5 FERPA Mistakes DRCs Make Every Semester (and How to Stop Making Them)
Key Takeaway
The five most common FERPA mistakes in DRCs: (1) sharing accommodation details without per-course consent, (2) including disability diagnosis in faculty letters, (3) discussing students in hallways or shared spaces, (4) using personal email for student communications, and (5) not documenting consent withdrawals. Most are procedural failures, not malicious intent, but OCR doesn't distinguish between the two.
Why FERPA Mistakes Keep Happening
In my 18 years working in disability rights, including 5 years as an OCR investigator, I've seen the same FERPA mistakes at institution after institution. They're not complicated or obscure. They're basic procedural failures that become habitual because nobody catches them.
The scary part? Most DRC staff making these mistakes have been trained on FERPA. They know the law. They just don't see how their daily practices violate it.
Mistake #1: Sharing Without Per-Course Consent
What Happens
Coordinator processes new accommodations for a student. Student signs a general consent form. Coordinator sends accommodation letters to all five of the student's professors.
Why It's a Problem
A general "I consent to share my information with faculty" form doesn't meet FERPA's specificity requirements. Students have the right to choose which courses receive accommodation letters. A student might want extended time in their math class but not want their psychology professor (who teaches a small seminar) to know they have a disability.
The Fix
Use per-course consent. For each course, the student explicitly agrees: "Yes, share my accommodations with this professor" or "No, I don't want accommodations in this course."
This sounds cumbersome, but in practice it takes 2 minutes when built into the intake workflow. Most students consent for all courses. But the 10-15% who don't? Their privacy matters.
Mistake #2: Putting Diagnosis in Faculty Letters
What Happens
Accommodation letter reads: "Due to the student's ADHD and anxiety disorder, the following accommodations are approved..."
Why It's a Problem
Faculty need to know what accommodations to provide, not why the student receives them. Including the diagnosis:
- Violates the minimum necessary principle
- Creates bias risk (conscious or unconscious)
- Gives faculty information they have no legitimate need for
- Opens the institution to liability if the diagnosis is disclosed further
The Fix
Letters should say: "The following accommodations have been approved for this student", full stop. If faculty have questions, they contact the DRC, not the student. The coordinator can explain accommodations without disclosing the underlying condition.
What Faculty Actually Need to Know
- What specific accommodations to provide
- When accommodations apply (all exams? In-class activities? Both?)
- Who to contact with questions (DRC, not the student)
- That accommodations are not optional
That's it. Everything else is the student's private medical information.
Mistake #3: Hallway Conversations
What Happens
Two coordinators discuss a student's case while walking from a meeting to their office. A professor overhears. A student in the hallway recognizes the name.
Why It's a Problem
DRC offices are busy places. Faculty visit, students wait in lobbies, other departments share the floor. Any conversation about a student's accommodations or disability in a space where unauthorized people might hear is a potential FERPA violation.
The Fix
- Discuss student cases only in private offices with doors closed
- Never use student names in common areas
- Use case numbers instead of names when referring to files in shared spaces
- Be aware of who is in your waiting area when students check in
Mistake #4: Personal Email and Devices
What Happens
Coordinator uses personal Gmail to email a student's accommodation letter because the institutional email is down. Or takes a photo of a student's documentation on their personal phone.
Why It's a Problem
FERPA-protected information must be stored and transmitted on institutionally controlled systems. Personal email accounts:
- Aren't encrypted to institutional standards
- Can't be audited or monitored
- Persist after the employee leaves
- May be accessed by family members on shared devices
The Fix
- All student communication through institutional email or the accommodation system
- No student documents on personal devices, ever
- If institutional systems are down, wait. The accommodation can be processed tomorrow.
- Include this in staff onboarding as a non-negotiable policy
Mistake #5: Not Documenting Consent Changes
What Happens
Student calls and says "I don't want my accommodations in Professor Smith's class anymore." Coordinator removes the accommodations but doesn't document the consent withdrawal.
Three months later, the student files a complaint saying their accommodations were removed without consent.
Why It's a Problem
Without documentation of the consent withdrawal, it's the student's word against the coordinator's. FERPA requires institutions to maintain records of educational records access and disclosure, which includes consent and consent changes.
The Fix
- Every consent change, grant, withdrawal, or modification, gets timestamped documentation
- Include who made the request, when, and how (phone, email, in person)
- Confirm consent changes in writing: "Per your request on [date], we have removed your accommodations for [course]. If you'd like to reinstate them, contact us at..."
- Store consent records in your accommodation system, not in email
The Pattern
All five mistakes share something in common: they're not about bad intent. Every DRC staff member I've seen make these mistakes was trying to help students. They shared diagnoses because faculty asked. They used personal email because the system was slow. They discussed cases in hallways because they were busy.
Intent doesn't matter under FERPA. Process does. And process requires systems that make compliance the default, not the exception.
What Systems Should Do For You
Good accommodation management software should make FERPA compliance automatic:
- Per-course consent built into the intake workflow
- Template letters that never include diagnosis
- Audit trails for every access, change, and disclosure
- Consent tracking with timestamps and immutable records
- Role-based access so staff only see students in their caseload
- Secure messaging that eliminates the need for email
If your system requires coordinators to manually remember FERPA requirements for every interaction, you're relying on human perfection. That's not a compliance strategy.
The Bottom Line
FERPA compliance in disability services isn't about knowing the law, most DRC staff know the law. It's about building processes and using systems that make violations difficult. Every mistake on this list is preventable with the right workflow design and technology.
Review your current practices against these five mistakes this week. I'd bet you'll find at least one.
Frequently Asked Questions
Does FERPA allow DRCs to share accommodation information with faculty?
Yes, but only with proper consent and only the minimum necessary information. Students must consent to information sharing for each course, and faculty should only receive the specific accommodations to be implemented, never the disability diagnosis, medical documentation, or details about the student's condition.
Can DRC staff discuss student accommodations with each other?
Yes, DRC staff with legitimate educational interest can discuss student accommodations for operational purposes. However, discussions should occur in private settings, not in hallways, shared offices, or common areas where unauthorized individuals might overhear. Even within the DRC, information should be shared on a need-to-know basis.
What happens if a DRC violates FERPA?
FERPA violations can result in institutional investigation by the Department of Education, loss of federal funding eligibility (the ultimate penalty, though rarely enforced), required remediation and compliance monitoring, reputational damage, and individual complaints filed with the Student Privacy Policy Office. Most FERPA issues are resolved through corrective action plans rather than funding loss.
Sources & References
Higher Ed Policy Analyst & ADA Compliance Consultant
Faridah spent five years as an investigator at the Office for Civil Rights (OCR) in the U.S. Department of Education before moving to consulting. She's investigated over 200 disability discrimination complaints and now helps institutions get ahead of compliance issues instead of responding to them. She's the reason our audit logs are as thorough as they are.
J.D., Georgetown University Law Center. M.A. in Disability Studies, Syracuse University. Former OCR investigator. 18 years in disability rights and higher education policy.