Under FERPA You Can Share Identifiable Student Information With School Officials If There Is a “Legitimate Educational Interest.” Who of the Following Is Considered a School Official?

A school official under FERPA is any person or entity the institution employs or contracts with to perform an institutional function, including faculty, administrators, staff, contractors, and volunteers acting on the school’s behalf. The “legitimate educational interest” condition then limits sharing to those officials who need the record to do their job. The answer is not a fixed roster; it is a two-part test built from the institution’s own designations.

FERPA, the Family Educational Rights and Privacy Act of 1974 (20 U.S.C. § 1232g), governs how federally funded institutions handle education records. The “school official” exception sits in the regulations at 34 C.F.R. § 99.31(a)(1). That provision lets an institution disclose personally identifiable information from education records without written consent to “school officials” it has defined, provided those officials have a “legitimate educational interest” in the information. The regulation does not hand schools a ready-made list. It gives them a framework and requires them to do the defining.

The Two-Part Test the Regulation Actually Builds

The mechanism matters because most thin explainers skip it. FERPA does not itself declare who counts as a school official. It delegates that classification to each institution, then imposes conditions on how the institution exercises it. Under § 99.31(a)(1), an institution may disclose records to a school official only if three conditions hold: the institution has defined “school official,” it has defined “legitimate educational interest,” and the official is acting within those definitions. The annual notification requirement in § 99.7(a)(3)(iii) forces the definitions into writing.

The regulation lists several nonexclusive categories. A school official may be a person employed by the institution in an administrative, supervisory, academic, research, or support-staff position, such as faculty or administration. A person or company the institution contracts with to perform a special task also qualifies, such as an attorney or auditor. So does a person serving on the board of trustees, or a student serving on an official committee or assisting another school official. A volunteer may qualify if the institution treats the role as official.

The legitimate educational interest prong is a need-to-know test, not a status test. The official must need the record to fulfill a professional responsibility for the institution. Curiosity, convenience, or general interest fails. A dean’s assistant processing an academic-integrity case has it; the same assistant browsing a student’s health file to satisfy curiosity does not. Plain language: being an official opens the door, and the interest test decides who may walk through it.

Who Meets the Definition in Practice

The four categories in the regulation are broad enough to cover most campus roles, but the institution’s written definition decides the edges. Look at the school’s annual FERPA notice before assuming a role qualifies.

Typical designated school officials include:

Full-time and adjunct faculty, including instructors of record and teaching assistants assisting with a course. Administrators and support staff in registrar, financial aid, advising, admissions, and student affairs. Contracted service providers given a special task, such as auditors, attorneys, or vendors running a learning-management or identity system. Board of trustees members acting in their governance capacity. Students serving on an official committee, such as a conduct or academic-review board, while they act in that role. Volunteers the institution formally designates, such as certain athletic or mentorship volunteers.

The 2024 regulatory expansion at 34 C.F.R. § 99.31(a)(1)(i)(B) matters here. The Department of Education revised the definition to include contractors, consultants, volunteers, and other parties to whom the institution outsources institutional services or functions, provided the institution keeps direct control over the information’s use and maintenance. That means more outside vendors can qualify than faculty may assume, but the control condition is real. An outsourced transcript service the registrar supervises qualifies; a freestanding commercial vendor the institution cannot direct does not.

Two terms often get confused. A “school official” is a role the institution defines, while “directory information” is a separate category of data the institution may release without consent under § 99.37 unless the student opts out. A school official can receive non-directory information, including grades and disciplinary records, when the interest test is met. Directory information touches the consent question, not the official-status question.

Edge Cases That Decide Real Disputes

The edges are where compliance lives, so it helps to walk through the recurring puzzles.

Clearer cases exist first. A professor teaching a student this term has a legitimate educational interest in that student’s transcript and prior grades. A residence-life coordinator investigating a conduct report needs the incident file. An auditor examining financial-aid disbursements qualifies as a school official with a task-specific interest. These pass both prongs without controversy.

Borderline cases cluster around personal or secondary roles. A faculty member who is also a parent generally has no legitimate interest as a parent, because the interest test keys to institutional responsibilities. A coach reviewing a player’s academic file may qualify if the institution’s written definitions make academic eligibility part of the coach’s duties, and many do. A journalist who is also a student employee usually fails unless the institution defines the assignment as an institutional function. A board member asking about an individual student’s discipline file is a common flashpoint; governance oversight is not the same as a case-specific operational need.

Contractors deserve special attention given the 2024 expansion. The institution must retain direct control over the information, which is why the written contract and the vendor’s data-use restrictions do the work. A cloud storage provider hosting student records can qualify; a marketing analytics firm scraping enrollment lists usually cannot.

There is a professional caveat worth stating plainly: the school official exception applies to education records as FERPA defines them. It does not apply to records held in a health or counseling center that meet the separate treatment-record exclusion at 34 C.F.R. § 99.3, where treatment records made by a professional or paraprofessional acting in that capacity, used solely in connection with treatment and disclosed only to those providing treatment, fall outside “education records” entirely. That counterintuitive gap trips up even experienced registrars. A dean may believe the school official exception covers a counseling file, and the treatment-record exclusion says FERPA does not reach it in the first place. Those records can then be subject to other privacy regimes.

Comparing FERPA’s Disclosure Routes

The school official exception is one of several consent-free paths, and choosing the wrong one is a common error. The table below sets it against nearby alternatives.

The reconciliation point: several of these can be true at once, and the institution should document which route it used. A school official who is also responding to a subpoena should not blend the two justifications. Pick the cleanest path and record it.

Misconceptions That Produce Violations

Several beliefs are widespread and wrong, and they tend to show up in audits.

The most common is that anyone with a campus badge is automatically a school official. Designation is a definitional act, not an employment byproduct. The second is that a legitimate educational interest covers anything related to education, including campus safety, conduct history, or a colleague’s curiosity. It is a need-to-know test tied to a professional responsibility. The third is that faculty can share freely with parents. Parents are not school officials, and consent rules apply unless another exception fits.

A further misconception treats the exception as authorizing unlimited forwarding. The disclosure must be tied to the official’s role, and the institution should train officials not to re-disclose records beyond the boundaries of their function. Many schools also require annual FERPA training as a condition of designation.

Red-flag warnings to watch:

Sharing a record with a colleague outside the function you are both performing. Treating a convenience vendor as a school official without a written contract giving the institution direct control. Letting a board member’s governance role expand into case-specific record access. Assuming the exception reaches counseling or health treatment records covered by § 99.3. Using the school official label to justify releasing directory information, which has its own opt-out rules.

Practical Steps for Institutions and Staff

Compliance is mostly drafting and training, which means concrete steps beat abstract guidance.

First, write the definitions. The annual notice required by § 99.7 should state exactly which roles are school officials and what “legitimate educational interest” means. Include faculty, staff, contractors, board members, and student committee members explicitly.

Second, build a vendor checklist. Confirm the contract gives the institution direct control over the data’s use and maintenance, consistent with the 2024 expansion. Without that control, the vendor probably is not a school official.

Third, set thresholds for access reviews. A sensible cadence is an annual review of who is designated and what systems they can reach, alongside required FERPA training at onboarding and yearly thereafter. Record the training completion date.

Fourth, document the route chosen for each non-consensual disclosure. If the basis is the school official exception, note who approved the designation and why the interest existed. If the basis is a subpoena or an emergency, note that instead.

Fifth, separate treatment records from education records in training. Tell staff that counseling files handled under the § 99.3 exclusion are not reached by the school official exception, and route those questions to the counseling director or legal counsel.

Sixth, address parent and coach requests case by case. A parent who is also an employee is still a parent; a coach gets access only if the written definitions include academic eligibility duties.

What the Framework Cannot Settle

The school official and legitimate educational interest definitions are institution-specific, which means no single roster answers every case. An institution that has never defined “legitimate educational interest” in writing has little defensible basis for invoking the exception. The regulation delegates the classification and then holds the institution to its own words.

The exception also does not resolve conflicts with other laws. Records covered by state privacy statutes, HIPAA when the institution is a covered entity, or the treatment-record exclusion at 34 C.F.R. § 99.3 may follow different rules. FERPA sets a federal floor, and state or sector-specific rules may be stricter. Where rules diverge, the institution should document which framework controls and get counsel involved for cross-cutting questions.

Finally, there is a genuine practical limit: the exception covers disclosure to designated officials acting in their role, not to anyone the school chooses to favor with a label. Designation must be tied to a real institutional function, and the need-to-know test must survive the question of why this person needed this record on this day. A well-drafted notice and a training log are the best evidence that it did.

For immediate legal questions about a specific disclosure, school officials should consult counsel, since FERPA decisions are fact-specific. [DISCLAIMER: This article is general educational information, not a legal opinion, and does not promise outcomes. Consult a qualified education-law attorney or your institution’s privacy officer before making disclosure decisions. For immediate danger or self-harm risk, contact local emergency or crisis services.]