FERPA
The Family Educational Rights and Privacy Act (FERPA) protects student education records at educational agencies and institutions receiving funding under applicable U.S. Department of Education programs. It matters when a school, college, university, or a provider acting for one exchanges protected education records through Files.com.
An education institution needs to establish who may receive those records and for what purpose, then configure access and sharing to reflect that decision. Files.com provides access controls, encryption, activity records, and data-management tools supporting that work. FERPA does not have a formal vendor certification process.
Records and Disclosures
FERPA education records generally concern an identifiable student and are maintained by the institution or a party acting for it, subject to the law's definitions and exclusions. Identify the records and the institution's role before deciding how to share them. The Department of Education's FERPA regulations define the scope and the rights and disclosure requirements.
Consent and permitted exceptions determine whether an institution may disclose protected information. One exception concerns school officials with legitimate educational interests. An outsourced provider can qualify only under the applicable conditions, including institutional control over the use and maintenance of the records and restrictions on use and redisclosure. A vendor relationship alone does not establish that permission. The Department of Education's data-sharing guidance explains these arrangements.
For example, a district exchanging student records with an authorized service provider must establish the permitted purpose and recipients before granting that provider access. The institution should also decide how the arrangement ends, how access is removed, and what happens to copies already delivered.
Files.com Controls
Use the controls that match the institution's approved arrangement:
| Review question | Relevant Files.com controls |
|---|---|
| Who can access the records? | Named users, groups, folder permissions, authentication policies, and identity-provider integration. Review direct, group, and inherited access together. |
| How can records be shared externally? | User and folder access, Share Link permissions, recipient controls, and expiration. Select controls according to the institution's authorized recipients and disclosure process. |
| What activity can be reviewed? | File activity history, sharing records, and other supported logs. Record types have different retention periods and identity information. |
| How long are records retained? | File expiration, deleted-file retention, archives, and export to customer-controlled storage. The institution establishes the required schedule. |
Customer Control Over Data explains these capabilities and links to their configuration references. A product activity record documents an operation; the institution's own records must capture any disclosure purpose, authorization, or other information its compliance process requires.
Agreements and Institutional Responsibilities
The institution remains responsible for permitted use and disclosure, requests from parents or eligible students, and the policies governing its records. Include service providers and recipients in that assessment, alongside the Shared Responsibility Model.
If your institution requires a FERPA or student-data privacy agreement, contact your Account Executive with the proposed requirements for Legal review. The agreement, permitted purposes, recipient access, retention, and removal of access should describe the same arrangement.
Student health records maintained as education records can fall under FERPA. A separate healthcare provider's records can involve different obligations. Establish the role and records involved before assuming that health-related content requires a HIPAA Business Associate Agreement.