FERPA-Compliant Software: Questions to Ask a Vendor

If you run a tutoring center, a learning center or a student success office, the software you are about to buy will hold records about named students: who visited, when, for which course and what was discussed. Before it goes live, someone in campus IT, procurement or the registrar’s office will ask whether it is FERPA compliant, and most vendors will say yes.

That answer helps only if you can check what stands behind it. Compliance rests on the agreement you sign and on the system’s settings, so your best step is to ask each vendor the same questions and keep their answers on file.

Key takeaways

• FERPA-compliant software lets your campus stay within FERPA, because the vendor acts as a school official under your control and you limit who sees each record.
• FERPA’s duties fall on your campus, so a vendor’s “FERPA compliant” label is where your questions begin.
• Ask about the agreement before the features, because the agreement is what puts a vendor under your control.
• FERPA itself sets no breach notification requirement, so the notice terms have to come from your contract and your state’s law.

What does FERPA compliance mean for software?

FERPA, the Family Educational Rights and Privacy Act, is the federal law that protects student education records. It gives students the right to see their records, to ask for corrections and to have some say in who else sees them. At a college these rights belong to the student, whatever their age.

FERPA’s duties fall on schools that receive funds from U.S. Department of Education programs, not on software companies, and the Department’s guidance on online educational services says it expects schools to comply. No software is compliant on its own, then. When a vendor calls its product FERPA compliant, the claim to check is that your campus can use it within the law. That holds when the vendor can act as a school official under your control and the system lets you limit who sees each record. The school official part rests on four conditions, set out below, and one of them sits in your own annual notice. If FERPA is part of a wider compliance effort for you, our guide to building a higher education compliance program covers the other areas.

Education records

Under FERPA, education records are records directly related to a student and kept by your campus or by a company or person working for it, in any format. The visit logs, appointments, referrals and session notes your center keeps about named students are usually education records, including when a vendor’s system holds them. One narrow exception covers a note that only its author ever sees, kept as a memory aid. A note saved in a shared system does not qualify, because other people can open it.

The school official exception

As a general rule, your campus needs a student’s written consent before it shares information from their records that identifies them. Software vendors usually receive records under the exception for school officials instead. The Department’s explanation of who counts as a school official sets four conditions for an outside company:

• It performs a service your campus would otherwise use its own staff for.
• It is under your campus’s direct control in how it uses and keeps the records.
• It uses the records only for the purpose they were shared for and does not pass them on.
• It meets the definition of a school official in your annual FERPA notification, the notice of rights your campus publishes each year.

FERPA does not require a written agreement for direct control, but the Department notes that schools usually set it up through a signed contract or through terms of service with the right protections. That is why the contract is the first thing to check.

Directory information, such as name, email address and dates of attendance, is a second route, because a campus can share it after public notice. The Department warns that this route may not work well for vendor accounts, because students who opt out cannot be included.

Contract questions to ask a vendor

Start with the contract, because the school official conditions depend on what it says. Send these questions to each vendor in writing:

• Does the contract or the terms of service make you a school official under our direct control?
• Will you use our students’ data only to provide the service, with no selling and no marketing?
• Which other companies handle our data, and will you tell us before that list changes?
• Can you change the terms without our consent?
• How quickly will you tell us about a breach, and what will you do about it?
• When the contract ends, how do we export our data, and when do you delete it, backups included?

What a good answer looks like

A strong reply names the vendor as a school official and limits its use of student data to running the service. The Department’s model terms of service checklist treats a promise not to market to students as good practice and flags any clause that allows such marketing. The same checklist says a promise to tell you about changes to the terms is good, and a promise not to change them without your consent is better.

The other companies in that list, often called subprocessors, are the hosting, email, text message and AI providers behind the service. You cannot control records that move to a company you have never heard of, so the list and notice of changes belong in the agreement.

Breach notice and the end of the contract

The Department’s data breach response checklist states that FERPA itself contains no specific breach notification requirement, although state laws can still apply. The Department recommends that your agreement describe each side’s duties in a breach, and its model terms ask the provider to share its incident response plan on request. We recommend a set number of days for notice, because “promptly” can mean a day to one vendor and a month to another.

The Department’s guidance on online services also recommends that the agreement say what happens to student records when the contract ends, so that nothing stays on the vendor’s systems. That comes down to three answers: how you export everything, how long you have after the subscription ends, and when the vendor deletes your data and backups.

System questions to ask a vendor

FERPA’s regulations expect your campus to use reasonable methods so that staff can open only the records they have a legitimate educational interest in, which means a reason connected to their work. The system questions test whether you can do that in practice, and it helps to see each answer in the product itself rather than in a sales presentation:

• Can we build roles that give each staff member only the records and reports their job needs?
• Does it support single sign-on with our campus login system?
• Does it keep an audit trail of who viewed or changed a record, and for how long?
• Where is our data hosted, and is it encrypted in transit and at rest?
• Which student data does it require, and what can we leave out?
• Does any feature send student data to an AI provider, and can we switch it off?

Your IT office may also send a security questionnaire, such as the Higher Education Community Vendor Assessment Toolkit (HECVAT) that EDUCAUSE publishes for college purchasing.

Roles that match each job

Least privilege means each person sees only what their job needs. A tutor needs the day’s appointments and a coordinator needs the reports for one center, while very few people need every student at every center. Reports deserve extra care, because one report can list every student who visited. It is worth checking how report access is controlled and how much a new staff account can see.

Single sign-on and audit trails

Single sign-on lets staff and students sign in with their campus accounts instead of a separate password. That means a person who leaves loses access to student records as soon as IT closes their campus account, provided nobody keeps a separate password in the system. Ask whether the vendor supports SAML, a common standard for campus sign-on, and whether every edition includes it.

An audit trail is a log of who viewed or changed a record and when. You will need it if a student asks who changed their records, so how long the vendor keeps it and whether you can export it matter as much as what it records.

Hosting, encryption and the data you share

Campus IT will want the hosting country and provider, and whether data is encrypted while it travels and while it is stored. The fields a system requires also matter, because each field you leave out is one less to protect. AI features belong on the list as well, because a writing or dictation assistant may send the text you enter to an outside company.

Privacy is only part of the purchase. Our guide to choosing higher education software covers the rest, from buying versus building to the budget request.

How Accudemia answers these questions

Accudemia, the academic center management software we make, comes in three editions: the full Accudemia License, Accudemia Light and Essentials, which covers appointment scheduling only. Light and Essentials leave out some features of the full License, so check which of the settings below come with the edition you are pricing.

Status as a school official and data use

Accudemia treats the information it stores as education records protected under FERPA. It acts as a school official with a legitimate educational interest, solely to provide the service, and processes your records only as your campus instructs. Your campus owns the records, and requests to see or correct one go to you. Data in Accudemia is never sold or used for third-party advertising or marketing, as the Accudemia privacy policy sets out.

Roles, reports and sign-on

The top administrator builds roles from 51 permissions and limits each role to the whole college, a group of locations, one center or one classroom. Eight ready-made templates cover common jobs, from a Viewer who can only view and run reports to a Referral Issuer who can only raise and update referrals. Cleveland Community College, for example, gave its athletic coaches their own access to check athletes’ study hall progress during the week. No administrator can give an account more permissions than they hold.

Report access is granted by type of report, so a center administrator can get attendance and appointment reports without student lists or survey results. You can also hide the student ID on session logs, center screens and some exports. Accudemia supports SAML 2.0 single sign-on through your own portal and sign-on through Canvas, and the mobile app uses the same campus sign-on. The College of San Mateo, for one, connected Accudemia to its campus single sign-on.

Audit trails, hosting and AI features

Audit trails record who changed an appointment, a session log or a setting and what the change was, and three permission reports show who holds which permissions. Accudemia keeps your data and backups in the United States on Amazon Web Services, and every edition encrypts data traveling between your browser and its servers with SSL. A user import needs only a first name, last name and user ID, and you can export ten types of data as CSV files, from users and enrollment to session logs and appointments.

Accudemia’s AI features are the AI Assistant, which drafts text, and Wiggins, which answers questions and books appointments. They do not send student names, ID numbers or email addresses to AI providers, and staff are asked to keep education records out of the text they enter. You can switch the AI Assistant off for your whole account, and booking through Wiggins has its own switch.

AccuClass for class attendance

If class attendance is what you are buying, AccuClass, our class attendance software, includes hosting on the Amazon cloud with backups and SSL in its license, and it supports SAML single sign-on with Microsoft Entra.

Limits to know before a demo

A new staff account can see the whole college until you narrow it to a center or location, so set that limit when you create it. Audit trail records are kept for 90 days. Single sign-on is included in the Accudemia License, costs a one-time setup fee on Light and is not part of Essentials.

For anything this page does not cover, such as our contract terms, breach notice commitments or a completed security questionnaire for your IT office, contact us and your account representative will answer directly.

If your review is waiting on these answers, request an Accudemia demo and bring your IT and privacy staff to see the role, sign-on and audit settings on screen.

Before you sign

You are ready to sign when every question above has a written answer you can file with the contract and your own campus has finished its share of the checks. These steps take you there:

1. Check that your annual FERPA notification defines school officials broadly enough to include contractors.
2. Send the contract questions to each vendor before the demo, along with your IT office’s security questionnaire.
3. In the demo, look at the role settings, the sign-on setup and the audit trail on screen.
4. Decide each staff member’s role, and make sure everyone who will have access has had FERPA training.
5. Have campus IT and your privacy office or counsel review the answers and the terms.
6. Confirm that the person accepting the terms may sign for your campus, since the Department notes that clicking “accept” can bind you much like a signed contract.
7. Before you start using the system, write down who would export your data and when the vendor would delete it if you ever leave.