FERPA Awareness

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. It applies to schools that receive funding from the U.S. Department of Education and gives families rights over their children's educational information.

FERPA governs who can access student records, how they can be shared, and what protections must be in place. For educational teams, evaluators, service providers, and families who handle IEPs, evaluations, and other education records, understanding and complying with FERPA is essential.

SpEd Coach is designed from the ground up to support FERPA-aligned handling of education records. Whether you are part of an educational team, an independent evaluator, a service provider, or a family managing your own child's records, much of the information you handle falls under FERPA protections, even when you operate outside the school district.

Our platform provides the tools and safeguards needed to handle these records responsibly, including access controls, data minimization, PII protection, audit logging, and retention management.

Access to data within SpEd Coach is governed by role-based permissions. Each user is assigned a role (owner, evaluator, service provider, staff, or family) that determines what they can see and do within the platform.

Staff members only access cases they are assigned to. Evaluators see only the students and reports they are working on. Family Portal users see only their own child's case information. Administrative functions are restricted to organization owners. This ensures that student information is only accessible to those who need it for their specific work.

SpEd Coach follows data minimization principles. We collect and store only the information necessary to provide the service. Features are designed to limit the exposure of sensitive data, and AI processing is structured to work with the minimum required content.

SpEd Coach is designed to reduce unnecessary exposure of personally identifiable information during document review and AI-assisted workflows. The platform includes privacy-aware tools intended to support FERPA-aware handling of education records, but organizations remain responsible for reviewing records and determining appropriate disclosures.

PII Detection: Automatically identify names, dates of birth, Social Security numbers, student IDs, parent contact information, and other potentially sensitive identifiers within uploaded records and educational documents.

Automated Redaction and Masking: SpEd Coach may remove, mask, or redact detected identifiers before AI-assisted processing workflows in order to reduce unnecessary exposure of personally identifiable information.

Tokenization: Sensitive identifiers may be replaced with structured tokens that preserve document context and workflow continuity while limiting direct exposure of identifying information.

AI Processing Protection Workflow: SpEd Coach is designed so AI-assisted workflows use privacy-aware processing protections before external AI processing occurs. Depending on organizational configuration and workflow design, personally identifiable information may be removed, masked, tokenized, or otherwise minimized before processing.

SpEd Coach maintains comprehensive audit logs that track access to and processing of sensitive information. These logs record:

• Who accessed what data and when
• PII detection and redaction events, including what was found and what action was taken
• AI processing requests and the de-identified content that was sent
• Document uploads, downloads, and sharing events
• Changes to access permissions and user roles

These audit logs support compliance documentation and can be referenced during reviews or audits.

SpEd Coach provides retention management tools that allow organizations to control how long data is stored. Soft-deleted records are automatically purged after 30 days. Organizations can configure retention policies aligned with their compliance requirements and applicable state regulations.

We maintain incident response procedures to address potential security events. In the unlikely event of a data breach, we will promptly notify affected users and take appropriate remediation steps. Our response process includes identification, containment, investigation, notification, and corrective action.

FERPA-aware data handling is a shared responsibility between SpEd Coach and its users.

Our responsibility: SpEd Coach is responsible for providing security-minded platform design, tenant-aware access controls, audit logging concepts, privacy-aware workflow tooling, and operational safeguards intended to support responsible handling of sensitive educational records and workflows.

Your responsibility: Organizations and users are responsible for reviewing uploaded records, managing user permissions, validating AI-assisted outputs, determining whether disclosures are appropriate, removing or reviewing sensitive information where necessary, complying with applicable laws and policies, and ensuring educational records are handled appropriately within their own operational environment.

AI-assisted tools are intended to support human workflows, not replace human judgment, legal review, educational decision-making, or organizational compliance obligations.