A US university that receives federal education funding moves student education records, including grades and disciplinary files, into a SaaS learning management system. Which law primarily governs disclosure of these records, and how can the vendor lawfully receive them?
Select an answer to reveal the explanation.
Short Explanation
Grades and disciplinary files at a federally funded US school? That's FERPA's home turf. You can hand records to a cloud vendor without consent when the vendor acts like a school official under your direct control. Don't let the word health or the word minor pull you toward the wrong statute.
Full Explanation
The Family Educational Rights and Privacy Act protects the privacy of student education records at educational institutions that receive funding from US Department of Education programs, and generally requires consent before disclosing personally identifiable information from those records. An exception allows disclosure to school officials with a legitimate educational interest, and an outsourced provider such as a SaaS vendor can qualify when it performs an institutional service the school would otherwise use employees for, is under the school's direct control regarding use and maintenance of the records and is bound by redisclosure limits. Contracts should spell out these conditions. HIPAA is the wrong lens because health records held as education records are expressly treated under FERPA rather than as protected health information. PIPEDA is a Canadian private-sector privacy law and does not govern a US university's student records. COPPA regulates online collection of personal information from children under 13 by operators of websites and online services and does not turn on the age of majority or govern disclosure of education records generally. Exam caveat: state student privacy laws may add requirements. Operational check: confirm the vendor contract establishes school official status, direct control, use limitations and return or destruction of records at termination.