FERPA truth statement?

• A. FERPA applies to health data privacy.
• B. FERPA governs access to student education records.
• C. FERPA requires PCI-DSS compliance.
• D. FERPA is primarily a data breach law.

Answer: (B)

FERPA is all about protecting the privacy of student education records and controlling who can access or disclose those records. It applies to schools and colleges that receive federal funds and gives students rights to inspect their records, request amendments, and limit who can see information without consent. The law specifies that information from education records can generally not be shared without consent, with certain allowed disclosures to school officials with a legitimate educational interest or in other narrowly defined circumstances. This focus on access and disclosure of student education records is why the true statement is that FERPA governs access to student education records.

Other options mix in areas that FERPA doesn’t cover: health data privacy is typically governed by HIPAA in many contexts, PCI-DSS relates to payment card security, and FERPA is not a general data breach statute.