5 FERPA Mistakes DRCs Make Every Semester (and How to Stop Making Them)

Why FERPA Mistakes Keep Happening

The same FERPA mistakes recur across institutions. They are usually basic procedural failures that become habitual because no process catches them.

The scary part? Most DRC staff making these mistakes have been trained on FERPA. They know the law. They just don't see how their daily practices violate it.

Mistake #1: Sharing Without Per-Course Consent

What Happens

Coordinator processes new accommodations for a student. Student signs a general consent form. Coordinator sends accommodation letters to all five of the student's professors.

Why It's a Problem

A general "I consent to share my information with faculty" form doesn't meet FERPA's specificity requirements. Students have the right to choose which courses receive accommodation letters. A student might want extended time in their math class but not want their psychology professor (who teaches a small seminar) to know they have a disability.

The Fix

Use per-course consent. For each course, the student explicitly agrees: "Yes, share my accommodations with this professor" or "No, I don't want accommodations in this course."

This sounds cumbersome, but in practice it takes 2 minutes when built into the intake workflow. Most students consent for all courses. But the 10-15% who don't? Their privacy matters.

Mistake #2: Putting Diagnosis in Faculty Letters

What Happens

Accommodation letter reads: "Due to the student's ADHD and anxiety disorder, the following accommodations are approved..."

Why It's a Problem

Faculty need to know what accommodations to provide, not why the student receives them. Including the diagnosis:

• Violates the minimum necessary principle
• Creates bias risk (conscious or unconscious)
• Gives faculty information they have no legitimate need for
• Opens the institution to liability if the diagnosis is disclosed further

The Fix

Letters should say: "The following accommodations have been approved for this student", full stop. If faculty have questions, they contact the DRC, not the student. The coordinator can explain accommodations without disclosing the underlying condition.

What Faculty Actually Need to Know

• What specific accommodations to provide
• When accommodations apply (all exams? In-class activities? Both?)
• Who to contact with questions (DRC, not the student)
• That accommodations are not optional

That's it. Everything else is the student's private medical information.

Mistake #3: Hallway Conversations

What Happens

Two coordinators discuss a student's case while walking from a meeting to their office. A professor overhears. A student in the hallway recognizes the name.

Why It's a Problem

DRC offices are busy places. Faculty visit, students wait in lobbies, other departments share the floor. Any conversation about a student's accommodations or disability in a space where unauthorized people might hear is a potential FERPA violation.

The Fix

• Discuss student cases only in private offices with doors closed
• Never use student names in common areas
• Use case numbers instead of names when referring to files in shared spaces
• Be aware of who is in your waiting area when students check in

Mistake #4: Personal Email and Devices

What Happens

Coordinator uses personal Gmail to email a student's accommodation letter because the institutional email is down. Or takes a photo of a student's documentation on their personal phone.

Why It's a Problem

FERPA-protected information must be stored and transmitted on institutionally controlled systems. Personal email accounts:

• Aren't encrypted to institutional standards
• Can't be audited or monitored
• Persist after the employee leaves
• May be accessed by family members on shared devices

The Fix

• All student communication through institutional email or the accommodation system
• No student documents on personal devices, ever
• If institutional systems are down, wait. The accommodation can be processed tomorrow.
• Include this in staff onboarding as a non-negotiable policy

Mistake #5: Not Documenting Consent Changes

What Happens

Student calls and says "I don't want my accommodations in Professor Smith's class anymore." Coordinator removes the accommodations but doesn't document the consent withdrawal.

Three months later, the student files a complaint saying their accommodations were removed without consent.

Why It's a Problem

Without documentation of the consent withdrawal, it's the student's word against the coordinator's. FERPA requires institutions to maintain records of educational records access and disclosure, which includes consent and consent changes.

The Fix

• Every consent change, grant, withdrawal, or modification, gets timestamped documentation
• Include who made the request, when, and how (phone, email, in person)
• Confirm consent changes in writing: "Per your request on [date], we have removed your accommodations for [course]. If you'd like to reinstate them, contact us at..."
• Store consent records in your accommodation system, not in email

The Pattern

All five mistakes share something in common: they're not about bad intent. Staff may share diagnoses because faculty ask, use personal email because the system is slow, or discuss cases informally because they are busy.

Intent doesn't matter under FERPA. Process does. And process requires systems that make compliance the default, not the exception.

What Systems Should Do For You

Good accommodation management software should make FERPA compliance automatic:

• Per-course consent built into the intake workflow
• Template letters that never include diagnosis
• Audit trails for every access, change, and disclosure
• Consent tracking with timestamps and immutable records
• Role-based access so staff only see students in their caseload
• Secure messaging that eliminates the need for email

If your system requires coordinators to manually remember FERPA requirements for every interaction, you're relying on human perfection. That's not a compliance strategy.

The Bottom Line

FERPA compliance in disability services isn't about knowing the law, most DRC staff know the law. It's about building processes and using systems that make violations difficult. Every mistake on this list is preventable with the right workflow design and technology.

Review your current practices against these five mistakes this week; most institutions will find at least one area to improve.