FERPA & Student Records:
A Document Destruction Guide for Massachusetts Schools

1. What FERPA Covers — and Why Schools Have Unique Obligations

The Family Educational Rights and Privacy Act (FERPA), enacted in 1974 under 20 U.S.C. §1232g and implemented by regulations at 34 CFR Part 99, is the primary federal law governing student education records. It applies to any educational agency or institution that receives funds under a program administered by the U.S. Department of Education — which includes virtually every public school and most private schools in Massachusetts.

FERPA gives parents and eligible students (those 18 or older, or attending postsecondary institutions) four core rights: the right to inspect and review education records, the right to seek amendment of records believed to be inaccurate, the right to consent before disclosure to third parties, and the right to file a complaint with the U.S. Department of Education.

The fourth right is the one most often overlooked in the context of document disposal: the right to be notified before records are destroyed and to receive copies. FERPA and Massachusetts 603 CMR 23.00 both treat destruction as a significant act requiring procedural compliance — not just a logistical task for the front office to handle during summer break. When records are destroyed, a notarized Certificate of Destruction is your documentation that it was done correctly.

What Counts as an Education Record

The breadth of the FERPA definition surprises many school administrators. Education records are not limited to academic transcripts and report cards. The following categories are all education records subject to FERPA and, in Massachusetts, to 603 CMR 23.00:

• Academic transcripts, report cards, and grade books
• Attendance records and enrollment documentation
• Special education records including IEPs, 504 Plans, evaluation reports, and meeting notes
• School health records maintained by school nurses
• Disciplinary records, incident reports, and suspension/expulsion documentation
• Standardized test scores and state assessment results
• Counseling records created and maintained by school counselors in the normal course of their duties
• Teacher observation notes shared with other staff or placed in the student record
• Communications and correspondence related to specific students
• Financial aid and lunch program eligibility records
• Photographs and videos in which a student is personally identifiable

What is not an education record under FERPA includes personal notes kept solely in the possession of the maker and not shared with others, records maintained by law enforcement units of the school, and employment records of individuals who are also students (when those records relate solely to employment). Homework, quizzes, and academic papers returned to students are also generally not education records.

2. Massachusetts 603 CMR 23.00 — Stronger Protections Than Federal Law

Massachusetts implemented its own student records regulations — 603 CMR 23.00 — under M.G.L. c. 71, §§34D and 34F. These regulations are intended to work in harmony with FERPA but provide stronger protections in several important respects. For Massachusetts school administrators, 603 CMR 23.00 is the operative compliance framework, and its requirements must be met even when federal FERPA would permit a less protective approach.

Two Record Categories — Two Different Retention Periods

Massachusetts 603 CMR 23.00 divides student records into two categories with fundamentally different retention and destruction requirements. Understanding this distinction is the foundation of any compliant records management program. The full retention framework for all record types is in our Massachusetts document retention schedule.

Rights Transfer at Age 14 in Massachusetts — Earlier Than Federal Law

A key difference between federal FERPA and Massachusetts 603 CMR 23.00: Massachusetts transfers student rights — including the right to be notified before record destruction — to the student beginning at age 14 or upon entering 9th grade, whichever comes first. Federal FERPA transfers rights at 18 or upon postsecondary enrollment. This means Massachusetts schools must treat 8th and 9th grade students as eligible participants in decisions about their records two years earlier than federal law requires.

3. The Parent Notification Requirement — The Step Most Districts Miss

Massachusetts 603 CMR 23.07(2) is explicit: before destroying any temporary record, the school must provide written notice to the parent (or eligible student) and give them an opportunity to receive the record or a copy of it. This applies during periodic reviews of temporary records while the student is enrolled and at the end of the retention period when systematic destruction occurs.

The regulation cautions that notice should be delivered directly — such as in a graduation packet, end-of-year communication, or individual letter — not merely posted as a general newspaper announcement or buried in a district-wide policy notice. A general annual publication of the district’s destruction policy satisfies the FERPA requirement; Massachusetts 603 CMR 23.00 expects more meaningful individual notification.

The Correct Four-Step Destruction Procedure

4. IDEA Special Education Records — The Most Sensitive Category

The FERPA-HIPAA Intersection for School Health Records

School nurse records and health information maintained as part of a student’s education record are subject to FERPA, not HIPAA — even though they contain medical information. FERPA generally preempts HIPAA for education records maintained by educational institutions. However, records maintained by a school-based health clinic that provides services to the broader community (not solely students) may be subject to HIPAA. Schools should consult with legal counsel if they are uncertain which framework governs their health records.

For purposes of document disposal, the practical implication is straightforward: school nurse records that are part of the student education record must be treated as education records under FERPA and 603 CMR 23.00, destroyed after the temporary record retention period with written parent notice, and documented with a Certificate of Destruction.

5. Massachusetts School Records Retention Schedule

The following schedule applies to Massachusetts public K–12 schools and private schools with publicly-funded programs. Charter schools operating as public school programs are also subject to these requirements. Individual districts may adopt longer retention periods than the minimums required by regulation — but no district may destroy records before the applicable minimum period has elapsed. See our full Massachusetts document retention schedule by industry for additional context on related employer and administrative records.

School districts should review and update their records management policies annually. The Massachusetts Department of Elementary and Secondary Education (DESE) and the Massachusetts State Archives provide guidance on record retention for different categories of municipal and educational records. When a record could be classified in more than one category, retain for the longer period.

6. The Volume Challenge — Why School Districts Accumulate So Much

A typical school district creates and receives thousands of student records each year. A district with 3,000 students — common for a mid-sized Massachusetts district like Chelmsford, Billerica, or Dracut — generates seven years of accumulating temporary records for each cohort. By the time those records are eligible for destruction, the district may have filing rooms, storage closets, or off-site storage units filled with boxes of paper that should have been destroyed years ago.

The volume problem compounds in a few specific circumstances:

• Districts that never conducted a systematic purge may have temporary records dating back 15 or 20 years. Every year of delay adds more records eligible for destruction and more potential breach exposure for records that should no longer exist.
• School closings and consolidations create concentrated volumes: when a building closes or two schools merge, the accumulated records of both must be reviewed, parent-notified, and either transferred or destroyed.
• Digital transition residue: the shift from paper to digital systems left many districts with a generation of paper records that were never digitized, sitting in boxes alongside their digital-era equivalents.
• Chromebook and device retirements: districts that issued 1:1 devices to students now face the annual challenge of safely disposing of aging hardware that contains student login credentials, locally cached data, and browsing histories.

7. Student Device Retirement — The Overlooked FERPA Risk

Massachusetts schools have issued millions of Chromebooks, tablets, and laptops to students over the past decade. When those devices reach end of life — typically after four to six years — the district faces a data security obligation that most have not fully addressed.

Student devices may contain locally cached Google account data, downloaded files, browsing histories, locally stored documents, and in some cases, cached credentials for school systems. Even after a factory reset, data may remain recoverable from the underlying storage hardware, particularly on older Chromebooks with spinning hard drives rather than eMMC flash storage. A student’s name, student ID, grade, and usage patterns stored on a device that is donated, sold for salvage, or improperly discarded represents a FERPA violation if that information is subsequently accessed by an unauthorized person.

The correct standard for student device retirement is physical destruction of the storage media with a serial number Certificate of Destruction — the same standard required for business IT assets under NIST 800-88 and the FTC Safeguards Rule. Our IT asset disposal service handles school device destruction with the same serial-number documentation process we apply to corporate IT assets.

8. The Consequences of Non-Compliant Disposal

DESE Complaint and Federal Loss of Funding

Parents who believe their rights under FERPA or 603 CMR 23.00 have been violated may file a complaint with the Massachusetts Department of Elementary and Secondary Education or with the U.S. Department of Education’s Family Policy Compliance Office. A sustained finding of a FERPA violation can result in the withholding of federal education funding — a sanction that, while rarely invoked in full, represents a serious institutional risk. DESE has the authority to conduct compliance reviews and to require corrective action by districts found to be in violation of 603 CMR 23.00.

Breach Liability Under Massachusetts 201 CMR 17.00

Massachusetts 201 CMR 17.00 applies to school districts as entities that maintain personal information about Massachusetts residents. A breach of student records through improper disposal triggers notification obligations under M.G.L. c. 93H to the Attorney General and affected individuals. The reputational consequences of notifying hundreds or thousands of families that the district improperly disposed of records containing their children’s personal information are severe and long-lasting.

Civil Liability to Students and Families

While FERPA itself does not create a private right of action (Gonzaga University v. Doe), Massachusetts state law may provide a basis for civil claims when improper disposal of student records results in actual harm. Districts that demonstrate a systematic disregard for records management obligations — including no destruction program, no parent notification process, and no Certificate of Destruction — have limited defense in such proceedings.

9. Building a Compliant School Records Destruction Program

A compliant program requires more than calling a shredding company. It requires documented procedures, proper notification, a certified vendor, and consistent recordkeeping. The following checklist is designed for the district records manager, business manager, or administrator responsible for implementing the program.

• ✓Establish a district records retention policy. Adopt a formal written policy specifying retention periods for each record category. The policy should be approved by the school committee and reviewed annually. It should reference 603 CMR 23.00 explicitly and specify the destruction procedure including parent notification requirements.
• ✓Create an annual destruction calendar. Map the 7-year temporary record period to each graduating class. Beginning each June, identify which class-year cohorts have records eligible for destruction. This makes the purge systematic rather than ad-hoc.
• ✓Send written notice to parents and eligible students before each purge. For students who graduated or left the district 7 years ago, send written notice to the last known address — or include in graduation packets for students currently exiting. Document that notice was sent, when, and to whom. Allow 30 days for responses before proceeding.
• ✓Honor all copy requests before destroying records. Fulfill any requests from parents or eligible students for copies of their records before those records are destroyed. Document copy requests and fulfillments.
• ✓For IDEA records, follow the heightened notification procedure. When special education records are no longer needed, notify parents specifically of that fact and of the availability of the records before destruction. Note in writing that records may be needed for future purposes such as Social Security disability claims.
• ✓Select a certified shredding vendor and document your due diligence. Choose a provider with BBB accreditation, HIPAA certification, and a notarized Certificate of Destruction on every job. Document your vendor selection criteria. A district that uses an uncertified vendor or discards records in recycling dumpsters cannot demonstrate compliance when challenged by DESE.
• ✓Use locked security consoles in offices generating routine documents. Scheduling changes, routine correspondence, attendance printouts, and day-to-day administrative documents containing student information should go into a locked console, not an open waste bin. Service the consoles on a regular schedule.
• ✓Include student devices in the destruction program. When retiring Chromebooks, tablets, laptops, or any device issued to or used by students, ensure storage media is physically destroyed with a serial number Certificate of Destruction rather than donated, sold for salvage, or discarded without destruction. See our IT asset disposal service.
• ✓File every Certificate of Destruction. Maintain a destruction log linking each Certificate of Destruction to the specific records destroyed, the date, and the parent notification sent. This is your compliance audit trail for DESE reviews, FERPA complaints, and school committee inquiries.
• ✓Train building-level staff annually. Principals, office managers, school nurses, counselors, and special education staff all handle student records. Annual training on proper handling and disposal — including the prohibition on placing student records in open recycling bins or unsecured dumpsters — should be documented with attendance records.

Scheduled Service vs. Annual Purge for School Districts

10. Serving School Districts Throughout Greater Boston and the Merrimack Valley

Our Tewksbury MA facility is positioned at the center of a region with some of the largest school districts in northeastern Massachusetts. We serve public school districts, charter schools, private schools, and vocational schools throughout Middlesex County, Essex County, and northern Worcester County.