A confidential label does not take a student record outside FERPA

What happened

On October 27, 2026, the United States filed suit against the Board of Education of Anne Arundel County, Maryland, in the U.S. District Court for the District of Maryland (United States v. Board of Education of Anne Arundel County, No. 1:26-cv-04499). The complaint is not a civil rights claim under Title VI or Title IX. It brings eight counts under the Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA), and it rests on the remedies provision of the General Education Provisions Act, 20 U.S.C. 1234c(a)(4), which lets the Secretary of Education "take any other action authorized by law" against a recipient that is out of substantial compliance.

The complaint describes an administrative sequence that preceded the suit. According to the complaint, the Secretary found the district out of substantial compliance with FERPA on July 22, 2026, and with PPRA on September 3, 2026, and the Justice Department demanded that the district stop each violation on July 29 and September 10. The district revised its regulation in August. The United States alleges that the regulation, as revised, still violates both statutes.

The allegations center on the district's regulation on student gender identity, Regulation JQ-RA. As described in the complaint, the regulation designates information about a student's gender identity as "confidential medical information," keeps it in the student information system under restricted access, and allows a principal to limit parental involvement in a support plan when the principal finds "a genuine safety concern." The complaint also alleges that when a parent asked for records, the district said that "internal emails, personal notes, or other staff communications" would require "appropriate legal process, including a subpoena." Other counts allege disclosure of a student's information on a field trip roster, reporting of "student gender information" to the Maryland State Department of Education without consent, denial of a hearing to challenge record content, and, under PPRA, that the support plan process required staff to question a student about protected topics without prior written parental consent.

The United States asks the court for declarations that the district's policies violate FERPA and PPRA and for an injunction requiring the district to stop enforcing the regulation, provide a records hearing, obtain written consent before covered surveys, and give parents direct notice and an opportunity to opt out. These are allegations in a complaint. No court has ruled on them, and K-12 Dive reported that the district had not responded to a request for comment at publication.

Why this development is significant

Most discussion of this case will focus on gender identity policy. For compliance staff, the more durable point is the enforcement vehicle. The federal government is litigating student privacy statutes directly, after administrative findings, and asking a court to order changes to a district's records practices. K-12 Dive also reported that two Kansas districts were referred to the Justice Department in September; that report has not been verified against a primary source.

The second point is that the records counts do not depend on how a court resolves the policy debate. FERPA defines education records as records that "contain information directly related to a student" and "are maintained by an educational agency or institution," subject to the statute's listed exceptions. It gives parents the right to inspect and review those records within 45 days of a request and the right to a hearing "to challenge the content" of them. A label such as "confidential medical information," a restricted access setting, or a practice of treating staff email as outside the record does not, by itself, change whether a document meets that definition. The complaint tests what happens when a district's internal classification and FERPA's definition point in different directions.

What it means for institutions

For PK-12 districts, the practical exposure sits in the gap between where information about a student actually lives and where the district says its education records are. Counselor notes, support plans, email threads among staff, and fields in the student information system with restricted visibility can all contain information directly related to a student. A district that answers a parent's records request only from the cumulative file, or that tells a parent that staff communications require a subpoena, should be confident that each excluded category fits a specific statutory exception.

The hearing right is the second gap. An amendment procedure that exists only on paper is easy to overlook until a parent invokes it. The regulations at 34 CFR 99.20 through 99.22 require a decision on an amendment request, notice of the right to a hearing, a hearing officer without a direct interest in the outcome, a written decision based solely on the evidence presented, and, if the record stands, the parent's right to place a statement in the record that travels with it.

The PPRA counts are the least settled part of the complaint. PPRA requires prior written parental consent before a student is required, as part of an applicable program, to submit to a "survey, analysis, or evaluation" that reveals information in eight protected categories, including "mental or psychological problems of the student or the student's family" and "sex behavior or attitudes." The complaint treats a structured support plan conversation as that kind of evaluation. Whether a court agrees is open. In the meantime, the theory gives districts reason to look at any structured intake, plan, or questionnaire process that touches a protected category, not only formal surveys.

What compliance leaders should review

1. Map where student-specific information is kept: the student information system, including restricted fields, counseling and health files, support or safety plans, and staff email. Decide, with counsel, which of those are education records and document the exception you rely on for any category you treat as outside FERPA.
2. Test the records request process against the 45-day requirement. Confirm that the person responding knows how to search staff email and restricted fields and does not route parents to a subpoena for records the district maintains.
3. Confirm that a working amendment and hearing procedure exists under 34 CFR 99.20 through 99.22, with a designated hearing officer, a written decision template, and a way to attach a parent's statement to the contested record.
4. List every data element reported to the state education agency and identify the legal basis for each disclosure.
5. Inventory structured questionnaires, intake forms, and plan templates that ask about any of the eight PPRA categories, and confirm whether written consent, annual notice, and opt-out procedures apply.
6. Where a policy allows staff to limit parental involvement, record who decides, on what factors, and how the decision is documented, so that the record can be produced and explained if it is requested.

What remains uncertain

The court has not ruled on any count, and we have not seen a filed response from the district. It is not settled whether the remedies provision the United States relies on supports this kind of suit, whether PPRA reaches individualized conversations with a single student, or how FERPA's access and amendment rights interact with state law and district policies on student privacy. The Justice Department press release announcing the suit could not be located for this article; the account above rests on the complaint itself, with district response and the Kansas referrals drawn from K-12 Dive. We will follow the docket and report on any ruling.

Sources

• Complaint, United States v. Board of Education of Anne Arundel County, No. 1:26-cv-04499 (D. Md. filed Oct. 27, 2026)
• Family Educational Rights and Privacy Act, 20 U.S.C. 1232g
• Protection of Pupil Rights Amendment, 20 U.S.C. 1232h
• General Education Provisions Act, remedies for existing violations, 20 U.S.C. 1234c
• 34 CFR Part 99, Subpart C, amendment of education records (34 CFR 99.20 to 99.22)
• Naaz Modan, "A Maryland district changed its pronoun policy. The Justice Department still sued." K-12 Dive, Oct. 28, 2026 (secondary source)