How to Review Who Accessed or Received a Student's Records

Request the correct access or disclosure record

For Priya, identify the education-record set and period, then ask for the record maintained under FERPA and any IDEA access record that applies. Request available information about further disclosures. Keep the response tied to the school or agency that maintains the underlying records rather than treating one platform log as the complete answer.

Interpret entries by legal route

Record the requester or recipient, date, records involved, purpose, authority, and whether consent or an exception was used. FERPA excludes certain categories from its disclosure-record requirement, including specified access by school officials and disclosures to the parent or eligible student. An absent entry therefore needs context before any conclusion.

Separate privacy review from technical forensics

A FERPA or IDEA log can support a privacy question. It may omit authentication attempts, exports, screenshots, shared credentials, vendor administrator activity, or other security evidence. Route a suspected compromise through the school's security and incident process while the records custodian addresses disclosure authority and accuracy.

Resolve unfamiliar entries with evidence

For Priya's unfamiliar vendor and evaluator, ask which contract, school-official criteria, consent, exception, purpose, record category, access period, restrictions, and termination controls applied. Preserve the school response and any corrected log. Escalate unresolved legal questions to the designated privacy office, state process, or qualified counsel.

Prepare Priya's record review

Bring Priya's student-record disclosure review, the school's annual FERPA notice and records procedure, current IDEA records when applicable, representative files and messages, authority or eligible-student information, access and communication needs, open deadlines, and a short decision list. Also bring delivery evidence, school responses, correction history, disclosure questions, retention notices, and requested outcomes. End with owners, dates, and a representative verification test.

Build Priya's source-attributed register

Create a restricted student-record disclosure review for Priya's record set, requester, recipient, date, purpose, authority, consent or exception, further disclosure, excluded category, concern, response, and correction. Give every field a source, record or notice version, holder, requester, recipient, authority, date, status, owner, next action, due date, correction, and closure evidence. Attribute the student's direct communication, family report, school record, school explanation, clinical record, professional opinion, and legal conclusion separately.

Protect Priya's access and participation

Give Priya and family participants understandable, accessible information, privacy, sufficient review time, and a reliable way to ask questions, disagree, correct, accept, decline, pause, and request help. Keep AAC, interpreters, captions, screen readers, hearing and vision tools, mobility supports, food, water, bathroom access, prescribed care, rest, and emergency help available.

Ask eight record-rights questions for Priya

Use these questions in the student-record disclosure review:

• Which record, category, holder, school or agency, requester, date range, and purpose apply?
• Which FERPA, IDEA, HIPAA, state, district, court, contract, or other source governs the field?
• Who holds the right now, and what authority or eligible-student status supports the request or decision?
• Which inspection, explanation, copy, accessibility, amendment, hearing, disclosure, retention, or destruction step is due?
• Which exact clock starts and ends the step, and which event can require earlier action?
• What did Priya communicate directly, and what did family, school, or a professional report separately?
• Which source record, response, delivery, correction, access, or validation evidence exists?
• Which representative item will show that the repaired record process works?

Classify fields as complete, failed, pending, declined, disputed, excluded, superseded, held, or inapplicable with a reason.

A fictional education-record example for Priya

Priya is fictional and involved in a disclosure-log review after an unfamiliar vendor and outside evaluator appear in the student's record history. Reviewers freeze 42 request, recipient, purpose, authority, date, exception, further-disclosure, and follow-up fields and complete 31 of 42, or 73.8%, by the checkpoint. A missing record identity, holder, authority, source, date, access, explanation, copy, correction, disclosure, retention, or validation field remains in Priya's denominator with an owner, age, and next action.

The student-record disclosure review measures evidence completion. It leaves legal compliance, educational quality, clinical quality, record accuracy, disclosure lawfulness, student understanding, family experience, and outcome as separate questions. Concurrent changes limit causal conclusions.

Use compatible record denominators for Priya

For Priya's student-record disclosure review, report eligible records produced divided by records due; accessible records received divided by accessible records due; explanations answered divided by explanations due; amendment decisions issued divided by decisions due; disclosure entries resolved divided by entries reviewed; and corrections or destruction actions passing validation divided by actions due.

Publish raw counts with percentages and report how long every open item has remained unresolved. Keep request receipt, search, production, access, explanation, copy, amendment, hearing, statement, disclosure, directory choice, retention, destruction, and validation as distinct measures.

Apply the federal record-rights boundaries for Priya

For Priya, current 34 CFR Part 99 defines FERPA education records and covers access, amendment, consent and exceptions, disclosure records, directory information, and complaints. The Education Department's FERPA hub supplies current public guidance. IDEA Part B separately addresses access, records of access, fees, amendment, hearing opportunity, hearing results, and destruction within their stated scope.

These federal rules do not create one file architecture, one state retention schedule, or one universal response for every record dispute. Verify current state, district, court, complaint, safety, cybersecurity, records, and student-specific requirements.

Apply health, communication, and professional boundaries for Priya

Federal school health-record guidance and joint FERPA-HIPAA guidance explain why holder and entity status matter for Priya. ASHA addresses AAC access. The BACB Ethics Code applies to covered people, and the CASP overview gives broad organizational context only.

These sources do not assign school-record, medical, clinical, privacy, cybersecurity, hearing, complaint, or legal authority to a private ABA provider or software platform.

Close Priya's loop with a record test

Ask Priya and the relevant family participant to review the outcome through their usual language and communication methods. Test the repaired file, portal export, explanation, copy, accessible format, corrected field, attached statement, disclosure entry, directory choice, health-record route, retention action, or destruction evidence suited to the issue. Log every mismatch, immediate safeguard, owner, due date, affected record or decision, and later verification. For Priya, review who accessed or received student records by comparing the final response with the governing source, affected records, student access, and acceptance condition. Preserve unresolved differences with an owner and next step.