FERPA Compliance for Disability Services: The Complete 2026 Guide
Key Takeaway
Student disability records are education records protected by FERPA. DRCs need written consent before sharing with faculty, cannot share with parents without student permission, and must ensure any software vendor signs a FERPA-compliant data sharing agreement.
What Does FERPA Protect in Disability Services?
Student disability records are "education records" under FERPA. This includes:
- Disability documentation and diagnoses
- Accommodation letters sent to faculty
- Communications between students and DRC staff
- Notes from intake and follow-up meetings
- Testing accommodations history and exam records
I've seen institutions get this wrong in ways that seem minor but have real consequences. Here's what 14 years of managing FERPA compliance has taught me.
Can DRC Staff Share Accommodation Letters with Faculty?
Yes, with written consent. Students must authorize sharing accommodation information with specific instructors. Best practice: Get blanket consent for all instructors, but let students opt out for specific courses.
Can Parents Access College Disability Records?
Generally no. Once a student turns 18 or enrolls in postsecondary education, FERPA rights transfer to the student. Parents have no automatic right to disability information.
Exceptions:
- Student provides written consent
- Health/safety emergency (narrowly defined)
- Student is claimed as dependent on taxes (limited exception)
The hardest phone calls I made as a director were telling worried parents I couldn't discuss their child's accommodations. It's the right thing legally, but it requires compassion in delivery.
Can DRC Staff Confirm a Student Is Registered?
No. Even confirming registration status is a FERPA violation without consent. This includes responding to faculty inquiries about whether a specific student is registered with disability services.
What FERPA Requirements Apply to Disability Software?
Any vendor storing student disability data must:
- Sign a FERPA-compliant data sharing agreement
- Implement AES-256 encryption for data at rest and in transit
- Limit access to authorized personnel with role-based controls
- Provide breach notification within 72 hours
- Allow data deletion upon request
FERPA Best Practices Checklist for DRCs
Consent Management
- Get written consent before sharing any information
- Document consent with dates, specifics, and scope
- Allow students to revoke consent at any time
- Track consent by course and instructor
Minimum Necessary Standard
Share only what faculty need to implement accommodations:
| Share This | Don't Share This | |-----------|-----------------| | Specific accommodations needed | Diagnosis details | | Implementation instructions | Medical records | | Contact for questions | Personal circumstances | | Duration of accommodations | Disability documentation |
Secure Storage
- Encrypt all disability records (AES-256 minimum)
- Limit access to trained staff only
- Audit who accesses records and when
- Secure physical files in locked cabinets
Common FERPA Violations in Disability Services
| Violation | Why It's Wrong | Risk Level | |-----------|---------------|------------| | Emailing accommodation letters without encryption | Unsecured transmission of education records | High | | Discussing students by name in hallways | Unauthorized disclosure to third parties | High | | Leaving files visible on desk | Physical security failure | Medium | | Sharing student info with parents without consent | Rights belong to student, not parent | High | | Using personal email for student communications | Records not properly secured or retained | Medium |
How Long Should DRCs Retain Disability Records?
Keep disability records for the same period as other education records, typically 5-7 years after last enrollment. Maintain records of all consent authorizations, access logs, disclosures to third parties, and security incidents.
Frequently Asked Questions
Are disability accommodation records protected by FERPA?
Yes. Student disability records including documentation, accommodation letters, communications, meeting notes, and testing history are all 'education records' under FERPA and require student consent before sharing.
Can disability services share accommodation letters with faculty?
Yes, but only with written student consent. Best practice is to get blanket consent for all instructors while allowing students to opt out for specific courses.
Can parents access their child's disability accommodation records in college?
Generally no. Once a student turns 18 or enrolls in postsecondary education, FERPA rights transfer to the student. Exceptions include written student consent, health/safety emergencies, and limited dependent student provisions.
What FERPA requirements apply to disability services software vendors?
Any vendor storing student disability data must sign a FERPA-compliant data sharing agreement, implement appropriate security controls (encryption, access controls), limit access to authorized personnel, and provide breach notification.
Sources & References
Director of Disability Services & FERPA Compliance Officer
Thandiwe ran the DRC at a Big Ten school for eight years before joining AccommodoHub. She's reviewed over 12,000 accommodation cases and built the compliance framework that most of our product is based on. She still guest-lectures on ADA/Section 504 at Michigan's School of Education.
Ed.D. in Higher Education Leadership, University of Michigan. Certified Disability Management Specialist (CDMS). 14 years directing DRC operations at two R1 universities serving 35,000+ students.