Sharing attendance data with community partners, under FERPA.

How can a school share attendance data with a partner under FERPA?

Daily attendance is part of a student’s education record, so FERPA applies. It is not directory information: the regulation says “dates of attendance” means the school year or term, and “does not include specific daily records of a student’s attendance.” A school can share it with a partner in one of four ways.

For a partner that calls families, mentors students or runs the attendance work in a community school, the school official exception is usually the fit. The U.S. Department of Education’s guidance uses a community organization running a tutoring program the school would otherwise staff as its example. FERPA doesn’t require a written agreement for that route, but the Department’s FAQ is plain: “It is a best practice to enter into a written agreement.”

The school also has to use reasonable methods to make sure each official, including a partner, reaches only the records it has a legitimate educational interest in. In practice, that means partners see their caseload, not the school.

What should a data sharing agreement for community schools include?

Federal checklists, StriveTogether’s privacy task force and district partner programs agree on the same core terms. StriveTogether calls FERPA “the absolute minimum requirements” and urges partners to go further.

• Purpose. What the partner will do with the data, in one or two sentences: “to contact families of students on our caseload about absences and arrange support.” Use stays limited to that purpose.

• The FERPA route. Which exception the sharing relies on, stated plainly. StriveTogether’s task force advises naming the FERPA authority for every data exchange.

• Data elements. A list, not “attendance data.” For follow-up that is usually name, grade, daily attendance, absence count and rate, and the family’s phone number and language. Share only what the work needs.

• Which students, and who sees them. The students on the partner’s caseload, and the named roles on the partner’s staff who may see them. Not the whole school.

• Security. Individual accounts, encryption in transit and at rest, and access removed when someone leaves. Federal guidance and StriveTogether’s task force both call for safeguards like these.

• No redisclosure. The partner may not pass identifiable records to anyone else, including funders and other programs, without consent.

• Retention and destruction. How long the partner keeps the data, and that it is destroyed, with a date, when the agreement ends or the data is no longer needed.

• Training. Who on the partner’s staff completes privacy training, and how often. Seattle Public Schools requires one person per partner to complete data stewardship training each year.

• Term and renewal. Start and end dates, and a yearly renewal. Seattle’s agreement, consent forms and training must all be renewed each year.

If the partner relies on parent consent instead, the consent form needs three things under FERPA: the records to be shared, the purpose, and who receives them. It must be signed and dated, and an electronic signature counts.

Do state student privacy laws add requirements?

Often, especially when the data moves through an online tool. Two examples:

• Illinois, Student Online Personal Protection Act (105 ILCS 85)An online service receiving student information from a public school must sign a written agreement first, listing the data it receives, stating that it acts as a school official, and setting when data is deleted. The school posts the agreement on its website, and the operator must report a breach within 30 calendar days of determining it happened.
• California, SOPIPA (Business and Professions Code 22584)Operators of online services designed and marketed for K-12 school purposes may not sell student information, use it for targeted advertising or build profiles outside school purposes. They must keep reasonable security and delete a student’s information when the school asks.

Examples, not legal advice. Your state’s law, your district’s policy and your district’s privacy office decide what you need; check with them before you share.

How do community school partners get attendance data, in weeks not months?

Most delays come from starting from a blank page or settling the caseload late. A community school director and principal can work through these together.

1. 1

   Call the district’s privacy or data office first

   Most districts already have a standard data sharing agreement for partners. Using it is faster than drafting your own, and the office will tell you which FERPA route they use.

2. 2

   Agree on the route and the caseload

   The principal and the community school director decide whether the partner works as a school official or with parent consent, and which students are on the partner’s caseload.

3. 3

   Check the annual FERPA notice

   Under the school official exception, the partner must fit the criteria the school publishes each year for who counts as a school official. If the notice is narrow, ask the district how partners are covered.

4. 4

   If you need consent, build it into enrollment

   Put the consent on the program’s registration form, in the families’ languages. Clear the wording with the district first: a school does not have to honor a consent a partner collected on its own.

5. 5

   Set up individual accounts and train

   Each partner staff member gets their own sign-in and sees only their caseload. Do the training before the first file is shared.

6. 6

   Put the renewal and deletion dates on the calendar

   The agreement, consent forms and training expire. Data should leave with them.

One district’s timeline, as an example. Seattle Public Schools gives partners attendance, discipline, assessment and demographic data, through reports and a dashboard, for the students each partner has permission to see. Its published goals:

• 2–3 weeks

  to sign a partner’s data sharing agreement after the district receives it.

  Seattle Public Schools (goal)

• 1–2 weeks

  to review consent forms and add students to the partner’s reports and dashboard.

  Seattle Public Schools (goal)

• 1 week

  from consent being established to the partner seeing the student’s data.

  Seattle Public Schools (goal)

Once data flows, put it to work: a shared follow-up list and one tiered plan for school and partner staff. Our guide on how to reduce chronic absenteeism covers what to do with it.

What mistakes should schools and partners avoid?

• Emailing spreadsheets

  An attachment with names and absences gets forwarded, saved to laptops and kept forever. Nobody can take it back or see who opened it.

• Shared logins

  One account for the whole partner team means no one can tell who looked at what, and a staff member who leaves keeps the password.

• The whole-school file

  Sending every student’s record because it is easier than filtering. Partners should see their caseload only.

• No end date

  Data that sits on the partner’s drive after the program ends. FERPA requires destruction for studies and evaluations; make it the rule for everyone.

• Reusing data for reports

  Identifiable student data in a grant report or a funder’s dashboard is redisclosure. Report counts, not names.

• Treating attendance as directory information

  It isn’t. FERPA’s directory information includes dates of attendance, meaning the school year or term, and expressly not daily attendance records.

This page explains federal rules and published guidance. It is not legal advice.

Common questions

Chronic absenteeism: the numbers, the rules and what works →How to choose attendance software →

Sources

1. 1. U.S. Department of Education, Student Privacy Policy Office, “FERPA Guidance on Sharing Information with Community-Based Organizations” (Dec. 2014, links updated Feb. 2022).
2. 2. Student Privacy Policy Office FAQ, “Can schools disclose education records to community-based organizations performing outsourced services?”: the four school official conditions; “It is a best practice to enter into a written agreement.”
3. 3. Student Privacy Policy Office FAQ, studies exception conditions for community-based organizations: no personal identification outside the study team, destruction, written agreement.
4. 4. 34 CFR 99.31: school officials, including outside parties under direct control (a)(1); reasonable methods to limit access (a)(1)(ii); studies and written agreements (a)(6).
5. 5. 34 CFR 99.3: definitions of directory information and dates of attendance (“does not include specific daily records of a student’s attendance”).
6. 6. 34 CFR 99.30: what written consent must specify; electronic signatures.
7. 7. 34 CFR 99.35: audit or evaluation; written agreement to designate an authorized representative; destruction.
8. 8. Privacy Technical Assistance Center, “Guidance for Reasonable Methods and Written Agreements” (PTAC-FAQ-5, rev. June 2015): security, destruction, training and data minimization terms.
9. 9. Privacy Technical Assistance Center, “Written Agreement Checklist” (July 2015).
10. 10. U.S. Department of Education, “Data-Sharing Tool Kit for Communities: How To Leverage Community Relationships While Protecting Student Privacy” (Mar. 2016), via Attendance Works: consent built into registration; schools need not honor consents given to third parties.
11. 11. Attendance Works, “Protecting Student Privacy When Sharing Data.”
12. 12. StriveTogether, “Student Data Privacy: Best Practices” (Jan. 2015): FERPA as “the absolute minimum requirements”; least-privilege access, audit trails, agreements with retention and destruction terms.
13. 13. Seattle Public Schools, “Data Access for Partners”: data sharing agreement, annual consent in seven languages, data stewardship training, timeline goals.
14. 14. FutureEd, “Community Collaborations” (Covid Relief Playbook): data-sharing agreements and memoranda of understanding between districts and outside agencies.
15. 15. Illinois Student Online Personal Protection Act, 105 ILCS 85/15: operator duties and written agreement contents.
16. 16. California Business and Professions Code 22584 (SOPIPA): operator prohibitions, security and deletion duties.