Expanding Discipline Disclosures in K-12
August 2025
Jessica Arciniega, Katherine Kalpos, Morgan Sexton, and Amelia Vance
CC BY-NC 4.0
Imagine your child is harmed by another student at school. You're assured the situation is being handled, but when you ask for specific details—What actions did you take to protect my child? Was the other student suspended?—you get no answers.
If your child is enrolled in K-12, the school’s silence is often mandated under federal student privacy law.
For K-12 schools, the Family Educational Rights and Privacy Act (FERPA) is a wall that prohibits them from sharing disciplinary results from serious offences like sexual assault and violence. For higher education, however, Congress installed two windows permitting certain disclosures to victims and the community. This legal double standard leaves younger victims with fewer rights, erodes community trust in public education, and forces K-12 schools to be less transparent than colleges about school safety incidents in order to comply with the law.
Unlike K-12 schools, FERPA allows colleges and universities to share certain information about school disciplinary proceedings without first obtaining consent from the disciplined student. Specifically, the college may (1) inform victims of a crime of violence or a non-forcible sex offense of the outcome of their attacker’s disciplinary proceeding, regardless of the outcome; and (2) release the attacker’s name, violation committed, and resulting punishment if the college finds that they violated the school’s rules or policies when committing the violent crime. These exceptions enable colleges and universities to be more transparent about campus safety and student discipline.
Younger students have less autonomy to remove themselves from unsafe situations and parents bear greater responsibility for their children's safety and educational decisions. Therefore, it is critical to allow K-12 schools to inform victims and their parents of disciplinary outcomes. However, careful consideration is needed before extending notification to the broader K-12 community due to the unique characteristics of juvenile offenders and the potential long-term impacts of public disclosure.
To protect students and rebuild trust in school safety, Congress should amend FERPA to extend existing exceptions that permit higher education institutions to make additional disciplinary disclosures to the K-12 context. In this resource we will dive into these issues, exploring FERPA’s current framework for disciplinary disclosures and recommending a solution that addresses the most pressing problems in the current system while maintaining appropriate privacy protections.
The Status Quo: A Wall of Silence
Protecting student privacy is a cornerstone of our education system, and for good reason. Disciplinary actions, while necessary, can create a stigma that may follow a young person for life. We believe the goal of school discipline should be rehabilitative, giving students who make mistakes the space to learn and grow without being permanently defined by their worst moments.
However, this crucial need for privacy must be weighed against another fundamental reality: students are legally required to be in school. Unlike adults who can often change jobs or move, children have little control over their environment or who they must be around during the school day. Parents and the broader community also have legitimate interests in knowing how schools respond to serious safety threats.This creates a unique, difficult tension when one student harms another.
This information gap isn’t just a bureaucratic problem—it can have devastating real-world consequences at a massive scale. Data shows that violence in K-12 schools is far from rare:
- In one five-year period, Virginia alone reported over 12,175 incidents of sexual assault and harassment in K-12 schools. (Investigative Reporting Workshop)
- “About 857,500 violent incidents…were recorded by public schools in 2021-22,” with 67% of public schools reporting “at least one violent incident.” (National Center for Education Statistics)
When schools are legally silenced by FERPA, they cannot reassure parents about how they're addressing serious safety concerns. Community members may–understandably–question whether appropriate action is being taken at all. This fuels distrust in public education and leaves families wondering if school safety is truly a priority.
Several K-12 administrators have told us that following disciplinary incidents, they want to share more information but feel their hands are tied by federal law. The current system essentially forces K-12 schools avoid transparency to comply with federal privacy law, even when disclosure may serve legitimate safety and accountability purposes.
How Does FERPA Handle this Delicate Balance?
Student disciplinary records are protected by FERPA because they include “personally identifiable information” (PII) in education records. When a school investigates misconduct and imposes discipline, the resulting records contain information directly linked to specific students and the educational institution maintains those records for official purposes.
Like other education records, FERPA generally prevents schools from sharing disciplinary information with third parties without consent. If a parent of a K-12 student wants to know how a school disciplined the student who harmed their child, FERPA typically prohibits such disclosures unless the school first obtains consent from the disciplined student (if they are over 18) or that student’s parents. The same holds true when community members seek information about how schools are addressing serious incidents on campus.
This Fixing FERPA publication is focused exclusively on what disciplinary information schools may share with impacted students, parents, and the community after an incident has occurred. Disclosures under FERPA’s Health and Safety exception, Judicial Subpoena exception, and Law Enforcement Unit Records exemption are out of scope for this resource. Additionally, FERPA’s exemption permitting disclosure of information obtained through personal knowledge or observation does not apply in this context because knowledge of disciplinary information comes from an individual’s official role in making a determination maintained in the student’s education records.
Higher Education Gets Critical Exceptions
Recognizing that sharing student disciplinary information can serve legitimate safety and transparency purposes, Congress created two important exceptions to FERPA for when a college takes disciplinary action against a student who allegedly committed a crime of violence or non-forcible sex offense. Congress created the victim notification exception to FERPA through the Crime Awareness and Campus Security Act of 1990, which USED then added to FERPA regulations in 1993 (1993 Federal Register, p. 3188). Congress then created the community notification exception to FERPA through the Higher Education Amendments of 1998, which USED then added to FERPA regulations in 2000 (2000 Federal Register).
1) Victim Notification Exception
FERPA has an exception allowing postsecondary institutions to disclose the “final results” of internal disciplinary proceedings related to violent crimes or non-forcible sex offenses to victims, regardless of whether the institution finds the alleged perpetrator “guilty” or not. The “final results” schools may disclose include a student’s name, the violation committed, and any sanction imposed by the institution against the student. No additional information can be disclosed under this exception. (34 CFR 99.31(a)(13) and 34 CFR 99.39)
Imagine that a student, Tim, was attacked while walking across campus to his dorm room. Tim didn’t see who attacked him, so he asks the school for help identifying his attacker. The school pulls surveillance video showing the fight, but Tim does not recognize his attacker. School administrators determine that the attacker was another student at the university, Riley. FERPA’s victim notification exception allows the university to tell Tim:
- That their attacker was Riley;
- Whether Riley is found “guilty” of a violation of school policy; and
- If/how the university is punishing Riley.
This information empowers Tim to take proactive steps to protect his safety moving forward. Without FERPA’s victim notification exception, Tim would likely be left in the dark–he would know his attacker’s face from viewing the video footage, but may not ever learn their name. Even if Tim checked every RSVP list and roster for anything he attends throughout the rest of college, he’d still be fearful that he will encounter his attacker again since he doesn’t know what name to watch out for.
2) Community Notification Exception
FERPA also has an exception allowing postsecondary institutions to disclose the “final results” of internal disciplinary proceedings related to violent crimes or non-forcible sex offenses to the broader education community, but only if the institution finds that the alleged perpetrator violated school rules or policies. This includes the same categories of information the school may disclose under the victim notification exception: a student’s name, the violation committed, and any sanction imposed by the institution against the student. No additional information can be disclosed under this exception. (34 CFR 99.31(a)(14), 34 CFR 99.39, and Appendix A to Part 99, Title 34)
Building on our last example: If the school’s internal disciplinary proceeding determines that Riley violated the university’s student conduct code by attacking Tim, the school can inform the school community that “Riley was found responsible for assault and has been suspended for two years.” The school cannot, however, disclose Tim’s name. This approach promotes accountability and greater transparency into school safety while still protecting the privacy of student victims.
Why Two Separate Exceptions?
Separating out the victim and community notification exceptions finds a crucial balance between protecting student privacy and the victim and community’s right to know.
The victim notification exception enables schools to share the final results of disciplinary proceedings with victims regardless of the outcome. This means that schools are always permitted to update victims on the status of disciplinary proceedings for the students who have harmed them. FERPA’s community notification applies in fewer situations. Schools can only disclose information under the community notification if the school finds a student “guilty” of violating school rules. This protects the privacy of students who may be wrongly accused or are not found to have violated school rules, while still allowing schools to share limited information with the community when the school determines that a violation has occurred.
Additionally, note that both of these disclosures are permissive, not mandatory. This allows colleges to evaluate the context and use their own judgment about when disclosures under either or both exceptions would serve legitimate transparency interests. For example, while a university may want to share information with the victim of a violent crime, the school may determine that public disclosure is not necessary if a perpetrator is no longer a threat to the campus community (such as if they were expelled or otherwise removed from the school). On the other hand, the school may believe that announcing the incident and outcome may help protect other students and build trust with the community. FERPA gives colleges the ability to share disciplinary information how they deem appropriate on a case by case basis, so long as they do so in accordance with the victim and community notification exceptions.
Current K-12 Disclosure Options Are Extremely Limited
K-12 schools have far fewer opportunities for sharing student disciplinary information without consent–even in the most serious cases. This is not inherently wrong: students enrolled in K-12 schools are primarily minors, and as such they are more vulnerable and may need additional safeguards to protect them from privacy harms. But at the same time, FERPA’s current framework significantly denies valuable transparency to victims and communities.
Outcomes “Directly Affecting” Multiple Students
K-12 schools are allowed to disclose disciplinary measures that "directly affect" multiple students. As the U.S. Department of Education (USED) explained in March 2025 guidance:
“Certain measures a school might impose to protect student safety that directly affect both students may be disclosed to the parents of both students; for example, an order that specifies that Student A must stay 500 feet away from Student B, is a record that relates to both students.” (PDF Page 4)
Building on the scenario from USED, imagine that a bully (Sam) is ordered to stay away from a student they assaulted (Hope). Because Sam’s punishment is directly related to Hope, the school can tell Hope and her parents that Sam has been ordered to stay away from her.
However, this changes if Sam is disciplined in a way that isn’t directly related to Hope (such as if Sam was suspended for their actions). In that case, the school can’t tell Hope if the school took disciplinary action against Sam at all. This is unlikely to satisfy Hope’s parents who want to know specific details* about steps the school is taking to address the threat and how Sam will be held accountable for harming their child. Hope and her parents have to trust that the school handled the situation appropriately–they have no way to hold the school accountable and evaluate the sufficiency of the school’s response. This goes against the spirit of FERPA by contributing to a one-sided system where schools hold all the information while victims and their families are left in the dark.
This changes again if Sam and Hope are in college. In this scenario, FERPA’s victim notification exception would allow the school to tell Hope the outcome of a disciplinary action against Sam related to the assault (a crime of violence). This approach restores the balance between schools and victims, providing key transparency that can empower victims to make informed decisions about their safety.
Records “Directly Related” to Multiple Students
In some circumstances, the underlying incident leading to disciplinary action may be captured in an education record of multiple students. The Privacy Technical Assistance Center (PTAC) at USED provides the following example:
“a surveillance video that shows two students fighting on a school bus that the school uses and maintains to discipline the two students, would be ‘directly related to’ and, therefore, the education record of both students.”
The same logic would apply if the video also shows a third student, a victim, in said fight. If the school uses and maintains the video to discipline the two fighting students, that video is also an education record of the victimized student. FERPA grants all three students (the two who were fighting and the victim) and their parents the right to inspect and review the video of said fight upon request.**
However, FERPA does not give any student–not even the victim–a right to learn additional information about the other students in the video. Unlike the higher education example before where the university was able to help Tim determine the identity of his attacker, K-12 schools cannot share this information with victims. If the victim and their parents are not able to identify who the two other students in the fight were by reviewing the video, they have reached a dead end–the school is not allowed to tell them the names of those other students without consent or another FERPA exception (such as a court-issued subpoena). Similarly, the school cannot share how they are (or are not) responding as it relates to the other students for their involvement in the fight.
Limitations on Sharing Redacted Disciplinary Records
But what about informing the community of serious incidents and how they have been addressed? FERPA also limits when K-12 schools can share information like this.
FERPA presents significant challenges for journalists seeking to uncover facts about newsworthy incidents that happen in schools to inform the public. Consider the following example from USED:
“a person running for local office is known to have graduated from a particular university in 1978. Rumors circulate that the candidate plagiarized other students' work while in school. A local reporter asks the university for redacted disciplinary records for all students who graduated in 1978 who were disciplined for plagiarism. The university may not release the records in redacted form because the circumstances indicate that the requester has made a targeted request, i.e. has direct, personal knowledge of the subject of the case.” (2008 Proposed Rule)
In this scenario, the public has a legitimate interest in obtaining facts relevant to evaluating the credibility of a candidate they may elect to public office. But the information the reporter is seeking is PII that is protected under FERPA (even if the records are redacted!), so the school cannot reveal the disciplinary records without first obtaining consent from the political candidate–which will be virtually impossible to get.
So What Can K-12 Schools do to Maintain their Community's Trust?
As with other PII, FERPA enables schools to share student disciplinary information with third parties when parents or eligible students provide written consent. However, this approach has limited practical value because consent is rarely granted in serious cases. Additionally, the process of obtaining consent can be time-consuming, delaying responses about how schools are responding to critical incidents when families most need them.
Why Would a Parent Consent to Sharing Disciplinary Info?
It's a fair question. While consent is rarely given in cases of actual misconduct, it can be a powerful tool for a different reason: to clear a student’s name.
Federal privacy law can create a frustrating catch-22 when false rumors fly. Consider this scenario: A rumor spreads that a student, Elijah, attacked another student, Henry. This never happened, but concerned parents ask the school if Elijah will be suspended.
Under FERPA, the school is legally silenced—the school cannot even respond to say the rumor is false. In this situation, obtaining written consent from Elijah's parents (or from Elijah, if he is an eligible student) is the only way the school can legally set the record straight and protect his reputation.
Suggested Solution: Congress Should Extend Higher Education Disclosure Exceptions to K-12
Congress should amend FERPA to allow K-12 institutions to tell victims the final results of disciplinary proceedings related to crimes of violence or non-forcible sex offenses in the same way that postsecondary institutions can. Extending this exception to K-12 would create a targeted, common-sense exception allowing K-12 schools to share limited information with victims of serious safety incidents while maintaining privacy protections. Not only would this increase transparency into school safety responses, it would also provide critical information to victims and their families evaluating how to protect themselves going forward.
We do not have a recommendation on extending the second exception–the community notification exception–to K-12 since students enrolled in K-12 schools are largely minors, and society historically treats the records of juveniles differently than adults. With that being said, there are also compelling arguments for disclosing information about how particularly serious crimes have been dealt with. We urge Congress to work with education stakeholders to carefully consider the appropriate balance that permits schools to retain community trust while protecting the privacy of juveniles.
Extend the Victim Notification Exception to K-12
Both college and K-12 student victims of violence have equally legitimate needs for information about the disciplinary outcomes for the perpetrator. Giving K-12 schools the ability to notify victims without first having to obtain consent from the perpetrator would provide immediate relief for the most pressing problems created by the current system.
Expanding schools’ ability to inform victims and their parents of disciplinary outcomes is especially critical in K-12, since younger students tend to have less autonomy to remove themselves from unsafe situations and parents bear greater responsibility for their children's safety and educational decisions. A college student can take a variety of different actions to escape potentially dangerous situations at school, such as choosing to change dorms, drop classes, or even transfer to another university. These options may not be available to a middle school student seeking to avoid a classmate who has harmed them. Informing parents of disciplinary outcomes in K-12 would better enable victims and their families to make informed decisions about their own safety and educational choices.
Carefully Consider Whether to Extend the Community Notification to K-12
Extending notification rights beyond victims and parents to the broader K-12 community requires careful consideration due to the unique characteristics of juvenile offenders and the long-term consequences of public disclosure.
Unlike college students, K-12 students are often minors. Criminal justice systems often seal juvenile records and provide mechanisms for expungement that acknowledge young people's capacity for rehabilitation and change. This is a safeguard against the risk that a child’s youthful mistakes captured in a permanent record may later be used to discriminate against them or deny them access to future opportunities. Public disclosure of K-12 disciplinary outcomes may create a similar, permanent reputational burden for students who have genuine potential for rehabilitation–even in situations where the legal system has completely erased records about the same underlying actions.
At the same time, communities also have legitimate interests in knowing how schools respond to serious safety threats. Parents making decisions about their children's education deserve transparency about how institutions handle violence and sexual misconduct.
Congress should carefully weigh these competing concerns, perhaps allowing individual states to make this determination based on their own juvenile justice philosophies and existing legal frameworks.
End Notes:
*USED’s March 2025 guidance also references more generalized information schools may share when disciplinary measures may not "directly affect" another student, including:
“While the disciplinary sanction imposed on Student A may not be shared with the parents of Student B, unless the sanction directly relates to both students, FERPA does not preclude school officials from communicating to Student B’s parents, for example, that responsive action is being taken with respect to a threat assessment or potential disciplinary action. Nor does FERPA prevent a school from taking actions designed to protect Student B, such as a classroom reassignment to avoid interaction with Student A.” (PDF Page 4)
**PTAC provides the following guidance to schools regarding parents’ and eligible students’ rights to access their own education records when such records are also directly related to other students:
“In providing access to the video, the educational agency or institution must provide the parent of the student (or the student if the student is an eligible student) with the opportunity to inspect and review the video. If the educational agency or institution can reasonably redact or segregate out the portions of the video directly related to other students, without destroying the meaning of the record, then the educational agency or institution would be required to do so prior to providing the parent or eligible student with access. On the other hand, if redaction or segregation of the video cannot reasonably be accomplished, or if doing so would destroy the meaning of the record, then the parents of each student to whom the video directly relates (or the students themselves if they are eligible students) would have a right under FERPA to access the entire record even though it also directly relates to other students.” (emphasis added)
