Storing special education records securely

By the IEP Atlas editorial teamLast updated November 1, 2026

Short answer

Store special education records in one official file, paper or digital, with a named person responsible, a current list of staff who may access it, and locked or permission-based storage. FERPA and IDEA require schools to protect the confidentiality of these records and give parents access. Working copies need the same care, and your district's retention schedule decides when records are destroyed.

Special education files hold some of the most sensitive information a school keeps: evaluations, diagnoses, behavior incidents, family details. Two federal laws cover them. FERPA gives parents rights over their child's education records and limits disclosure without consent.^[1]^[2] IDEA adds confidentiality rules for special education records specifically.^[4]

This guide covers the storage side: where records live, who can see them and how long they are kept. It is written for administrators and case managers. The role behind the records is in the case manager's handbook.

What the rules say

Rule	What it requires	Source
Parent access	Parents may inspect and review their child's records. The district must comply without unnecessary delay, before any IEP meeting or hearing, and within 45 days at most	34 CFR 300.613^[3]
Safeguards	Protect confidentiality when collecting, storing, disclosing and destroying records	34 CFR 300.623^[4]
One responsible official	One official at each agency is responsible for confidentiality	34 CFR 300.623^[4]
Training	Everyone who collects or uses personally identifiable information is trained on the state's policies	34 CFR 300.623^[4]
Access list	A current list of names and positions of employees who may have access, available for public inspection	34 CFR 300.623^[4]
Consent to disclose	Disclosure generally needs written consent, with listed exceptions	FERPA, 34 CFR Part 99^[2]
Retention	How long records are kept	State and district retention schedules; these vary

What you need before you start

Your district's records policy and retention schedule.
A list of every place special education records currently live: cabinets, the IEP system, shared drives, email, classroom binders.
The name of the official responsible for confidentiality.

Step-by-step

Step 1: Map where records live now

Walk the building and the drives. Count every location that holds IEPs, evaluations, data sheets or contact logs.

Example: one fictional middle school found records in 11 places, including 3 classroom binders, a counselor's desk drawer, 2 shared drives and personal email folders.

Step 2: Name one official file per student

Decide which copy is the record: the IEP system, a central cabinet, or both with a clear split. Everything else is a working copy.

Step 3: Lock it down

Paper: a locked cabinet in a room that is locked when unattended, with keys held by a short list. Digital: permission-based access by role, not a folder shared with "all staff." Turn off link sharing for anything with student names.

Step 4: Keep the access list current

Write down the names and positions of staff who may access special education records, and update it each August and whenever staff change.^[4] Many districts also keep a sign-out or access record on paper files. FERPA requires a record of disclosures to outside parties.^[2]

Step 5: Control working copies

Data binders, teacher binders and IEP summaries are working copies. Keep them locked, use initials on anything posted or emailed, and shred them when they are out of date. A summary left on a copier is a disclosure.

Step 6: Follow the retention schedule

Your state or district sets how long special education records are kept after a student exits, and how parents are told before records are destroyed. Schedules vary, so do not guess. Mark each file's destruction date when the student leaves.

Worked example: one student's records over a year

Nia is a fictional 5th grader. Here is where each record lives and who can see it.

Record	Official location	Working copy	Who can access
IEP (Oct 2026)	IEP system	One-page summary in teacher binder	Case manager, teachers, providers on the access list
Evaluation report (Mar 2026)	IEP system and central cabinet	None	Case manager, school psychologist, administrator
Data sheets (4 goals)	Scanned to the IEP system each quarter	Data binder, locked cabinet in Room 114	Case manager, para, SLP
Service logs	IEP system, quarterly	Paper log in teacher binder	Case manager, administrator
Parent contact log	IEP system notes	None	Case manager
Behavior incident reports (2)	Central cabinet	None	Case manager, administrator, behavior specialist

In February, Nia's father asks to see her records before the spring meeting. The case manager logs the request on February 3, gathers the files from 2 locations, and meets him on February 9, before the meeting and well within 45 days.^[3] Because the official file was defined in step 2, nothing had to be hunted down.

Common mistakes

Weak: Records spread across binders, drives and inboxes. Better: One official file; everything else is a dated working copy.
Weak: A shared drive folder open to all staff. Better: Access by role, listed by name and position.
Weak: Emailing an IEP to a personal account to work from home. Better: Use the district system's remote access.
Weak: Keeping every draft forever "just in case." Better: Follow the retention schedule and shred working copies when they are replaced.
Weak: Students' full names in a free online tool. Better: Use initials or IDs in any tool outside the district system, and check the district's approval list.

Using the caseload tracker for this

The free caseload tracker keeps what you enter in your browser, so treat the device as part of your records. Use initials or student numbers rather than full names, and keep its CSV exports in district storage, not a personal drive. The same goes for printouts from the IEP due date calculator.

For the documents that should go into the file, see building a clean documentation trail. For working copies, see the teacher binder and the data binder. The FERPA glossary entry explains parents' rights in plain terms. Retention periods and destruction notice rules vary by state; check your district's schedule.

Frequently asked questions

How long must special education records be kept?

It depends on your state and district retention schedule. Federal rules require protecting confidentiality through destruction but leave the retention period to states and districts, so check your local schedule.

Who can see a student's special education records?

School staff with a legitimate educational interest who are on the district's access list, and the student's parents. Disclosure to others generally needs written parent consent, with exceptions listed in FERPA.

How quickly must a school let parents see records?

Without unnecessary delay, before any IEP meeting or hearing, and in no case more than 45 days after the request.

Use it in IEP Atlas

Sources

FERPA, Protecting Student Privacy, U.S. Department of Education
34 CFR Part 99: Family Educational Rights and Privacy, eCFR (National Archives)
34 CFR §300.613: Access rights, U.S. Department of Education (IDEA website)
34 CFR §300.623: Safeguards, U.S. Department of Education (IDEA website)

Written and checked by the IEP Atlas editorial team under our editorial policy. This guide describes general practice and federal rules. It is not legal advice; your state may add requirements, and the IEP team makes the decisions for each student.