Can a school vendor release student records for another use?

Begin with the institution and the purpose of access

A vendor may maintain records on a school’s behalf without owning an unrestricted right to reuse them. Identify the originating institution, the activity that created the records, the people covered and the reason the vendor had access. Keep the service contract and any disclosure authorization with the record description. A technical export capability is not evidence of a new permitted disclosure.

FERPA’s applicability depends on its institutional and record scope. The Education Department’s regulations specify consent elements and conditional exceptions. The school-official route for outsourced functions includes institutional-function, control and legitimate educational interest conditions. The studies exception is limited to specified studies for or on behalf of educational agencies or institutions; it is not a general commercial research label.

The first commercial question should therefore be who can approve discussion of this record category. Ask the institution’s authorized privacy reviewer to choose a scoped review agenda before requesting student-level rows. A vendor should not treat a generic terms-of-service change as proof that families or eligible students authorized the proposed recipient and purpose.

Complete the route record before preparing a student sample

Hypothetical example: a tutoring platform maintains student IDs, attendance, lesson feedback and free-text notes for a funded school. A separate company wants to train a commercial education assistant. The platform has no documented consent for that recipient and no institution-approved study agreement for that use. The following record gives the school reviewer a concrete release decision rather than a checklist that silently assumes permission.

Changing the proposal to a study designed to improve the school’s instruction might create a different review agenda, but would still require the relevant conditions and institutional decision. It would not automatically authorize the recipient’s general product training. Record the narrower purpose, permitted people, duration and disposition before considering that alternative.

Give a written agreement a precise job

For the studies exception, the regulations and PTAC checklist describe a written agreement identifying purpose, scope, duration and information, limiting use and identification, and providing destruction timing. The checklist distinguishes mandatory elements from additional best practices. An audit clause, named contact or termination process may be a useful negotiated protection without being a universal FERPA requirement in the form a party proposes.

Turn that distinction into two columns in the review file: the condition the claimed route requires, and the contract protection the institution separately wants. The distinction prevents a negotiator from assuming that an extensive contract fixes an inapplicable exception. It also makes missing mandatory evidence easier to see. Assign a person to confirm the actual final agreement, rather than leaving the record at “contract in progress.”

A de-identification proposal needs its own assessment. Section 99.31(b) describes a reasonable determination about identifiability, taking account of other reasonably available information and multiple releases. In this example, dates and detailed notes could preserve links even after direct IDs disappear. Do not assert that a toy redaction demonstrates the result for a real school corpus.

Use rights review to collect institutional authority and due diligence to describe recipient use. VOID does not promise student-record inventory or FERPA clearance. This guide concerns a scoped US federal review and does not determine a school’s coverage, a particular consent or exception, state student-privacy rules, COPPA or other laws. Sample permission and a later license remain separate decisions.