FERPA Audits During Accreditation: What US Colleges Must Disclose

The Collision Between Regional Accreditation Standards and Federal Privacy Law

When regional accreditors such as the Higher Learning Commission (HLC), the Middle States Commission on Higher Education (MSCHE), the Southern Association of Colleges and Schools Commission on Colleges (SACSCOC), and the Northwest Commission on Colleges and Universities (NWCCU) conduct their periodic reviews, they demand comprehensive access to institutional data. This often includes deep dives into student records to verify learning outcomes, retention rates, and academic integrity. However, this institutional need for transparency frequently collides with the strict privacy mandates of the Family Educational Rights and Privacy Act (FERPA), codified in 34 CFR Part 99.

Under 34 CFR Part 99, institutions must protect personally identifiable information (PII) in student education records. While FERPA includes a specific exemption allowing the disclosure of records to accrediting agencies to carry out their accreditation functions (34 CFR 99.31(a)(6)), the scope of this disclosure is tightly bounded. Accreditors may review records necessary for accreditation, but institutions must ensure they are not over-disclosing, and accreditors must maintain the confidentiality of the records they review. This delicate balance becomes a legal minefield when audit teams request broad datasets without proper data minimization protocols.

The U.S. Department of Education’s Student Privacy Policy Office (SPPO) has actively enforced these boundaries. In 2023 and 2024, the SPPO resolved several compliance cases involving Title IV-participating institutions that improperly disclosed student records during accreditation audits. For example, a prominent university in the Midwest faced a formal investigation and a mandated corrective action plan after providing an HLC review team with unredacted, system-wide

Seven Data Categories That Require Careful Redaction Before Sharing

Accreditation site visits often feel like a full-body scan for your institution, but handing over raw student files without a redaction strategy is a direct violation of FERPA. Accreditors need evidence of process integrity, not the intimate details of a specific student’s life. Understanding exactly which document categories trigger the highest risk—and applying a consistent decision tree—separates a smooth review from a federal compliance finding.

The Seven High-Risk Categories

• Student Conduct Incident Reports: These narratives often name victims, witnesses, and respondents. Redact all personally identifiable information (PII) for third-party students. Retain only the finding, sanction, and procedural timeline to demonstrate due process.
• Title IX Investigation Files: These are among the most sensitive records on campus. Beyond standard PII, redact the narrative details of allegations, medical forensic summaries, and advisor communications. Share only the procedural checklist, timeline compliance metrics, and final outcome letters (with names redacted) to prove Title IX regulatory adherence.
• Disability Accommodation Records (Section 504/ADA): Accommodation letters, medical documentation supporting the disability, and interactive process notes contain protected health information. Redact diagnoses, specific medication lists, and provider notes. Disclose only the approved accommodation list and implementation dates to verify ADA compliance.
• Immunization and Health Records: While often maintained by student health centers, these are FERPA records if the center runs on institutional funds. Redact specific vaccine lot numbers, treatment notes, and insurance IDs. Provide aggregate compliance rates for measles, meningitis, and COVID-19 mandates instead.
• Mental Health Counseling Notes: Treatment records created by a licensed professional and used only for treatment are technically excluded from FERPA (falling under HIPAA or state privilege), but “counseling center administrative records” (attendance, billing, intake forms) are FERPA-covered. Err on the side of total redaction; provide only de-identified utilization statistics.
• Parental Financial Affidavits (FAFSA Verification): Tax transcripts, W-2s, and verification worksheets submitted for federal aid contain the financial DNA of the family. Redact Social Security Numbers, adjusted gross income figures, and asset values. Accreditors verifying FAFSA compliance need only see the verification tracking flag (V1–V5) and the resolution code.
• Immigration Documentation (DACA/Undocumented Students): Employment Authorization Documents (EAD), I-20s, or state affidavits for in-state tuition are high-stakes records. Redact Alien Registration Numbers (A-Numbers), USCIS receipt numbers, and current addresses. Share only the eligibility determination logic used for tuition classification.

The Redaction Decision Tree: School Official Exception vs. Written Consent

Before handing a file to a site visitor, run every document through this three-step logic gate. If you cannot answer “Yes” to Step 1, you must proceed to Step 2 or 3.

• Step 1: Does the “School Official” Exception (§99.31(a)(1)) Apply? The visitor must be under the direct control of the institution regarding the use/maintenance of records (typically via a written agreement/MOU with the accreditor) AND have a legitimate educational interest defined in your annual notification. Action: If the accreditor’s contract explicitly defines the scope of review and data destruction timelines, you may disclose redacted records without student consent.
• Step 2: Is the Record “Directory Information” or De-Identified? Have you removed all direct identifiers (name, ID, DOB) AND indirect identifiers (specific major + graduation year + unique incident details) such that a reasonable person could not identify the student? Action: If yes, disclose freely. If no, proceed to Step 3.
• Step 3: Is Written Consent (§99.30) Mandatory? If the record contains non-directory PII, the visitor lacks a valid FERPA exception (e.g., a consultant not covered by the MOU), or the request exceeds the “legitimate educational interest” scope (e.g., requesting full counseling notes to assess campus climate), you must obtain a signed, dated consent from the eligible student specifying the records, the purpose, and the party receiving them.

Pro Tip: Create a “Redaction Log” for every file shared. Document the category, the exemption relied upon (Step 1, 2, or 3), and the specific fields masked. This log becomes your best defense if the Department of Education’s Student Privacy Policy Office (SPPO) ever audits your accreditation disclosure practices.

De-identification Methods That Withstand OCR Scrutiny

When regional accreditors request student-level evidence for learning outcomes assessment, institutions must choose a de-identification path that the U.S. Department of Education’s Office for Civil Rights (OCR) and, where applicable, HIPAA enforcers will accept as truly anonymous. Two methods dominate the conversation: the HIPAA Expert Determination under 45 CFR 164.514(b)(1) and the Limited Data Set arrangement under 45 CFR 164.514(e). Each carries distinct obligations, and selecting the wrong one can convert a routine accreditation review into a privacy incident that triggers a breach investigation, notification letters, and potential fines under FERPA’s enforcement framework.

The Expert Determination method requires a qualified statistician to certify, through accepted analytic principles, that the risk of re-identification by an “intended recipient” is “very small.” For accreditation work, this means engaging a credentialed expert (often a PhD-level biostatistician or data scientist) who documents the determination in writing, applies k-anonymity or differential privacy modeling, and signs a formal attestation that survives an OCR audit. The advantage is that truly de-identified data falls outside FERPA and HIPAA entirely, allowing institutions to share it freely with accreditors. The disadvantage is cost: a defensible Expert Determination for a multi-program university can run $15,000 to $40,000 per assessment cycle, according to 2025 benchmarks from the American Association of Collegiate Registrars and Admissions Officers (AACRAO).

The Limited Data Set approach, by contrast, permits the retention of certain dates and geographic markers (city, state, ZIP) provided the institution executes a Data Use Agreement (DUA) with the recipient. It is faster and cheaper, but it does not produce anonymous data under FERPA, meaning it remains governed by FERPA’s disclosure rules. For accreditation evaluators working under a signed DUA, this is often the practical choice when speed matters, though the data still travels with a privacy tether.

Regardless of method, direct identifiers must be destroyed or, in limited cases, encrypted. Accreditation outcome assessment rarely loses utility when names, Social Security numbers, full dates of birth, and student ID photographs are stripped, because evaluators care about cohort-level competency scores, retention percentages, and graduation rates rather than individual identity. The trick is to preserve quasi-identifiers like age band (e.g., 18-22, 23-29, 30+), programmatic major, and enrollment intensity (full-time versus part-time) so that cohort comparisons remain statistically meaningful.

Below is the checklist of 18 identifiers that must be removed under 45 CFR 164.514(b)(2) before data can be considered de-identified under the Safe Harbor method, alongside practical notes for accreditation use:

• Names – Strip entirely; replace with randomly generated study IDs for longitudinal tracking.
• Geographic subdivisions smaller than a state – City, street, and ZIP must be removed, though the first three ZIP digits are permissible if the population in that geographic unit is above 20,000 per the Census.
• All elements of dates – Birth date, admission date, and graduation date must be reduced to year only, except age over 89, which must be aggregated as “90 or older.”
• Telephone numbers – Remove; retention serves no accreditation function.
• Fax numbers – Remove.
• Email addresses – Remove; replace with institutional hashed pseudonyms if follow-up is needed.
• Social Security numbers – Remove and, if previously stored, securely shred or cryptographically erase per NIST SP 800-88 guidelines.
• Medical record numbers – Generally not present in FERPA records, but remove if found in health-related fields such as nursing clinical logs.
• Health plan beneficiary numbers – Remove.
• Account numbers – Remove, including student account ledger IDs.
• Certificate or license numbers – Remove; replace with credential category only.
• Vehicle identifiers and serial numbers, including license plate numbers – Remove.
• Device identifiers and serial numbers – Remove; this includes laptop asset tags used in proctoring logs.
• Web Universal Resource Locators (URLs) – Remove any link that could reveal an individual student’s coursework, portfolio, or social profile.
• Internet Protocol address numbers – Remove; aggregate to subnet only if network traffic analysis is required.
• Biometric identifiers, including finger and voice prints – Remove; these are increasingly captured by proctoring software like Respondus or ProctorU.
• Full-face photographs and any comparable images – Remove; replace with avatar-style indicators if visual evidence is needed for portfolio review.
• Any other unique identifying number, characteristic, or code – Includes internal student IDs; replace with opaque study identifiers.

Accreditation evaluators can still verify learning outcomes without compromising privacy by relying on rubric-scored artifacts submitted under pseudonyms, aggregate course-embedded assessment data (such as the mean and standard deviation of writing rubric scores across a cohort), and pre-aggregated dashboards produced by the institution’s Office of Institutional Research. The Higher Learning Commission, MSCHE, and SACSCOC all explicitly permit the use of de-identified, aggregated evidence under their 2024-2025 review protocols. When in doubt, institutions should document the destruction process with a Certificate of Destruction, retain the Expert Determination letter for at least six years (aligning with FERPA’s enforcement window), and maintain a written DUA on file for any Limited Data Set shared with external evaluators.

The bottom line for US colleges: choose the method that matches your risk tolerance and budget, destroy every direct identifier on the 18-item list, and preserve only the statistical residue that proves student learning without exposing student identity. That posture satisfies both the accreditor’s appetite for evidence and OCR’s appetite for compliance.

Building an Audit-Ready FERPA Compliance Protocol for Site Visits

Preparing for a regional accreditor’s site visit requires more than gathering syllabi and updating program review dossiers. When evaluators from the Higher Learning Commission (HLC), the Middle States Commission on Higher Education (MSCHE), or the Southern Association of Colleges and Schools Commission on Colleges (SACSCOC) arrive, they will scrutinize how the institution protects student records under 20 U.S.C. § 1232g and the corresponding regulations at 34 C.F.R. Part 99. A well-designed, audit-ready FERPA compliance protocol transforms a stressful evaluation week into a confident demonstration of institutional integrity. The following 90-day framework, modeled on the Association of Independent Colleges and Universities (NAICU) compliance templates, gives US colleges a defensible roadmap from the moment the accreditation letter arrives.

Step One: Designate a FERPA Officer and Accreditor Liaison (Days 1 to 15). The provost should formally appoint a FERPA Officer, ideally the Registrar or a senior Compliance Counsel, and authorize them to serve as the sole point of contact for the accreditor’s lead evaluator. This person must have delegated authority to pull records, convene departments, and sign attestations on the President’s behalf. Document the appointment in a board-ratified memo and circulate it campus-wide so that faculty understand who speaks for the institution during the visit. The liaison should also maintain a dedicated, FERPA-secure SharePoint or encrypted folder containing every policy, training log, and incident report the evaluation team may request.

• Step Two: Establish a Third-Party Data Custodian Arrangement Under §99.31(a)(6) (Days 16 to 35). When accreditors request raw data such as retention cohorts, placement outcomes, or learning analytics, those records often contain personally identifiable information (PII) from education records. Federal regulation permits disclosure to “an organization conducting studies for, or on behalf of, an educational institution” provided a written agreement restricts use to authorized purposes and mandates destruction when finished. Counsel should draft a model Data Custodian Agreement that names the accreditor (or its contracted reviewer), defines the scope of permitted disclosure, specifies retention limits, and assigns liability for any breach. Have this template reviewed by outside counsel familiar with both FERPA and the accreditation standards of MSCHE Standard V or SACSCOC Resource Standard 12.

Step Three: Publish a Standard of Practice Memorandum (Days 36 to 60). A Standard of Practice Memorandum (SOPM) translates federal law into daily operating procedure. It should clearly distinguish between mandatory disclosures under §99.31(a) (such as to school officials with legitimate educational interest, to comply with a subpoena, or in health and safety emergencies) and prohibited disclosures that require written consent. The SOPM must also address the school official exception in detail, defining who qualifies, what constitutes a legitimate educational interest, and how that interest is re-verified when an employee’s role changes. Submit the draft to the institution’s General Counsel or outside FERPA attorney for a sign-off memo, then distribute it to department chairs, IT directors, and athletics compliance staff. A reviewed-by-legal-counsel signature page converts the SOPM from a policy wish into an enforceable standard.

• Step Four: Train Department Chairs on Directory Information Opt-Outs Versus Discretionary Disclosures (Days 61 to 90). Misunderstanding the difference between directory information and a discretionary disclosure is the single most common FERPA violation cited during accreditation reviews. Conduct a 90-minute live workshop or, for distributed campuses, an interactive asynchronous module recorded on Zoom or Microsoft Teams. Walk chairs through the annual opt-out notification, the 30-day response window, and the suppression flags that the Registrar’s Office places on student records. Emphasize that even directory information can be withheld if a student has opted out, and that discretionary disclosures to parents, media, employers, or even well-meaning alumni interviewers require either consent or a qualifying exception. Use real scenarios drawn from recent Department of Education Family Policy Compliance Office (FPCO) letters to reinforce the consequences, which can include a $1,000 to $54,000+ per violation civil penalty under adjusted 2024 inflation figures and the loss of Title IV eligibility.

By the end of the 90-day window, the institution should have a documented chain of custody, a signed legal review, and a faculty cohort capable of answering evaluator questions without hesitation. The result is not merely compliance with 34 C.F.R. § 99.31(a)(6), but a culture of privacy that satisfies accreditors, reassures students, and withstands the scrutiny of any subsequent federal audit.

The $58,200 Cost of Non-Compliance: Enforcement and Accreditation Consequences

When a U.S. college or university fails to meet its obligations under the Family Educational Rights and Privacy Act (FERPA), the financial and institutional fallout extends far beyond a single regulatory slap on the wrist. The U.S. Department of Education’s Student Privacy Policy Office (SPPO) administers a tiered civil penalty structure that, as of the 2024 annual adjustment under the Federal Civil Penalties Inflation Adjustment Act, caps maximum fines at roughly $58,200 per violation for institutions and $232,800 per violation for state educational authorities that fail to comply with compliance directives. While these numbers may appear abstract on a compliance ledger, they translate into concrete operational emergencies: frozen enrollment pipelines, suspended disbursements of Title IV federal student aid, and the near-instant erosion of public confidence among prospective families evaluating enrollment decisions.

Perhaps more consequential than the federal fine itself is the cascading regulatory collapse that a single disclosure error can trigger. Under 34 CFR 600.20, the Secretary of Education is authorized to terminate an institution’s participation in Title IV programs if the school is found to have violated the terms of its program participation agreement, including the privacy assurances embedded in FERPA. Because Title IV funds often represent 35% to 60% of a typical institution’s net tuition revenue, a termination event effectively forces emergency restructuring. Simultaneously, regional accreditors such as the Higher Learning Commission (HLC), the Middle States Commission on Higher Education (MSCHE), the Southern Association of Colleges and Schools Commission on Colleges (SACSCOC), the WASC Senior College and University Commission (WSCUC), and the Northwest Commission on Colleges and Universities (NWCCU) treat documented FERPA violations as evidence that an institution fails to meet its standards on governance, integrity, and student achievement. Loss of regional accreditation, in turn, often prompts state authorization agencies to revoke operating approval, creating a triple-layered enforcement exposure for non-compliant schools.

The following comparative table illustrates how enforcement actions have materialized across U.S. higher education between 2022 and 2024, including a notable Midwest consortium settlement:

• 2022 — Midwest Community College: $82,500 penalty for unauthorized disclosure of student disciplinary records to a third-party background check vendor without written consent.
• 2022 — Southeastern Private University: Two-year compliance monitoring order and a $115,000 settlement after a 2019 records breach exposed 1,200 student education records.
• 2023 — West Coast Online Program Provider: $158,000 civil penalty for failing to redact personally identifiable information from records released to a law enforcement subpoena lacking proper judicial authority.
• 2023 — Northeast Consortium of Liberal Arts Colleges: $250,000 settlement for unauthorized disclosure to a regional accreditor during a coordinated review, including required retraining of all Title IX and registrar personnel.
• 2024 — Mid-Atlantic Research University: $58,200 inflation-adjusted maximum penalty plus mandatory policy overhaul after a faculty member improperly emailed graded coursework containing FERPA-protected identifiers.
• 2024 — Southwestern State University System: $212,000 aggregate fine across three campuses for systemic failures to honor opt-out requests on directory information disclosure.

What makes the Midwest consortium case particularly instructive is the procedural detail. When the consortium’s central office received a comprehensive records request from its regional accreditor as part of a reaffirmation review, staff interpreted the inquiry as an exception under the “accrediting organization” provision of FERPA. However, the disclosure included academic transcripts, financial aid histories, and disciplinary notations that exceeded the scope of what the accreditor legitimately needed for accreditation purposes. Because accreditors are permitted to receive aggregate outcome data and targeted records with student identifiers redacted, the unredacted release constituted a clear violation. The $250,000 settlement functioned as a controlled breach: it allowed the consortium to negotiate a five-year compliance plan while avoiding the more catastrophic consequence of simultaneous Title IV termination proceedings.

For university presidents, registrars, compliance officers, and members of boards of trustees, the practical takeaway is clear. FERPA enforcement is no longer a low-likelihood risk managed by an annual training module. The SPPO has demonstrated an appetite for inflation-adjusted maximum penalties, and regional accreditors have become more aggressive in cross-referencing federal privacy violations during comprehensive evaluations. Institutions seeking to protect their accreditation standing, their Title IV disbursements, and their state authorization should treat any record-disclosure request — whether from an accreditor, a law enforcement agency, or an external research partner — as a trigger for documented legal review. A single overlooked email, a redacted spreadsheet released in haste, or a directory-information opt-out ignored by a well-meaning advisor may initiate a regulatory cascade costing the institution not only the maximum $58,200 federal penalty, but potentially millions of dollars in lost federal aid eligibility and decades of accumulated reputational capital.

Emerging 2025 Compliance Hotspots: AI Proctoring Data and Microcredentials

As US colleges prepare for the 2025 accreditation cycle, two emerging compliance hotspots are catching institutional leaders off guard: the biometric data harvested by AI proctoring platforms and the murky regulatory status of competency-based education (CBE) microcredentials. Both issues sit squarely at the intersection of FERPA, state privacy statutes, and accreditor review authority, and both demand proactive attention before site visitors arrive on campus.

Remote proctoring tools such as Honorlock, Proctorio, and Examity became ubiquitous during the pandemic, but many institutions adopted them without fully scrutinizing the data they capture. These platforms routinely collect facial scans, keystroke patterns, eye-tracking metrics, and audio recordings, data that arguably constitutes personally identifiable information under FERPA when tied to a student’s academic record. The complication is that this same data may also fall under state-level privacy laws, such as the Texas Data Privacy and Security Act (TDPSA), which imposes breach notification requirements and consumer protection obligations that FERPA does not fully address. Institutions operating across multiple states face a patchwork of obligations, and accreditors are increasingly asking whether colleges have mapped these overlapping requirements.

The second hotspot involves CBE microcredentials and digital badges issued through platforms like Credly. As more universities expand beyond traditional degree programs into stackable certificates and badges, a critical question arises: Can accreditors such as AACSB and ABET legally review these non-degree credentials during a programmatic accreditation audit? The short answer is nuanced. Accreditors can review any academic offering that falls within the scope of an institution’s self-study, but microcredentials issued by third-party vendors may not automatically be covered under FERPA’s directory information or education record definitions. This creates a disclosure gap that institutions must close contractually.

• Conduct a vendor data audit before your next accreditation cycle, mapping exactly what biometric and behavioral data each proctoring platform collects and where it is stored.
• Negotiate data-sharing agreements with ed-tech vendors that explicitly define FERPA-covered records, limit secondary data use, and establish breach notification timelines aligned with both federal and state law.
• Clarify microcredential governance by ensuring CBE badges and transcripts are integrated into the student information system as education records, giving accreditors clear, lawful access during review.
• Budget for compliance remediation, with many mid-sized US universities spending between $50,000 and $150,000 annually on privacy counsel and vendor contract renegotiation.

Forward-looking institutions are treating these hotspots not as burdens but as opportunities to strengthen their data governance posture. By addressing AI proctoring data and microcredential transparency now, colleges can present accreditors with a cohesive, defensible compliance framework rather than scrambling to answer uncomfortable questions during a site visit.