisions  

The central theme of the Family Education and Right to Privacy Act (FERPA) is the right to inspect and review records and the restriction of personally identifiable information. FERPA is selected for examination because it contains so many of the provisions found in state confidentiality statutes, such as those found in Illinois. For example, FERPA has an exception called “sole possession records”, while the same exception in Illinois is called “personal notes.”

1. Right to Challenge

Under FERPA, there is a due process right which constitutes an absolute right to a hearing for the purpose of challenging the accuracy of the contents of a particular file. There is also an unqualified privilege for the subject of the record to insert his or her own version of an incident or occurrence, and should that record ever be disclosed, the subject’s explanation must also be disclosed.

FERPA applies to recipients of federal financial assistance. The fundamental consequence for non-compliance with FERPA is that the agency in question (such as a state university) will not receive federal money if the provisions of the act are not obeyed.

2. What Records Are Protected?

Under FERPA, all records are “protected” except those specifically mentioned in the Act. Such exceptions might include separate law enforcement files, records of persons employed but not in attendance, physician/psychologist records if generated by them in that capacity and if the subject is 18 years of age or older, so-called “directory” information, and “sole possession” records. None of the above types of records are subject to disclosure under any circumstances, for the simple reason that they are not defined as “records” under FERPA. A closer examination of “sole possession” records maybe helpful.

Sole possession records, otherwise known as personal notes, are not subject to disclosure if they fit within the strict definitions contained in the Act. Sole possession records are defined as records of instructional, supervisory, and administrative personnel in the sole possession of the maker and not accessible or revealed to any other person. One who is seeking disclosure of the file cannot under any circumstances inspect, copy or challenge the contents of sole possession records. However, the courts’ interpretations have been strict in this regard. Such records must be private notes, intended as personal memory aids, and inaccessible by others. The same definition of so-called “personal notes” holds generally in most states. For example, Illinois has such a provision which fundamentally follows the FERPA definition.

3. Non-Disclosure of Personally Identifiable Information

The most fundamental rule of any confidentiality code is that personally identifiable information is prohibited from being disclosed except with the consent of the subject of the record in question. There are other exceptions, which might include the various school administrative officials, officials in an institution where a student seeks to enroll, disclosures in connection with an application for financial aid, natural parents, disclosures necessary to protect the health and safety of the subject of the record, or in response to judicial order or lawful subpoena.[1] Other exceptions are also contained in the Act.

Any disclosures made by the institution must be documented. When a student or other subject of a file reaches the age of 18, only he or she may consent to the disclosure, not the parents. FERPA, as mentioned, applies to all agencies receiving money from U.S. Office of Education Programs.

Confidentiality Rules under the Education of the Handicapped Act

The Education of the Handicapped Act (EHA) also has its own confidentiality provision. This act is broader than FERPA and encompasses children age 3 to 21 on whom files are generated. The act applies to all agencies involved in receiving money under the Education of the Handicapped Act. The right to access by parents is more extensive, and the parental consent requirements are slightly different. There are more detailed procedures for safekeeping and destruction of files. Unlike FERPA, when the student reaches 18, the severity of his or her disability must be considered before the rights transfer to the pupil. Each state is required to have enforcement sanctions in the event of non-compliance in the EHA confidentiality provision.

Illinois DMHDD Confidentiality Act

The DMHDD Confidentiality Act of Illinois (hereafter DMHDD-CA) is one of the most stringent in the nation. It mandates strict non-disclosure except under certain circumstances. The requirements for recitations within any consent form are much more detailed, and rights extended to younger minors are more extensive. Personal notes are described in detail, although FERPA has a better summary of what constitutes personal notes.

The DMHDD-CA enforces strict non-disclosure except: 1) to an insurance company or agency for benefits (limited consent form is required); 2) to parents if the child is under 12; 3) to staff members of an agency acting within their official capacity; 4) to any location with proper consent; 5) by court order (but not necessarily by subpoena alone).

Legally effective consent forms must have the following components:

1. An expiration date. If a consent form contains no expiration date, it is only good on the day it is received. The date must be specific. Language such as “good for two years” is not allowed.

2. Recitations that the signers understand consequences of non-disclosure, what records will be disclosed, and their ability to revoke consent.

3. Witness and date signed.

4. Signature of the minor if aged 12 to 18, except that when a therapist determines there is a good clinical basis in the minor’s best interests for disclosure over the minor’s objection, such certification may be made and the records disclosed. Recent changes may have altered this, however. “Therapists” may no longer have the power to bypass a minor’s objection but instead may have the authority to “block” the minor’s consensual disclosure.

If a recipient of mental health services is 18 years if age or over, his or her consent is required, except where there is an appointed guardian. Note that guardians may only be appointed by court order, and cannot be “assigned”. Personal notes are not mental health records, but all other records concerning recipients are mental health records. Incorporation of a mental health record into some other file does not change its status as a mental health record.

So-called “blanket” consents, in other words, “all records”, are prohibited. The request must be specific, and it is most efficient to describe with specificity all of the records in the release itself, such as in the attached form.

Intentional violations of the DMHDD-CA are a crime in Illinois. Negligent violations may result in civil suit and award of damages and attorneys’ fees and costs. Mental health records survive death, unlike many other confidential records.

A note on substance abuse: a physician may disclose to parents the fact that their minor child has sought substance abuse counseling or treatment from him, but the physician must tell the parents of an age-12-or-older minor after the second treatment. The only exception to mandatory disclosure after the second treatment for substance abuse problems is certification by the physician that doing so would jeopardize treatment. In that instance, the physician may wait up to three months before disclosing.

A note on abuse reporting: In all states, confidentiality is waived when a mandated reporter has reasonable cause to believe an abuse or neglect situation is present. Moreover, any reports pursuant to abuse reporting acts are immune from civil suit. Depending on the state, sanctions may be present, for the failure of a mandated reporter to submit a report of abuse or neglect. Such sanctions might include loss of a professional license. But see documents included as Appendix “A,” from the Department of Professional Regulation.


[1]Illinois’ consent provisions in the DMHDD CA are not overcome by the simple receipt of a subpoena.