FERPA vs. Attorney–Client Privilege: What Students Can Access

When students submit FERPA inspection requests to a school, the conversation often turns into a tug-of-war between FERPA access rights and the school’s claim that certain documents are “attorney–client privileged.” Sometimes the school is right. Other times, “privilege” is used too broadly—especially when the document is really an administrative/policy discussion rather than legal advice.

This post breaks down (1) what FERPA does and does not require, (2) what attorney–client privilege actually protects, and (3) how the two can overlap in real disputes.

Important disclaimer: This article is general educational information—not legal advice. Every case turns on its facts, governing law, and the specific document at issue.

FERPA (the Family Educational Rights and Privacy Act) is a federal law tied to federal funding. Among other things, it gives parents (and later “eligible students”) the right to inspect and review the student’s “education records,” and it restricts a school’s disclosure of personally identifiable information from those records without consent unless an exception applies.

FERPA generally requires schools to provide access within a reasonable time, not more than 45 days after receiving the request.

FERPA defines “education records” broadly as records that are:

1. directly related to a student, and
2. maintained by the school or by a party acting for the school.

That sounds sweeping—and it can be. But FERPA also excludes important categories from “education records,” including:

• Sole possession notes (personal memory-aid notes kept in the maker’s sole possession and not shared, except a temporary substitute)
• Law enforcement unit records (created/maintained by the law enforcement unit for law enforcement purposes)
• Certain employment records (when employment is not contingent on being a student) and certain treatment records (in higher ed) (these exclusions are also reflected in the regulatory definition)

The Supreme Court has emphasized that “education records” are generally the kinds of records the institution keeps as institutional records—not every piece of paper that passes through a classroom.

If a record includes information about more than one student, FERPA limits access to only the requesting student’s information (often requiring redaction or segregation).

Attorney–client privilege is not a “privacy label” a school can slap on a document. It’s an evidence doctrine that protects confidential communications between attorney and client for the purpose of seeking or providing legal advice.

Florida’s lawyer–client privilege statute protects the “contents of confidential communications” made in the rendition of legal services, with defined exceptions (e.g., crime–fraud).

With institutions, the “client” is the organization, not each employee individually. Privilege can extend to communications between counsel and employees when they’re made to obtain legal advice for the organization—an idea reflected in the Supreme Court’s reasoning about corporate privilege.

Even when privilege applies, it generally does not protect:

• The underlying facts (only the confidential legal communications)
• Purely business or administrative communications copied or question asked to a lawyer “just because”
• Communications where confidentiality was waived (e.g., broad distribution outside those necessary for legal advice)

Yes—and this is where real disputes happen.

FERPA itself does not expressly list attorney–client privilege as a blanket basis to deny a student access to education records.
However, the U.S. Department of Education has recognized that in certain circumstances, a school may deny inspection/review of education records (or portions) on attorney–client privilege grounds—essentially to preserve the institution’s ability to seek confidential legal advice—even though this is not a named FERPA exception.

In a 2019 findings letter (University of California at Irvine), the Department discussed the concept this way:

• FERPA doesn’t explicitly provide an attorney–client privilege denial basis, but
• the office recognized a school may deny access on privilege grounds where the school meets the elements for attorney–client privilege (and similarly outlined work-product elements for documents prepared in anticipation of litigation).

Takeaway: A school shouldn’t treat “privilege” as a magic word. If it’s truly privileged, it must satisfy the privilege elements. If it’s not, FERPA access rules may require disclosure (with appropriate redactions for other students).

• Emails between administrators and counsel seeking legal advice about a specific student discipline case, threat assessment, accommodation dispute, or litigation strategy—kept confidential and shared only on a need-to-know basis.
• Documents prepared “in anticipation of litigation” that qualify as attorney work product (again, fact-specific).

• Routine policy discussions, handbook interpretations, or “how we normally do this” guidance where counsel is acting more like an administrator than a legal advisor.
• Communications widely forwarded to people who aren’t necessary for legal advice (a common waiver problem).
• “Mixed” emails where a small portion is legal advice but the bulk is non-legal business; the legal portion may be redacted, but the rest may be disclosable depending on the context.

A FERPA access request is not the same as civil discovery. Discovery rules (state or federal) govern what must be produced in litigation and how privilege must be logged and evaluated.

In federal court, when a party withholds responsive information on privilege grounds, Rule 26 generally requires the party to expressly claim the privilege and describe the nature of the withheld materials so the other side can assess the claim (commonly through a privilege log).

Practical point: Even if a school denies FERPA access to a document (or a portion) as privileged, that doesn’t automatically end the analysis if litigation is pending—courts can evaluate privilege claims, order privilege logs, and (in appropriate cases) conduct in camera review.

If you get a response like “withheld as attorney–client privileged” or just redactions without any explanations, consider these practical moves:

1. Ask the school to identify the withheld categories and confirm whether the withheld materials are being treated as “education records” or as excluded/non-responsive materials. (The DOE’s findings letter approach highlights the importance of document categories and criteria.)
2. Request segregable portions: if only part is legal advice, ask for the rest (with redactions for other students where required).
3. Confirm timing compliance: remind the school of the 45-day maximum for access.
4. Escalate through the institution’s process (registrar/privacy officer/general counsel) (be careful of engaging with University Counsel on your own)
5. Consider an SPPO complaint if appropriate and timely: complaints generally must be filed within 180 days of the alleged violation (or when you knew/should have known).

• Schools sometimes overuse “privilege” as a catch-all to avoid disclosure, even when a document is mostly administrative.
• Students sometimes assume FERPA overrides all privileges and requires full production of everything that mentions them.
• The reality is nuanced: FERPA defines what records are covered and what access is required, while privilege doctrines can, in some circumstances, justify withholding certain content—but only when the privilege elements are actually met.

The cleanest way to analyze “FERPA vs. privilege” is to separate the questions:

1. Is it an education record (or excluded)?
2. If it is, does FERPA require access (with redactions/limitations)?
3. If the school claims privilege, does the communication actually meet the privilege elements (and was it kept confidential)?
4. If litigation is involved, are privilege-log and discovery rules being followed?

If you’re dealing with a university records dispute—especially one intertwined with discipline, professionalism, disability accommodations, or discrimination allegations—getting this framework right can change the trajectory of the case.

Attorney advertising. No attorney–client relationship is formed by reading this post.

Related practice areas

• FERPA and education records
• Due process at public institutions
• Appeals and court review

If your matter is at a Florida institution, the school-specific pages are indexed on the Florida schools page.