Is it OK to share a student’s financial aid information within your institution, with government agencies, or with scholarship providers? In January 2017, the Privacy Technical Assistance Center (PTAC), which is sponsored by the U.S. Department of Education, issued guidance addressing the use student financial aid information. This guidance focuses on the limited ways educational institutions can permissibly use student financial aid information and includes more than two pages of “frequently asked questions” for colleges and universities.

While the guidance covers a wide variety financial aid data, the PTAC notes that Free Application for Federal Student Aid (FAFSA) information, in particular, is subject to Federal Educational Rights and Privacy Act (FERPA) requirements and to provisions of the Higher Education Act (HEA).

While FAFSA information is considered part of a student’s education record and is protected by FERPA requirements, it is also subject to more stringent requirements under the HEA. Notably, the PTAC guidance indicates that the HEA prohibits the release of FAFSA information:

  • To entities not affiliated with federal or state aid programs (e.g., third-party private scholarship funds or state agencies not administering aid);
  • To ineligible institutions; and
  • For reasons other than those directly related to the awarding of financial aid (absent a particular exception).

This prohibition applies even if a student FERPA waiver permits disclosure of other personally identifiable information. More specifically, FAFSA and other Federal Student Aid student information records may only be used for “the application, award, and administration of aid awarded under federal student aid programs, state aid, or aid awarded by eligible institutions.”

In short, an institution may not release students’ FAFSA information in the instances listed above—even with a student’s written authorization. Rather, institutions should release FAFSA information directly to the student and then, at the student’s discretion, he or she may provide that information to requesting parties.

Recent developments

In June, the National Association of Student Financial Aid Administrators (NAFSAA) released a white paper on this topic. And, as recently last week, the PTAC reemphasized its commitment to the FAFSA guidance issued in January 2017.

For more information, tune in next week

On September 27, the Department of Education will host a “virtual meeting” regarding data security and breach requirements featuring the PTAC and Federal Student Aid’s Senior Advisor of Cybersecurity. With the recent swell of discussion on the topic, we expect FAFSA information sharing to be on the agenda.

What this means to you

In order to comply with the recent PTAC guidance, colleges and universities should halt practices releasing FAFSA and other protected student aid information to third-party entities or for purposes outside those specifically provided for by law—regardless of whether students provide FERPA waivers. Institutions are advised to review which third-party entities, government agencies, and even internal offices may be restricted from receiving information under the HEA in order to avoid inadvertent disclosure of private student financial aid information.

Institutions should consider implementing a practice of notice and explanation to students and third-parties who request that FAFSA information be provided for purposes other than administering student aid. This notice and explanation would outline the applicable laws prohibiting FAFSA information disclosure and provide a procedure for the appropriate release of the desired information.

As always, institutions should continue to protect all student information with an eye towards compliance and student service.