# OCR Student Education Records: FERPA Limits for Counsel

- Author: Schema Law (https://www.schemalaw.com/)
- Published: 2026-01-06T15:34:39Z
- Updated: 2026-10-11T19:22:20Z
- Category: Confidentiality
- Canonical: https://www.schemalaw.com/blog/ocr-student-education-records

> Before you OCR student education records, check how they reached you. What FERPA says about outside vendors, subpoenas, consent and de-identified text.

A lawyer may run OCR on student education records only on terms that match how the records arrived. FERPA regulates what a school discloses and on what condition. For a school's own counsel, an OCR vendor has to fit the school official exception. For records received by consent or subpoena, the condition attached to the disclosure controls.

This post reads the federal regulations as they stood on the eCFR in October 2026. It explains how to handle the documents and is not legal advice. State student privacy statutes and district policies add their own rules, so check the ones that apply to your school or client.

## What counts as an education record under FERPA?

An education record under FERPA is a record that is directly related to a student and maintained by an educational agency or institution, or by a party acting for it. The regulation defines "record" broadly enough to cover handwriting, print, film and computer media, so a scanned page and the text converted from it are both inside the definition.

The definitions are in [34 CFR 99.3](https://www.ecfr.gov/current/title-34/section-99.3). Education records are "those records that are: (1) Directly related to a student; and (2) Maintained by an educational agency or institution or by a party acting for the agency or institution." A record is "any information recorded in any way, including, but not limited to, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche."

### What the definition leaves out

The same definition lists exclusions. Among them:

- "Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the record."
- "Records of the law enforcement unit of an educational agency or institution", subject to a separate section of the rule.
- Certain employment records of people who work for the school, and certain treatment records of students who are 18 or older or attending a postsecondary institution.

Whether a given page falls in an exclusion is a legal question about that page. For handling purposes, treat everything in a student's file as an education record until someone has decided otherwise.

### What the rule protects inside the record

FERPA's consent requirement is aimed at "personally identifiable information" from education records. The definition in 99.3 lists the student's name, the names of the student's parent or other family members, the address of the student or family, "A personal identifier, such as the student's social security number, student number, or biometric record", and "Other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name". It ends with a catch-all for information that "alone or in combination, is linked or linkable to a specific student".

### Who the regulation applies to

The part applies, under [34 CFR 99.1](https://www.ecfr.gov/current/title-34/section-99.1), "to an educational agency or institution to which funds have been made available under any program administered by the Secretary". The duties in the rule are written as duties of that agency or institution. That is why the route by which a file reached your desk decides so much.

| How the records reached the lawyer | Provision to read first |
| --- | --- |
| The school is your client and handed you its files | 34 CFR 99.31(a)(1)(i) |
| A school produced them to you under a subpoena or court order | 34 CFR 99.31(a)(9) |
| A parent or eligible student signed a consent | 34 CFR 99.30 and 99.33(a) |
| The parent or student obtained copies and gave them to you | 34 CFR 99.31(a)(12) and 99.33(c) |

## May a school district's lawyer send student records to an OCR vendor?

A school district's lawyer may send student records to an OCR vendor without parental consent only if the vendor fits the school official exception, which sets three conditions for outside parties. The district decides whether those conditions are met and on what contract terms. The lawyer's task is to check the vendor's terms against the three conditions before uploading.

The exception is [34 CFR 99.31(a)(1)(i)](https://www.ecfr.gov/current/title-34/section-99.31). Paragraph (A) allows disclosure "to other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests." Paragraph (B) extends it:

> A contractor, consultant, volunteer, or other party to whom an agency or institution has outsourced institutional services or functions may be considered a school official under this paragraph

That holds, the paragraph continues, "provided that the outside party" meets three conditions:

> (1) Performs an institutional service or function for which the agency or institution would otherwise use employees;
> (2) Is under the direct control of the agency or institution with respect to the use and maintenance of education records; and
> (3) Is subject to the requirements of § 99.33(a) governing the use and redisclosure of personally identifiable information from education records.

### Testing a vendor's terms against the three conditions

| Condition | What to look for in the vendor's terms | A term that cuts against it |
| --- | --- | --- |
| Institutional service or function | A description of the service that matches work the district would otherwise do itself, such as converting its own records | Nothing in the terms does this; it is a fact about the task |
| Direct control over use and maintenance | The customer decides what is uploaded, how long it is kept and when it is deleted | The vendor reserves its own retention period or its own uses for uploaded content |
| Subject to 99.33(a) | A promise to use the content only for the customer's purpose and not to pass it on | A license to use uploads to improve products, or sharing with unnamed third parties |

Paragraph (a)(1)(ii) of the same section adds that the district "must use reasonable methods to ensure that school officials obtain access to only those education records in which they have legitimate educational interests." In practical terms, upload the pages the task needs and leave the rest of the file where it is.

Outside counsel is in the same position as the vendor one step earlier: the firm received the records from the district under some provision, and the district is the one that determined it. Ask the district's records custodian or general counsel which provision the district relies on for the firm, and whether its contracts or policies say anything about the firm's own service providers. Check whether your state has a student privacy statute that sets its own terms for vendor contracts before you rely on the federal rule alone.

When you read a converter's terms, the clauses to find are the ones on use of uploads, retention and deletion. The list of [clauses that decide what happens to uploaded client documents](https://www.schemalaw.com/blog/ocr-vendor-data-processing-agreement#which-clauses-decide-what-happens-to-uploaded-client-documents) explains each. Schema Law's plan list states four commitments for every plan, including "Your documents are never used to train an AI model" and "Delete any document, at any time". Those are the site's words. Whether they satisfy a district's reading of the three conditions is for the district to decide, in writing.

## Student records a law firm received by subpoena or court order

Student records produced under a subpoena or court order reach the law firm through a specific FERPA exception with a notice condition. The regulation's general limit on redisclosure does not apply to that exception. What limits the firm's handling is the order itself, any protective order in the case and the firm's own confidentiality duties.

The exception is 34 CFR 99.31(a)(9)(i): "The disclosure is to comply with a judicial order or lawfully issued subpoena." Under paragraph (a)(9)(ii), the school may disclose "only if the agency or institution makes a reasonable effort to notify the parent or eligible student of the order or subpoena in advance of compliance, so that the parent or eligible student may seek protective action", with listed exceptions for certain grand jury, law enforcement and terrorism-related orders.

The redisclosure rule is [34 CFR 99.33](https://www.ecfr.gov/current/title-34/section-99.33). Paragraph (a)(1) states the general condition: a school may disclose personally identifiable information "only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the parent or eligible student." Paragraph (c) then says that paragraph (a) "does not apply to disclosures under §§ 99.31(a)(8), (9), (11), (12), (14), (15), and (16)". Disclosures under a subpoena or order are in that list.

That does not make the records free to circulate. Before converting subpoenaed student records, read:

1. **The subpoena or order.** Note any terms on who may see the records and what happens to them afterwards.
2. **Any protective order in the case.** A protective order may limit which outside vendors can receive designated material. The post on [whether an OCR service is a vendor under your protective order](https://www.schemalaw.com/blog/ocr-documents-under-a-protective-order#is-an-ocr-service-a-vendor-under-your-protective-order) covers that reading.
3. **Whether the parent or student sought protective action.** The notice condition exists so they can. A pending motion is a reason to wait.
4. **Your own rules of professional conduct** on information relating to the representation.

One more provision matters when a firm passes records on. Under 99.33(b)(2), a party that "receives a court order or lawfully issued subpoena and rediscloses personally identifiable information from education records on behalf of an educational agency or institution in response to that order or subpoena" must provide the notification that (a)(9)(ii) requires. If your firm is the one answering a subpoena for a school client, the notice duty travels with you.

## Does FERPA bind a lawyer who represents the parent or the student?

FERPA's regulations are addressed to educational agencies and institutions, and 34 CFR 99.1 does not list a parent's or student's lawyer among them. What reaches that lawyer is the condition a school attaches when it discloses records on a signed consent, and that depends on how the copies were obtained. Read the consent form.

### Records released to the lawyer on a signed consent

When a school sends records straight to the lawyer, it does so on a written consent under [34 CFR 99.30](https://www.ecfr.gov/current/title-34/section-99.30). The consent must "Specify the records that may be disclosed", "State the purpose of the disclosure" and "Identify the party or class of parties to whom the disclosure may be made." The school then discloses on the 99.33(a)(1) condition that the recipient "will not disclose the information to any other party without the prior consent of the parent or eligible student." Paragraph (a)(2) adds that "The officers, employees, and agents of a party that receives information under paragraph (a)(1) of this section may use the information, but only for the purposes for which the disclosure was made."

The regulation does not say whether a conversion service used by a law firm is an "agent" of the firm for that sentence. The consent is your client's to give, so the clean approach is to have the client agree in writing to the tools the firm will use on the file. The post on [client consent to use AI tools](https://www.schemalaw.com/blog/client-consent-to-use-ai-tools) covers how to ask and what to tell the client.

### Records the parent or student obtained and handed over

A school may disclose records "to the parent of a student who is not an eligible student or to the student" under 99.31(a)(12), and 99.33(c) takes that kind of disclosure out of the redisclosure condition. An "eligible student" is one "who has reached 18 years of age or is attending an institution of postsecondary education". Copies your client collected personally and brought to your office arrive without the 99.33(a) condition attached.

They still arrive as client confidences, and a disciplinary file or evaluation can name other students. A worked example shows the difference.

A fictional parent, Dana Whitcombe, hires a lawyer to challenge her son's expulsion. She brings 60 pages she requested from the school herself. The lawyer also sends the school a signed consent and receives 140 more pages directly. The first set came to Ms. Whitcombe under (a)(12). The second came to the lawyer under the consent, limited to the purpose written on the form. The lawyer asks Ms. Whitcombe to approve the conversion tool in writing before any of the 200 pages is uploaded, and notes that witness statements in the second set name three other students.

Student privacy covers those three other students even though they are not the client. Children's privacy concerns grow when the statements describe minors by nickname, team, or incident date. Education records in the second set should be split so you convert only the pages that answer the expulsion question. Leave class lists and therapy notes as images until someone decides they are needed.

## Special education files and their extra confidentiality rules

Special education files are covered by FERPA and by a second set of confidentiality rules in the regulations under Part B of the Individuals with Disabilities Education Act, at 34 CFR 300.610 to 300.626. Those sections add a parental consent rule, safeguards, an access log and a destruction right that apply to the agencies holding the records.

The IDEA sections borrow FERPA's definition: under [34 CFR 300.611](https://www.ecfr.gov/current/title-34/section-300.611), education records "means the type of records covered under the definition of 'education records' in 34 CFR part 99". The duties fall on a "participating agency", defined there as "any agency or institution that collects, maintains, or uses personally identifiable information, or from which information is obtained, under Part B of the Act."

| Section | What it requires of the agency | Why it matters before conversion |
| --- | --- | --- |
| [300.622](https://www.ecfr.gov/current/title-34/section-300.622) | Parental consent "before personally identifiable information is disclosed to parties, other than officials of participating agencies", unless the disclosure is authorized without consent under 34 CFR part 99 | A vendor must fit a FERPA exception or the parent must consent |
| [300.623](https://www.ecfr.gov/current/title-34/section-300.623) | Protect confidentiality "at collection, storage, disclosure, and destruction stages"; one official assumes responsibility | The district has a named person to ask |
| [300.614](https://www.ecfr.gov/current/title-34/section-300.614) | Keep "a record of parties obtaining access to education records", with name, date and purpose | Ask whether a vendor's access must be logged |
| [300.624](https://www.ecfr.gov/current/title-34/section-300.624) | Inform parents when information is no longer needed, and destroy it "at the request of the parents", subject to a stated permanent record | Converted copies held by a firm or vendor are copies to account for |

Section 300.611 defines destruction as "physical destruction or removal of personal identifiers from information so that the information is no longer personally identifiable." If a parent's destruction request reaches the district, exports sitting in a converter account or a matter folder are within what the district will need to find.

Special education files also hold evaluations, therapy notes and physician letters. The regulations quoted here govern them as education records when the school maintains them. Medical records that a firm obtains from a clinic or hospital come under a different federal rule, which the post on [business associate agreements with an OCR vendor](https://www.schemalaw.com/blog/ocr-vendor-business-associate-agreement) covers.

## Removing student names from converted text before it is shared

Removing student names from converted text can take the text outside the consent requirement, but only if every identifier is gone and no one could reasonably work out who the student is. The regulation sets that test for de-identified records. A name search is the start of the job, and indirect identifiers are the hard part.

The test is in 34 CFR 99.31(b)(1). A school, "or a party that has received education records or information from education records under this part", may release the records without consent "after the removal of all personally identifiable information provided that the educational agency or institution or other party has made a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information."

### A routine for a converted file

1. **Convert to text you can search.** A plain text or Word export lets you search for every form of a name. Recognition is strongest on clean print and weaker on handwriting, and a misread name will not match your search, so read the pages as well.
2. **List the identifiers before you search.** Use the 99.3 list: student name, parent and family names, address, student number, Social Security number, date and place of birth. Add nicknames, initials and siblings.
3. **Search and replace with neutral labels** such as "Student A" and "Parent 1". Keep the key in a separate, restricted file.
4. **Read for indirect identifiers.** A small school, a rare diagnosis, a team roster or an incident date can identify a child without a name. The catch-all in the definition covers information that would let "a reasonable person in the school community" identify the student "with reasonable certainty".
5. **Check the other students.** Witness statements and class lists name children who are not your client.
6. **Check the file, not only the visible text.** File names, document properties, headers and the image layer of a searchable PDF can still show the name. A scan with a black box drawn over a name may keep the name in its text layer; the post on [whether to OCR before or after redaction](https://www.schemalaw.com/blog/ocr-before-or-after-redaction) explains the safe order.
7. **Record who made the determination and on what basis.** The rule asks for a "reasonable determination", so keep a note of it.

De-identifying for an expert, a mediator or a training file is separate from redacting a court filing. Court rules set their own list of identifiers, described under [which personal identifiers court rules make you redact](https://www.schemalaw.com/blog/ocr-documents-with-social-security-numbers#which-personal-identifiers-do-court-rules-make-you-redact).

If students or volunteers do this work in a clinic, the post on [OCR for law schools](https://www.schemalaw.com/blog/ocr-for-law-schools) covers supervising what they upload and share. Schema Law reads uploaded pages into text and tables and exports them in the [formats listed on the homepage](https://www.schemalaw.com/#formats). It does not find or remove names for you, so the routine here is yours to carry out on the export.

## Try it on a real document

Upload a scanned PDF and export it as Word, a searchable PDF or plain text on the free plan. Your documents are never used to train an AI model. [Start free](https://www.schemalaw.com/api/auth/google)