FERPA for Athletic Departments

FERPA — the Family Educational Rights and Privacy Act — is the federal law that controls who can see student educational records and under what circumstances. Coaches and athletic directors are bound by it whenever they handle anything that counts as a "student record."

What counts as a student record

FERPA defines an "educational record" broadly: anything maintained by the school that identifies a student. For athletic departments, this includes:

• Eligibility status
• Grades / GPA
• Disciplinary records
• Medical clearances and injury records
• Athletic stats stored in the school\'s system
• Recruiting correspondence with college coaches

Who can see what without consent

• The student\'s parents (until the student turns 18 or enrolls in college, whichever comes first).
• The student themselves (after 18 or college enrollment).
• School officials with "legitimate educational interest" — coaches, AD, trainers, school nurses. The "legitimate interest" test is whether the person needs the information to do their job.

Who CANNOT see records without written parent consent

• College recruiters and coaches
• Outside scout services
• Booster clubs (despite the gray area many of these operate in)
• Other students\' parents
• Media

Practical scenarios

"Can I email a college coach my athlete\'s grades?" Not without written parent consent. You can confirm "she\'s on the eligibility roster" — but you can\'t share the actual transcript.

"Can a college coach access our roster page that shows GPAs?" Not without consent for each athlete listed. Internal rosters that include grades are FERPA-protected and shouldn\'t be publicly visible.

"Can a parent see another student\'s records?" No. Including for legitimate-seeming reasons like booster club fundraising or carpool coordination.

"What if the student is 18 and still in high school?" The 18-year-old controls the records, not the parent. Get the student\'s consent.

How Lightning handles FERPA

Lightning for Schools implements FERPA-aligned access controls. Coaches can only see athletes assigned to their teams. Recruiting contact requests trigger a documented parent consent workflow, and a student record can't be imported until the parent or athlete consents. Document access (uploads and downloads) is logged, and changes to records are audit-tracked.