How are confidentiality and FERPA protections maintained when sharing IEP information with external providers?

• A. Share all IEP information with any external provider who requests it.
• B. Send information via unsecured email without encryption.
• C. Obtain written consent where required, share only necessary information, use secure transmission, and limit access to authorized personnel.
• D. Never disclose any information to external providers.

Answer: (C)

Protecting student privacy when sharing IEP information with external providers hinges on consent, sharing only what is needed, using secure methods, and limiting access to those who are authorized. When services come from outside professionals, schools should obtain written consent from a parent or guardian when required, and disclosures should be limited to the minimum information necessary to deliver the service. Information should be transmitted through secure channels—such as encrypted email, a secure portal, or other approved methods—and access should be restricted to the personnel who need the data to provide supports. Keeping a record of what was shared, with whom, and ensuring external providers sign confidentiality agreements helps maintain ongoing protection. This approach aligns with FERPA and data-minimization principles, supporting the student’s access to services while reducing privacy risks. Sharing everything on request or sending information via unsecured channels would increase risk and isn’t appropriate, and withholding information would impede needed services.