Utah FERPA Records Request Letter

Utah student records law

We found no Utah statute or state rule that adds to FERPA's access and correction rights, so FERPA sets the rules for Utah schools. The access deadline is FERPA's: a reasonable time, and no more than 45 days after the school receives the request.

What FERPA adds everywhere

The Family Educational Rights and Privacy Act gives parents, and students once the rights pass to them, three main tools. You can inspect and review the student's education records (34 CFR 99.10(a)). You can ask the school to amend a record you believe is inaccurate, misleading, or in violation of the student's privacy rights, with a hearing if it refuses (34 CFR 99.20(a), 34 CFR 99.21(a)). And, outside listed exceptions, the school needs signed and dated written consent before it discloses personally identifiable information from those records (34 CFR 99.30(a)).

The rights belong to the parent until the student becomes an "eligible student": one who has reached 18 or attends a postsecondary institution (34 CFR 99.3). At that point they transfer to the student (34 CFR 99.5(a)(1)). Either parent keeps full rights after a divorce or separation unless the school has a court order, state law or other legally binding document that specifically revokes them (34 CFR 99.4).

"Education records" means records directly related to the student and maintained by the school or someone acting for it (34 CFR 99.3 (education records (a))). A few kinds are excluded, including a teacher's private memory-aid notes, records of a school's law enforcement unit, and treatment records of students who are 18 or in college (34 CFR 99.3 (education records (b)(1)), 34 CFR 99.3 (education records (b)(2)), 34 CFR 99.3 (education records (b)(4))).

Correcting a record

A correction request must explain what in the record is inaccurate, misleading, or in violation of the student's privacy rights. The school decides within a reasonable time; if it refuses, it must tell you of the decision and of your right to a hearing (34 CFR 99.20(b), 34 CFR 99.20(c)). FERPA sets no fixed number of days for either step.

The hearing may be run by any individual, even a school official, who has no direct interest in the outcome. You get a full and fair chance to present evidence and may bring anyone you choose, including a lawyer at your own expense, and the written decision must rest solely on the evidence presented (34 CFR 99.22(c), 34 CFR 99.22(d), 34 CFR 99.22(e)-(f)). If the school still will not change the record, you may add a statement explaining why you disagree, and the school must keep it with the contested part of the record and disclose it whenever that part is disclosed (34 CFR 99.21(b)(2), 34 CFR 99.21(c)).

What the process does not cover: the Department of Education's privacy office has said FERPA's amendment right cannot be used to challenge a grade, an evaluation or another substantive decision unless it was recorded inaccurately (Department of Education guidance letter, August 13, 2004). That is guidance rather than a regulation; for a grade dispute, use the school's own appeal process. 10 states add their own correction procedure, shown on their state pages.

If the school does not respond

If a school does not respond, the U.S. Department of Education's Student Privacy Policy Office takes complaints from parents and eligible students. A complaint must give specific facts and should be filed within 180 days of the alleged violation or of when you knew or reasonably should have known of it; the office can extend that for good cause (34 CFR 99.64(c), 34 CFR 99.64(d)). The office's complaint page provides the form, which can be emailed or mailed. Contacting the school first is encouraged but not required for a FERPA complaint (Student Privacy Policy Office).

FERPA itself does not let you sue the school: the Supreme Court held that its privacy provisions create no rights enforceable in a private lawsuit under 42 U.S.C. 1983 (Gonzaga Univ. v. Doe, 536 U.S. 273 (2002)). The remedy runs through the Department. Some state student-records laws provide their own complaint route; the state pages list the state education agency where we found one.

FERPA covers schools that receive funds under a Department of Education program (34 CFR 99.1(a)), which takes in public schools and nearly every college, since federal student aid counts (34 CFR 99.1(c)(2)). Most private K-12 schools receive no such funds and are generally not covered (Student Privacy Policy Office). School health records kept as education records are covered by FERPA rather than the HIPAA Privacy Rule (45 CFR 160.103 (protected health information (2))).