Parent Access Requests: FERPA Guide for Schools

FERPA gives schools up to 45 days to respond to a parent access request, but the hard part is knowing who has the right to ask, what must be shared, and how to document each step.

If I had to sum up the whole process in a few lines, it would be this:

• In K-12, parents usually hold FERPA rights.
• In college, those rights usually belong to the student, even if the parent is paying tuition.
• Schools should verify identity, check for custody limits, review the record for other students’ data, and log what happened.
• Parents can ask to inspect records, request an amendment, and, if denied, ask for a hearing.
• FERPA allows some disclosures without consent, but schools still need to apply those rules with care.

A few facts matter right away:

• The response deadline is 45 days
• Schools may charge for copies, but not for search or retrieval
• Noncustodial parents usually have the same access rights as custodial parents unless a court order or similar document says otherwise
• If a student is in dual enrollment, the high school record and the college record may follow different FERPA rules

Here’s the short version: if I were setting up this process, I’d use one intake path, one ID-check step, one review process for redactions and exceptions, and one log for decisions and disclosures. That cuts confusion and helps staff stay within the law.

The rest of this guide walks through that workflow in plain English, from the first request to logging, amendments, hearings, and record retention.

Episode 48 - FERPA: Education Records and Student Rights

sbb-itb-5f36581

How to Build a Clear Intake Process for Parent Access Requests

Once a school confirms who has access rights, the next step is simple but important: use one intake process for every parent access request.

That process should do two things right away. First, it should start the FERPA clock. Second, it should collect the details staff need to find the right records without wasting time.

FERPA requires schools to provide access no later than 45 days after receiving the request. The clock starts when the request is received, not when staff begin working on it. So if intake is messy, the response window gets smaller fast. A standard intake process makes the next steps much easier, including record review, disclosure limits, and deadline tracking.

What to collect on the request form

A standard form gives staff a clear starting point. It also helps the school document what was asked for and when.

At a minimum, every request form should capture the following:

Schools may charge a reasonable copy fee, but not a search or retrieval fee. It helps to state that directly on the form so no one is surprised later.

How to verify identity before releasing records

Before releasing any PII, staff should verify the requester’s identity.

For in-person requests, ask for a government-issued photo ID and log that check. For remote requests, use a secure parent portal login with unique credentials or another documented authentication method for remote requests.

Custody cases need extra care. Noncustodial parents generally have the same access rights as custodial parents unless the school has a court order, state statute, or legally binding document on file that says otherwise. If a request comes from a parent in a disputed custody situation, staff should review the student’s file for any restricting legal documents before releasing records. That review should also be logged.

Once identity is confirmed, the request can move into review and fulfillment.

How a digital form workflow helps school teams stay consistent

A digital form workflow can make this process much easier to manage day to day. It can route request types, keep submissions in one place, and timestamp deadlines automatically.

Tools like Reform let school teams build multi-step forms with conditional routing. That means different request types can go to the right staff, submissions can land in a central tracker, and deadlines can be calculated from the submission timestamp.

Once intake is logged and verified, staff can move to inspection, copies, and FERPA exceptions.

How to Process Access Requests, Copies, and FERPA Exceptions

After intake and identity verification, the school needs to act within FERPA's 45-day deadline. At that point, staff have to make a practical call: give direct access, provide copies, or allow a limited disclosure under a FERPA exception.

What schools must provide: inspection, review, and copies

FERPA gives parents the right to inspect and review education records. It does not give them an automatic right to copies.

So, the default move is simple:

• in-person review
• secure digital access

Copies become required only when in-person review would, in practice, block the parent from using that right. A common example is when the parent lives too far away to make a school visit reasonable.

How to handle shared records and restricted access situations

If a record includes information about other students, staff should redact or separate that information before release. If redaction would leave the record with little or no meaning, the school should withhold only the other student's information when the requesting student is not the main subject of the record.

FERPA disclosure exceptions that apply to parent requests

Once access and redaction decisions are made, check whether a disclosure exception applies before releasing records. In parent-request workflows, these are the main exceptions staff should review.

• School officials with a legitimate educational interest may access records without parental consent, but only when the access connects directly to their job duties. Schools should define "legitimate educational interest" in the annual FERPA notice so staff apply the rule the same way each time.
• Transfers to another school let the sending school forward education records without prior consent, though the school must make a reasonable attempt to notify the parent.
• Health or safety emergencies allow disclosure without consent to law enforcement, medical personnel, or public health officials, but only for as long as the emergency lasts.
• Directory information - such as a student's name, address, or phone number - may be disclosed without consent only if the school gave proper annual notice and the parent did not file a formal opt-out for the current school year. Always check for opt-outs first.

"In a health or safety emergency, records and information may be released to appropriate parties such as law enforcement officials, public health officials, and trained medical personnel." - NCES Forum Guide to Data Ethics

If the parent disputes the accuracy of the record, move next to the amendment process.

How to Manage Amendment Requests, Hearings, and Written Statements

Once a parent reviews a record and spots an error, the next step is to submit a written amendment request. FERPA gives parents the right to ask a school to change a record if it is inaccurate, misleading, or violates the student's rights under FERPA.

What a parent must include in an amendment request

The request must be in writing. It also needs to point to the exact part of the record at issue and explain why that part is inaccurate, misleading, or improper.

A general complaint won't do the job. The parent needs to name the specific entry and spell out what is wrong with it.

This process is meant for factual mistakes. It is not the right path for disputes over grades, discipline, or academic judgment.

Schools should make this easier by naming a designated office in the annual FERPA notice, such as the Registrar or the Principal's Office. That way, parents know exactly where to send amendment requests.

How schools should review, decide, and notify parents

After the school gets a written request, it must review it within a reasonable period. Then it must notify the parent of the decision in writing.

If the school decides not to amend the record, the written notice must also explain the parent's right to ask for a formal hearing.

If the matter moves to a hearing, the school must use a neutral decision-maker who has no direct role in the dispute. The parent must get a full and fair chance to present evidence, and the school must issue a written decision.

What happens if the record is not changed after the hearing

If the school still refuses to amend the record after the hearing, the parent has the right to place a written statement in the record. That statement can explain the parent's view or why they disagree with the school's decision.

That statement does not just sit there and disappear. It must stay with the record for as long as the contested information is kept. And if the school shares that part of the record with a third party, it must also share the parent's statement alongside it.

"Parents or eligible students have the right to request that schools correct records they believe to be inaccurate or misleading." - NCES Forum Guide

If the school denies the amendment and fails to add the parent's statement, the parent may file a complaint with the Family Policy Compliance Office.

Before moving to retention, log the request, the decision, the hearing outcome, and the placement of the written statement.

How to Store, Log, and Report Requests in a Defensible Way

What to log and how long to keep the records

Once a request is fulfilled or denied, the school still needs a full audit trail. FERPA requires schools to keep a record of each access request and each disclosure of student records. For every request or disclosure, the log must identify the parties who requested or received the information and the legitimate interests they had in getting it.

That said, not every interaction belongs in the log. Schools do not have to record requests from:

• Parents or eligible students
• School officials with a legitimate educational interest
• Parties who provided written consent
• Requests for directory information

If PII is disclosed to a third party who may pass it along, the school must also document the names of those additional parties and their legitimate interests.

Keep the log for as long as the education record exists, and do not destroy records tied to an open access request.

"FERPA also requires that educational organizations maintain a record of each request for access to and each disclosure of personally identifiable information from the education records of each student (as long as a student's educational records are maintained by the education agency or institution)." - NCES

Parents and eligible students may inspect the log to see who accessed the records.

Paper versus electronic logging: a side-by-side comparison

The clearest audit trail usually comes from a consistent digital log. The logging method a school uses shapes how hard, or easy, it is to respond to audits and internal reviews. Paper can work, but it often turns simple questions into a scavenger hunt. Digital systems make the trail easier to follow.

Conclusion: The core steps every school should standardize

Once logging is in place, schools should standardize retention, disclosure tracking, and audit response. A defensible FERPA workflow comes down to being consistent in a few core areas:

• Document receipt, disclosure, and completion dates so the school can show the request was handled on time
• Handle amendments through a documented process with written decisions
• Maintain durable logs for as long as the records exist

Structured digital logs help keep request data complete, searchable, and ready for review. Standardized logging also makes FERPA audits faster and easier to defend.

FAQs

Does FERPA apply differently in K-12 and college?

Yes. The main difference comes down to who controls the rights to education records.

In K-12, those rights belong to parents or legal guardians. Once a student enrolls in a postsecondary institution or turns 18, those rights transfer to the student.

So the rule changes in a pretty clear way:

• In K-12, parents can directly access education records.
• In college, parents usually cannot access those records unless the student gives written consent or a specific legal exception applies.

It’s a simple shift, but it changes who can see what - and when.

What if a parent access request involves a custody dispute?

Under FERPA, both custodial and noncustodial parents usually have the right to inspect and review a child’s education records. That right applies unless a court order or state law specifically takes it away.

If a school identifies a safety threat, it may redact sensitive details, such as addresses or phone numbers. And for some court orders or subpoenas tied to child abuse, neglect, or dependency cases involving the parents, the usual notice rules may not apply.

When does a school have to provide copies instead of inspection?

Under FERPA, schools usually only need to let parents or eligible students inspect and review education records.

But there's an important catch: if not providing copies would effectively block the parent or eligible student from getting access to those records, the school must provide copies.

Schools also have to provide copies of information disclosed to another institution a student plans to attend, if the parent asks for that copy.

Related Blog Posts

• How Multi-Step Forms Help Schools Stay FERPA-Compliant
• FERPA Compliance for SaaS Tools in Education
• DSAR Intake Form: Build Checklist
• CCPA Opt-In Consent for Minors: SaaS Guide