When can Colorado school staff share information about a student with police, parents, or other educators without violating federal student privacy law?

Plain-English summary

This is a guidance opinion on FERPA, the federal law that governs student record privacy. AG Cynthia Coffman issued it after a 2016 report on the Arapahoe High School shooting found that misunderstandings about FERPA had hampered information-sharing among school staff. Educators thought FERPA covered everything, that they could be sued for sharing too much, and that they needed to err on the side of silence. The opinion's central message: that picture is wrong.

The opinion lays out four main points:

1. FERPA only covers "education records", narrowly defined. A teacher's personal observations, what one student tells you about another, social media posts, and records kept by school security personnel are all outside FERPA. Educators can share that information freely with other staff, parents, or law enforcement.

2. Even education records can be disclosed without parental consent in certain circumstances, including health-or-safety emergencies, sharing with school officials who have a "legitimate educational interest" (which the opinion reads to include threat-assessment work), and sharing with criminal justice agencies under Colorado's Children's Code.

3. Schools should err on the side of safety. Federal regulations explicitly defer to school officials' judgment about whether an emergency exists. The Department of Education will not second-guess decisions made on the ground based on information available at the time. And FERPA does not give parents or students a private right of action, so good-faith mistakes do not create individual liability for teachers or schools. Gonzaga Univ. v. Doe, 536 U.S. 273 (2002).

4. Colorado's Children's Code Records and Information Act gives schools more access, not less, to law-enforcement information about students with public-safety concerns. Schools can request information about threats, arrests, charges, and adjudications.

The opinion ends with a substantial FAQ designed for school staff to use as quick reference.

Currency note

This opinion was issued in 2018. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Background and statutory framework

FERPA is codified at 20 U.S.C. § 1232g. The Department of Education's regulations are at 34 C.F.R. Part 99. The statute generally bars schools that receive federal funds from disclosing a student's "education records" without parental consent (or, for students 18+, without the student's own consent).

What FERPA does not cover:
- Information learned through personal observation or overheard remarks. Owasso Indep. Sch. Dist. v. Falvo, 534 U.S. 426, 434-35 (2002), holds that FERPA applies to records "maintained by an educational agency or institution," typically meaning records "kept in a filing cabinet in a records room at the school or on a permanent secure database." Personal observations don't qualify.
- Peer reports. Students are not "agents of the school," so what one student tells you about another is not an "education record."
- Social media posts. Created by students, not maintained by schools, so they fall outside the definition.
- Records of school security personnel, which 20 U.S.C. § 1232g(a)(4)(ii)(B)(II) specifically excludes from "education records." A "law enforcement unit" can be as informal as a security guard or SRO, per 34 C.F.R. § 99.8(a)(1).

The emergency exception, 20 U.S.C. § 1232g(b)(1)(I) and 34 C.F.R. § 99.36, lets schools share education records with "appropriate persons" if disclosure is "necessary to protect the health or safety of the student or other persons" in connection with an emergency. The 2008 regulatory amendments removed the "strictly construed" language and replaced it with a "rational basis" standard. The school just needs to "articulate" a "significant threat" based on "the totality of the circumstances," judged on what the school knew at the time.

The school-official exception, 34 C.F.R. § 99.31(a)(1)(i)(A), permits sharing among "school officials" with "legitimate educational interests." Critically, the Department of Education has read "school officials" to include security staff, threat assessment team members, and even non-employees like parent volunteers serving on official committees, when they need the information to do school business.

The Colorado piece: § 19-1-301, C.R.S. (the Children's Code Records and Information Act, originally the "Exchange of Information Related to Children Act") creates a structured framework for schools to obtain criminal justice information about students. Section 19-1-303(2)(b)(I) lets schools receive information about threats, arrests, charges, and municipal ordinance violations from criminal justice agencies when there is a public safety concern. Section 19-1-304 gives principals and superintendents access to juvenile delinquency, arrest, and probation records.

Common questions

Q: Can a teacher tell another teacher that a student made a threatening comment?
A: Yes. Personal observations are not education records, so FERPA does not restrict the sharing.

Q: Can a school resource officer (SRO) get a copy of a student's discipline file?
A: Yes, under the school-official exception, if the SRO has a "legitimate educational interest" in the information. The Department of Education has confirmed school security personnel qualify as school officials. Schools must list SROs in their annual FERPA notice as among those with access.

Q: What about a student's nurse-office records?
A: Health information maintained by a school is part of the education record. FERPA, not HIPAA, governs it. See 45 C.F.R. § 160.103. Threat assessment teams can review it under the school-official exception when relevant.

Q: Can a teacher be sued for sharing too much?
A: No. FERPA does not create a private right of action. Gonzaga Univ. v. Doe, 536 U.S. 273 (2002). Only the U.S. Department of Education can enforce FERPA, and it focuses on systemic violations, not isolated mistakes.

Q: A school called police about a perceived threat that turned out to be a prank. Are the school and the principal in trouble?
A: No. The Department of Education explicitly defers to the school's judgment under the emergency exception, judged on what was known at the time. A reasonable, articulated belief that there was a significant threat is sufficient.

Q: What can be shared during an emergency, and with whom?
A: Whatever is necessary to respond to the threat, with whoever needs it. That can include law enforcement, emergency responders, social service agencies, and even potential victims or their parents. The 2008 regulations expressly authorize disclosures to those "who can provide ... appropriate information to assist in protecting against the threat," not just to those "responsible for providing the protection."

Q: When a school finds a "hit list" or violent drawing, is that protected by FERPA?
A: Not under the personal-observation rule. The school official's awareness of and concern about the document is not an education record. Risica ex rel. Risica v. Dumas, 466 F. Supp. 2d 434, 437, 441-42 (D. Conn. 2006).

Q: What does Colorado's Information Act let schools find out from police?
A: Information about threats made by the student, any arrest or charging information, municipal ordinance violations, and arrest or charging records that, if committed by an adult, would constitute misdemeanors or felonies. § 19-1-303(2)(b)(I). Principals and superintendents also have access to juvenile delinquency, arrest, and probation records under § 19-1-304.

Citations and references

Federal:
- 20 U.S.C. § 1232g, FERPA
- 34 C.F.R. § 99.36, emergency exception
- 34 C.F.R. § 99.31(a)(1), school officials exception
- 34 C.F.R. § 99.8, law enforcement unit and records definition
- 45 C.F.R. § 160.103: HIPAA "protected health information" excludes FERPA-covered records

Colorado:
- § 19-1-301 et seq., C.R.S., Children's Code Records and Information Act
- § 19-1-303(2)(b)(I), C.R.S., disclosure of public-safety information from criminal justice agencies
- § 19-1-304, C.R.S.: access to juvenile delinquency, arrest, and probation records

Cases:
- Owasso Indep. Sch. Dist. v. Falvo, 534 U.S. 426 (2002), narrow scope of "education records"
- Gonzaga Univ. v. Doe, 536 U.S. 273 (2002), no private right of action under FERPA
- Risica ex rel. Risica v. Dumas, 466 F. Supp. 2d 434 (D. Conn. 2006), student documents as personal observations
- In re Rome City Sch. Dist. v. Grifasi, 806 N.Y.S.2d 381 (N.Y. Supp. Ct. 2005), security camera footage exempt as law enforcement record

Source

• Landing page: https://coag.gov/attorney-general-opinions/
• Original PDF: https://coag.gov/app/uploads/2020/02/no-18-01.pdf

Original opinion text

Best-effort transcription from a scanned PDF. Minor errors may remain — the linked PDF is authoritative.

CYNTHIA H. COFFMAN
Attorney General

MELANIE J. SNYDER
Chief Deputy Attorney General

LEORA JOSEPH
Chief of Staff

FREDERICK R. YARGER
Solicitor General

STATE OF COLORADO
DEPARTMENT OF LAW
Office of the Attorney General

FORMAL OPINION No. 18-01
of CYNTHIA H. COFFMAN, Attorney General
January 11, 2018

This Opinion provides general guidance regarding the Family Educational Rights Privacy Act, 20 U.S.C. § 1232g ("FERPA"), a federal statute governing privacy of student records. The Opinion addresses misconceptions about FERPA's scope to assure teachers, administrators, and other school staff that they may proactively respond to safety concerns, including threats of school violence, without violating students' and families' privacy rights. The Opinion also explains what information Colorado schools may obtain from juvenile courts and law enforcement agencies to assist in evaluating school safety risks.

For answers to specific questions regarding FERPA compliance, including questions beyond the scope of this Opinion, schools and districts should consult counsel. This Opinion focuses on the K-12 school environment. FERPA questions specific to higher education are beyond the scope of this Opinion.

OVERVIEW

Reports analyzing recent campus shootings observe that educators in Colorado and elsewhere often misunderstand the scope and meaning of FERPA. Teachers and administrators fear that by responding proactively to threats of school violence, they may run afoul of federal privacy laws. This Opinion seeks to dispel these misunderstandings and to prevent unfounded privacy concerns from hampering school violence prevention. When deciding whether to share student information with other school staff or outside agencies, educators should remember the following guidelines:

• Not all student information is an "education record" subject to FERPA's privacy restrictions. Without implicating FERPA, educators may share observations and other personal knowledge about a student's behavior, reports about a student from peers, threats of violence shared on social media, and records created and kept by school security personnel.
• Even "education records" may be disclosed without parental consent in certain circumstances. FERPA does not prevent school staff from sharing education records with other school personnel who have "legitimate educational interests." In response to health or safety emergencies, schools may share FERPA-protected education records with those outside the school who can help.
• Educators can and should err on the side of safety. Neither a school nor a school employee can be sued for claimed violations of FERPA. Only federal officials have the right to enforce FERPA.
• Amendments to FERPA regulations have broadened the emergency exception, making clear that federal regulators will defer to the reasonable judgment of educators confronted with potential safety risks.
• Colorado law encourages law enforcement agencies and school districts to share information.

BACKGROUND

Congress enacted FERPA to "protect [students'] right to privacy by limiting the transferability of their records." United States v. Miami Univ., 294 F.3d 797, 817 (6th Cir. 2002). To serve this purpose, FERPA generally prohibits schools from releasing information in a student's "education records" without obtaining written consent from the student's parents. 20 U.S.C. § 1232g(b)(1).

This general rule against disclosure is not absolute, however. Not all information that comes into the hands of an educator, administrator, or other school staff member is an "education record" subject to FERPA's restrictions. And even education records may be disclosed without parental consent under certain circumstances, including when schools are presented with health or safety emergencies.

In 2007, the Governor of Virginia commissioned a panel of experts to study a mass shooting at Virginia Polytechnic Institute and State University, in which 32 students lost their lives. The study highlighted "widespread confusion about what federal . . . privacy laws allow," including a failure to realize that "federal laws and their state counterparts afford ample leeway to share information in potentially dangerous situations."

In 2016, a report analyzing the circumstances leading to a shooting at Arapahoe High School in Centennial, Colorado, likewise cited misunderstandings about FERPA. School staff believed that under FERPA "they would be more liable if they had shared information about [the gunman's] concerning behaviors, than if they had not."

DISCUSSION AND GUIDANCE

I. FERPA restricts disclosure of information only if it qualifies as an "education record."

FERPA covers only "education records," which are defined as "records, files, documents, and other materials" that "contain information directly related to a student" and are "maintained by an education agency or institution." 20 U.S.C. § 1232g(a)(4). The United States Supreme Court has held that FERPA is concerned mainly with "institutional records kept by a single central custodian, such as a registrar," which would typically be "kept in a filing cabinet in a records room at the school or on a permanent secure database." Owasso Indep. Sch. Dist. v. Falvo, 534 U.S. 426, 432-33, 434-35 (2002).

A. Information about student behavior that an educator learns through observation, discussions with students, or social media is not subject to FERPA.

Personal Observations. Information "obtained through [a] school official's personal knowledge or observation" is not an "education record." Examples include a teacher overhearing a student making threatening remarks, finding a "hit list" or threatening drawing, observing escalating aggressive behavior, or noticing a disturbing change in a student's demeanor. Risica ex rel. Risica v. Dumas, 466 F. Supp. 2d 434, 437, 441-42 (D. Conn. 2006).

Information Learned from a Student's Peers. Because students are not "agents of [a] school" and do not "act[ ] for" an educational institution, peer reports, whether written or spoken, are not "education records." Cf. Owasso Indep. Sch. Dist., 534 U.S. at 434-35.

Social Media. Social media posts are not restricted from disclosure under FERPA. They fall outside the definition of "education records" because they are not "maintained" by schools and are created by students, not school staff.

B. FERPA contains a specific exclusion for records maintained by school security personnel, which may be disclosed without parental consent.

Under FERPA, investigative reports and other records created and maintained by a school's security staff are specifically excluded from the definition of "education records." 20 U.S.C. § 1232g(a)(4)(ii)(B)(II). To qualify as a FERPA-exempt "law enforcement record," the record must be (1) created by a "law enforcement unit"; (2) created for a "law enforcement purpose," and (3) maintained by the law enforcement unit. 34 C.F.R. § 99.8(b)(1). The term "law enforcement unit" is not limited to a formal department staffed by commissioned police officers or school resource officers. It may simply be a "component" of the school staffed by "security guards" or others designated to "maintain the physical security and safety of the [school]." 34 C.F.R. § 99.8(a)(1).

II. Even "education records" may be disclosed in certain circumstances.

A. Schools may disclose protected information to respond to a health or safety emergency.

School officials may disclose education records without parental consent "to appropriate persons" if the disclosure "is necessary to protect the health or safety of the student or other persons" and is "in connection with an emergency." 20 U.S.C. § 1232g(b)(1)(I); 34 C.F.R. § 99.36. This emergency exception is "flexible." Federal regulations make clear that a school's actions will not be second-guessed based on information that may become clear only later. The school need only "articulate" a "significant threat to the health or safety of a student or other individuals," and it may make its judgment "based on the information available at the time." 34 C.F.R. § 99.36(c).

Schools also should not delay disclosure until an emergency has materialized. School officials "must be able to release information from education records in sufficient time . . . to keep persons from harm or injury." An "emergency" may thus arise not just from an immediate, ongoing incident, but from less immediately urgent circumstances, such as a change in a student's behavior. Disclosure need not be limited to those "responsible for providing the protection" necessary to respond to an immediate danger.

B. Education records may be shared among school staff with a legitimate educational interest in the information.

FERPA does not require parental consent when schools share education records among "school officials" who have a "legitimate educational interest" in the information. 34 C.F.R. § 99.31(a)(1)(i)(A). The term "school officials" is not limited to administrators and teachers. School security staff fall within the exception, as do members of threat assessment teams.

C. Colorado schools must share education records with law enforcement agencies conducting criminal investigations.

FERPA allows schools to share education records with criminal justice agencies if authorized by state law and if the "disclosure concerns the juvenile justice system and such system's ability to effectively serve the student whose records are released." 20 U.S.C. § 1232g(b)(1)(E). Colorado's Children's Code includes provisions allowing for the reciprocal sharing of information between schools and the juvenile justice system. § 19-1-303(1)(a), C.R.S. (2015). The Colorado statute requires schools to share "disciplinary and truancy information" upon the request of a criminal justice agency, if the agency is investigating a criminal case or a truancy matter. § 19-1-303(2)(c), C.R.S. (2015).

D. Health information maintained by a school is part of the student's education record and subject to FERPA, not to HIPAA.

Some educators mistakenly believe that HIPAA applies to all medical records in a school's possession. In fact, medical records in a school's possession are treated as education records and are subject to FERPA's disclosure framework. See 45 C.F.R. § 160.103.

III. When faced with potential safety risks, schools may, consistent with FERPA, err on the side of proactive disclosure.

A. Under current FERPA regulations, schools are entitled to deference when they decide to disclose education records in the face of safety concerns.

In 2008, the Department of Education issued new rules "to eliminate[] the previous requirement that [the emergency exception] be 'strictly construed.'" The amendment recognizes that school officials must "act quickly and decisively when emergencies arise" and accordingly "provides greater flexibility and deference to school administrators."

B. Schools and school officials cannot be sued by parents or students for FERPA violations.

Parents and students may not sue under FERPA for an unauthorized disclosure of protected information. Gonzaga Univ. v. Doe, 536 U.S. 273, 287 (2002). Only the United States Department of Education may enforce FERPA, and it must do so within FERPA's administrative framework. Further, that framework focuses on "systemic" violations of student privacy, not isolated mistakes. Jensen v. Reeves, 45 F. Supp. 2d 1265, 1276 (D. Utah 1999).

IV. Colorado law gives schools access to criminal justice information which can assist in risk assessment.

In 2000, the Colorado General Assembly passed the Exchange of Information Related to Children Act (later renamed the Children's Code Records and Information Act) as an amendment to the Colorado Children's Code. § 19-1-301, C.R.S. (2015). The Information Act authorizes schools and school districts to obtain information from law enforcement and criminal justice agencies, based on the assumption that schools "are often better able to . . . preserve school safety when they are equipped with knowledge concerning a child's history and experiences."

Under the Information Act, schools may receive information about a student, except mental health or medical records, relating to an incident that "rise[s] to the level of a public safety concern." § 19-1-303(2)(b)(I), C.R.S. (2015). Examples include information or records of threats, arrest or charging information, municipal ordinance violations, and records relating to arrests or charges that, if committed by an adult, would constitute misdemeanors or felonies. The Information Act also makes available to school principals and superintendents juvenile delinquency records, arrest records, and probation records. § 19-1-304, C.R.S. (2015).

CONCLUSION

FERPA and its accompanying regulations allow educators flexibility in responding to potential school safety threats. Schools should become familiar with FERPA's framework and adopt policies that avoid well-intentioned but overly restrictive application of student privacy laws. Schools should also be aware that Colorado law makes available to them criminal justice information that may assist them in maintaining a safe campus.

Issued this 11th day of January, 2018.

CYNTHIA H. COFFMAN
Colorado Attorney General

FREQUENTLY ASKED QUESTIONS (FOR SCHOOL STAFF)

I am concerned about the behavior of one of my students. Can I share my observations with others?
Yes. Observations and opinions do not fall under FERPA. A teacher may always discuss observations about a student with other school officials and, if necessary, law enforcement.

A student told me her friend planned to do something violent on Friday. Can I do anything other than call the student's parents?
Yes. A report from a fellow student is not protected information under FERPA. This information may be shared with those inside and outside the school to determine the best response to the threat.

I learned that one of my students posted a threatening statement towards another student on Facebook. Is a student's Facebook post protected by FERPA?
No. Information posted on a student's personal social media account is not maintained by the school. The information may be shared with those inside and outside the school.

We found an anonymous bomb threat in the library. Can we give local police the library surveillance video so that they can investigate who did it?
Yes. The threat itself would trigger the "emergency" exception. Also, if your security video system is maintained by your security staff or SRO for law enforcement purposes, footage would be a "law enforcement record" exempt from FERPA.

Based on information we learned from students, we believe that two groups of students are going to fight after school. Does this situation qualify as a "health or safety emergency"?
Yes. FERPA defers to the judgment of school officials when making the determination that a "health or safety emergency" exists. So long as the school can articulate facts indicating a "significant threat to the health or safety of a student" at the time the decision was made, the U.S. Department of Education will not second guess your judgment.

In a health or safety emergency, with whom can I share student information?
This depends on the circumstances. FERPA-protected information may be shared with anyone who needs the information to help respond to the threat. Information may be shared with law enforcement officials, emergency responders, and social service agencies. In appropriate circumstances, otherwise-confidential information may be shared with a student's doctor, therapist, or other person deemed "necessary" to assist with the emergency.

A student was expelled last week. May the principal tell the school resource officer about the expulsion?
Yes, because the SRO is a school official and needs the information to do his job.

A student has been behaving strangely on campus. Can our Threat Assessment Team review our in-school nurse's records regarding his prescription medications?
Yes. Records at the school, even if they are medical in nature, are "education records" that may be disclosed in appropriate circumstances under FERPA. Because members of a threat assessment team are "school officials," they may obtain access to student information relevant to performing their function.

A principal called police and shared confidential student information, believing she was faced with an emergency. The "emergency" turned out to be a prank. Can the student or his family sue the school or the principal?
No. FERPA does not give private parties the right to sue. Even if it did, the principal acted in good faith based on her understanding of the situation. The Department of Education would defer to her judgment.