Potential Changes to FERPA and the Impact on Document Management Customers
With the recent announcement that two senators, Orrin Hatch of Utah and Edward Markey of Massachusetts, hope to extend protection of personal student details, it’s time to consider how these changes may impact Document Management. The Family Education Rights and Privacy Right Act (FERPA) of 1974 requires that before a publicly-financed school shares personal student data with a third party, the school should obtain permission of the parents.
With the continued growth of IT systems at schools and the reduction of control over data, parents should be aware that their children’s personally identifiable information (PII) and detailed records are potentially available to parties outside of the authorized school district. Such records that can be exposed are grades, test scores, disabilities, memos, etc. Updating FERPA is needed to ensure that parents are guaranteed to be made aware of third parties who have access to this private information.
Many public school districts and private schools use document management solutions to store and organize student records. Some document management solutions store data on school premises, so the data is in the control of employees, while other document management solutions store data in the Cloud. Cloud-based document management systems, by their nature, require that data is stored external to the school IT network, meaning that all student, and potentially employee HR data is in the direct control of one or more third parties. Cloud-based document management software vendors often utilize a third party for storage, so the data may then be exposed to another party.
While the updates to FERPA do not directly target cloud-based document management solutions, school districts that store their data “in the cloud” should make plans to institute new procedures to comply with the upcoming changes. The proposed changes to FERPA will be costly to these school districts. School districts that are considering or currently evaluating cloud-based document management solutions should also be concerned about the time, effort, and cost of notifying parents.
See here for draft legislation specifics from Edward Markey’s official site.