Which FERPA practice supports secure handling of student assessment data?

• A. Share data with all staff to promote transparency.
• B. Access should be on a need-to-know basis; use secure systems; obtain consent when required.
• C. Store data in public cloud without encryption.
• D. Disclose data to external partners without consent.

Answer: (B)

Protecting student privacy under FERPA means limiting access to assessment data to those with a legitimate educational interest and ensuring the data are securely stored and transmitted. The best practice is to grant access on a need-to-know basis, use secure systems (strong authentication, encryption, and proper access controls), and obtain consent when required for disclosures beyond what FERPA permits. This approach minimizes the risk of unauthorized access, maintains data integrity, and keeps disclosures within legal and policy guidelines.

Sharing data with all staff undermines privacy and ignores the need-to-know principle. Storing data in a public cloud without encryption leaves sensitive information exposed. Disclosing data to external partners without proper consent or FERPA authorization violates student privacy protections.