FERPA states that an institution's records must:
. reflect each request for access to, and each disclosure from, an education record.
. be maintained as long as the student record is active.
. include the parties who have requested or received information from a student's records.
. include the legitimate interest parties had in receiving information.
The record keeping requirement does not apply when the request is from, or the disclosure is made to:
. the student.
. a properly designated school official .
. a party with written consent from the student.
. a party seeking directory information .
. a party with a law enforcement subpoena or court order which specifies that the existence or contents of the subpoena or court order not be disclosed.
. a school attorney who is designated as a school official.