FERPA-Aware Practices

What Is FERPA?

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student educational records. It applies to schools receiving funding from the U.S. Department of Education and gives parents - and students who have reached age 18 - rights over their educational information, including the right to inspect records, request corrections, and control disclosures.

For special education teams, FERPA governs the handling of IEPs, evaluation records, service logs, meeting notes, and other documents that contain personally identifiable student information. Compliance with FERPA is a baseline legal obligation, not an optional practice.

How SpEd Coach Supports FERPA-Aligned Handling

Role-Based Access Controls

Access within SpEd Coach is governed by role-based permissions. Each user is assigned a role that determines exactly what they can see and do.

• Staff members see only the students and cases they are assigned to.
• Evaluators see only the students and reports in their active caseload.
• Family Portal users see only their own child's information.
• Organization administrators have full organizational access.

No user can access student records outside their assigned scope.

Data Minimization

SpEd Coach collects and stores only the information necessary to deliver the service. Features are designed to limit exposure of sensitive data. AI processing is structured to work with the minimum required content, with PII scanning and redaction applied before content reaches external model providers.

PII Protection and AI Safeguards

Before any educational record content is processed by AI features, SpEd Coach applies a privacy-aware processing pipeline:

• PII Detection - Automatically identifies names, dates of birth, Social Security numbers, student IDs, and other sensitive identifiers.
• Automated Redaction / Masking - Detected identifiers are removed, masked, or replaced before AI processing.
• Tokenization - Sensitive identifiers may be replaced with structured tokens that preserve workflow context without exposing identifying data.

Audit Logging

SpEd Coach maintains audit logs that record who accessed what data and when, including document uploads and downloads, AI processing events, changes to access permissions, and administrator actions. These logs support your organization's compliance documentation needs and can be referenced during internal reviews or external audits.

Tenant Separation

Each organization's data is isolated at the database layer using row-level security policies. No user of one organization can access the data of another. This separation is enforced at the infrastructure level, not only in the application interface.

Retention Controls

Organizations can configure data retention aligned with their applicable state and federal requirements. Soft-deleted records are purged on a defined schedule. Bulk deletion and export requests can be coordinated through support@spedcoach.com.

Shared Responsibility

SpEd Coach is responsible for:

• Providing a FERPA-aware platform architecture with tenant isolation, role-based access, audit logging, and AI governance controls
• Processing educational data only as directed by the organization and for the purpose of providing the service
• Maintaining appropriate technical and organizational security measures

Your organization is responsible for:

• Ensuring lawful use and handling of educational records under FERPA, IDEA, state law, and local policy
• Managing staff access, permissions, and offboarding within your workspace
• Reviewing AI-assisted outputs before sharing or relying on them
• Your organization's own FERPA compliance obligations, including required parental notices and consent
• Determining appropriate retention periods for your student records

SpEd Coach does not provide legal advice and does not certify FERPA compliance on behalf of any organization. Always consult qualified legal counsel for specific compliance questions.

Frequently Asked Questions