FERPA Compliance

1. What is FERPA

The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, is a federal law that protects the privacy of student education records. FERPA applies to all educational agencies and institutions that receive funding under programs administered by the U.S. Department of Education. Under FERPA, students have the right to inspect their education records, request corrections, and control the disclosure of their records to third parties. Institutions must have a legitimate educational purpose or student consent before disclosing education records.

2. How TCS Platform Complies

TCS Platform is built with FERPA compliance as a foundational design principle, not an afterthought. Key technical and operational controls include:

• Data isolation per institution: Every record in TCS Platform is tagged with the institution's school and department identifiers. SQL-level scoping enforces that users can only retrieve records belonging to their own institution — cross-institution data visibility is architecturally prevented.
• No cross-institution data sharing: Student records, scores, and assessment data are never shared with, accessible to, or visible by users from a different institution, regardless of platform role.
• Audit logging: All access to student education records is logged with the user identity, timestamp, action taken, and the record accessed. These audit logs are available to institutional administrators on request.
• Role-based access controls: Access to student records is restricted to users with an appropriate institutional role (administrator, facilitator, or the student themselves). Students may only view their own records.

3. School Official Legitimate Educational Interest

FERPA permits the disclosure of education records to school officials who have a "legitimate educational interest" in the records — that is, when the official needs to review the records to fulfill their professional responsibilities. TCS Platform is designed to operate squarely within this exception. Facilitators and administrators who use the platform access student records only in the context of managing, administering, and evaluating clinical education activities. Institutions should document in their FERPA policies that TCS Platform is a system used by designated school officials under the legitimate educational interest exception.

4. Directory Information

TCS Platform does not publish, display, or otherwise expose student directory information to any party outside the institution. Student names, contact information, and enrollment status within the platform are treated as non-directory, protected education records. Institutions should not configure TCS Platform as a channel for communicating directory information.

5. Student Rights

Under FERPA, enrolled students retain the following rights with respect to their education records held in TCS Platform:

• Right to inspect: Students have the right to inspect and review their own education records, including assessment scores and evaluator feedback, within 45 days of a request.
• Right to request amendment: Students may request that their institution amend records they believe are inaccurate or misleading. TCS Platform supports institutional administrators in correcting records when appropriate.
• Right to consent to disclosures: Education records may not be disclosed outside the institution without the student's written consent, except as permitted by FERPA. TCS Platform does not facilitate any such disclosures without explicit institutional and student authorization.

To exercise these rights, students should contact their institution's registrar or program administrator. For technical assistance, institutions may contact ferpa@osceapp.com.

6. Parent and Guardian Access

Under FERPA, once a student is enrolled in a postsecondary institution, educational rights transfer to the student. Parents or guardians do not have an automatic right to access education records. TCS Platform does not provide parent or guardian access to student records. Exceptions apply only where:

• The student has provided written consent authorizing disclosure to a parent or guardian, or
• The student is a dependent minor as defined under the Internal Revenue Code and the institution has determined that parent access is appropriate under applicable FERPA exceptions.

Institutions are responsible for managing any such access requests and for obtaining appropriate authorizations before requesting that TCS Platform facilitate any disclosure.

7. Institutional Responsibilities

While TCS Platform provides robust technical controls to support FERPA compliance, institutions retain legal responsibility for compliance with FERPA. Institutional responsibilities include:

• Designating only appropriate staff members as users with access to student education records in TCS Platform, and ensuring those designations align with the institution's published FERPA policies.
• Providing FERPA training to all staff who will access student records through TCS Platform, and maintaining documentation of such training.
• Including TCS Platform in the institution's annual notification to students of their FERPA rights, where required.
• Promptly deprovisioning access for personnel who no longer have a legitimate educational interest (e.g., upon departure or role change).
• Responding to student requests to inspect, amend, or restrict disclosure of their records in accordance with applicable FERPA timelines.

8. Data Requests and Subpoenas

If ECC, Inc. receives a legal demand, subpoena, or government order requiring disclosure of student education records, we will:

• Notify the affected institution as promptly as practicable before complying with the demand, unless we are legally prohibited from doing so (e.g., by a court-issued nondisclosure order).
• Provide the institution a reasonable opportunity to seek a protective order or other legal remedy before disclosure occurs, where permitted.
• Disclose only the minimum records necessary to comply with the legal obligation.

Institutions that receive their own legal demands seeking records stored in TCS Platform should contact ferpa@osceapp.com to coordinate a response.

9. Contact

ECC, Inc. DBA Training Centre Solutions
FERPA Compliance: ferpa@osceapp.com