Loading...
A source-cited guide to Pennsylvania K-12 student records retention — what FERPA actually governs (privacy, not retention duration), why PHMC's county/municipal schedules don't cover school districts, the IDEA special-education destruction rule, and the specific questions that have no statewide answer.
More from the Compliance category.
A definitive HIPAA records compliance checklist for healthcare compliance and facilities leaders: the Security Rule controls that protect records (access, audit, integrity), how HIPAA, CMS, and Pennsylvania retention rules stack, the economics of a breach, defensible destruction, the ROT and dark-data problem, and a working audit-readiness checklist.
Our team has 55+ years of experience helping organizations like yours. Reach out for a no-pressure consultation tailored to your situation.
Need help applying this guide?
Talk to a specialistFERPA (20 U.S.C. §1232g; 34 CFR Part 99) does not set retention periods for student records — it is a privacy and access law, not a records-management law. Its only retention-adjacent rule is a destruction bar: a school may not destroy any education record while a parent or eligible student has an outstanding request to inspect it (34 CFR §99.10(e)). Pennsylvania also has no single statewide retention schedule for public school district student records comparable to PHMC's county/municipal schedules — PHMC's Local Government Retention and Disposition Schedule program explicitly covers only county and municipal government records, not school districts. Instead, 22 Pa. Code §§12.31–12.32 require each school entity's governing board to adopt its own written plan for the collection, maintenance, and dissemination of student records, conforming to state and federal law. For special education records, IDEA (34 CFR §300.624) requires a district to inform parents when personally identifiable information is no longer needed for educational services and to destroy it at the parent's request — but permits certain core identifying and achievement data (name, address, phone number, grades, attendance record, classes attended, grade level completed, year completed) to be kept permanently. Where a specific duration could not be confirmed at a primary source, this guide says so rather than estimating.
This guide is general reference information, not legal advice. Retention schedules and regulations are periodically revised — always confirm the current requirement against your regulator's published guidance (Pennsylvania Department of Education, PHMC, or your district's legal counsel) before setting a destruction date.
FERPA (20 U.S.C. §1232g; 34 CFR Part 99) does not set retention periods for student records — it is a privacy and access law, not a records-management law. Its only retention-adjacent rule is a destruction bar: a school may not destroy any education record while a parent or eligible student has an outstanding request to inspect it (34 CFR §99.10(e)). Pennsylvania also has no single statewide retention schedule for public school district student records comparable to PHMC's county/municipal schedules — PHMC's Local Government Retention and Disposition Schedule program explicitly covers only county and municipal government records, not school districts. Instead, 22 Pa. Code §§12.31–12.32 require each school entity's governing board to adopt its own written plan for the collection, maintenance, and dissemination of student records, conforming to state and federal law. For special education records, IDEA (34 CFR §300.624) requires a district to inform parents when personally identifiable information is no longer needed for educational services and to destroy it at the parent's request — but permits certain core identifying and achievement data (name, address, phone number, grades, attendance record, classes attended, grade level completed, year completed) to be kept permanently. Where a specific duration could not be confirmed at a primary source, this guide says so rather than estimating.
IT directors and records staff often search for "the FERPA retention period," but no such thing exists. FERPA (20 U.S.C. §1232g, implemented at 34 CFR Part 99) is a privacy and access statute. It gives parents and eligible students the right to inspect and review education records, controls when personally identifiable information can be disclosed to third parties, and sets procedural deadlines — like the requirement that a school comply with an inspection request within a reasonable time, not to exceed 45 days.
A source-cited retention guide for Pennsylvania hospitals, ambulatory surgical facilities, and physician practices — covering the 7-year state rule, the HIPAA documentation floor most organizations mistake for chart retention, and the diverging minor-patient rules between hospitals and physician practices.
What FERPA does not do is tell a district how many years to keep a transcript, a discipline file, or a special-education record. The U.S. Department of Education's Student Privacy Policy Office confirms this directly: schools have discretion over what education records they create and keep, because "FERPA does not require schools to create education records nor does it require schools to maintain education records, unless there is an outstanding request by a parent or eligible student to inspect and review the records" (34 CFR §99.10(e)).
That one clause — the pending-request destruction bar — is FERPA's only retention-adjacent rule. Retention durations come from somewhere else entirely: state law, state education-agency guidance, other federal program rules (like IDEA for special education), and each district's own board-adopted records plan.
Pennsylvania counties and municipalities operate under retention and disposition schedules maintained by the Pennsylvania Historical and Museum Commission (PHMC) State Archives under the County Records Act and Municipal Records Act. School districts are a different animal: PHMC's own description of its Local Government Retention and Disposition Schedules program limits its scope to "cities of the third class, boroughs, incorporated towns, townships" and county government — school districts are not listed as a covered entity type.
Instead, Pennsylvania regulates student records through 22 Pa. Code Chapter 12. Section 12.31 requires that "the governing board of every school entity shall adopt a plan for the collection, maintenance and dissemination of student records," keep a current copy on file, and update it as state or federal law changes. Section 12.32 requires that plan to "conform with applicable State and Federal laws, regulations and directives identified in guidelines issued by the Department [of Education]." Neither section specifies a retention duration in years — the regulation delegates that decision to each district's own board-adopted plan, built to conform with whatever federal and state requirements apply to that record type.
Practical effect for a records manager: there is no single number to look up for "how long PA schools keep student records." The number that applies to a given file is the one in your own district's board-adopted student records plan — which itself has to trace back to a real legal requirement (FERPA's access-request bar, IDEA's parental-notice rule, employment/payroll law, or a specific state statute) rather than an assumed convention. Districts that have not reviewed their retention plan against current law are the ones most exposed at audit time.
Separately, 22 Pa. Code §51.72 requires K–12 private academic schools (licensed under the Private Academic Schools Act, 24 P.S. §§6701–6721) to maintain a permanent cumulative record with hours of instruction, attendance, scholastic achievement, test scores, and personal/health/co-curricular data — current and available for inspection. That section, too, does not specify a retention duration.
Records for students who received special education services carry an extra federal layer under the Individuals with Disabilities Education Act. 34 CFR §300.624 requires the public agency to inform parents when personally identifiable information collected, maintained, or used under Part B "is no longer needed to provide educational services to the child." At the parent's request, that information must then be destroyed.
The same section carves out an exception: a district may permanently maintain certain core identifying and achievement information without destroying it — specifically "name, address, and phone number, his or her grades, attendance record, classes attended, grade level completed, and year completed." Everything else that is personally identifiable and tied to the disability determination (evaluations, IEPs, related-services documentation) is subject to the parental-notice-and-destruction-on-request cycle.
What IDEA does not do is hand districts a specific year count (e.g., "7 years post-graduation") — that number, again, has to come from the district's own retention plan, informed by other obligations (e.g., statute-of-limitations exposure for due-process complaints, which is a legal-counsel question, not a records-management one).
This is the one hard, verifiable FERPA rule that touches retention, and it is a floor, not a schedule: "The educational agency or institution ... shall not destroy any education records if there is an outstanding request to inspect and review the records under this section" (34 CFR §99.10(e)).
In practice, this means a district's routine retention schedule is automatically suspended for any specific record the moment a parent or eligible student submits a formal inspection request — regardless of what the board-adopted plan says about that record's normal disposal date. Records staff need a process to flag records under an open inspection request before running any scheduled destruction batch, digitization purge, or off-site storage cleanup.
This guide's differentiation is honesty about what Pennsylvania has not settled at a state level, rather than filling the gap with an estimate. Four specific questions could not be answered from a primary Pennsylvania or federal source during this research:
In each case, the honest answer is: confirm your specific district's board-adopted plan, because no state schedule fills the gap.
Because Pennsylvania delegates retention scheduling to each district's own board-adopted plan rather than issuing a single state-mandated schedule (the PHMC framework that governs counties and municipalities does not extend to school districts), the operational risk for IT and records staff is less about "which year to shred" and more about defensibility: can the district show every record type has a retention period traceable to an actual legal requirement, and can it produce any given record — permanent or scheduled — on demand while it's within its retention window?
Digitizing permanent and long-retention student records (cumulative folders, transcripts, special-education files subject to IDEA's notice-and-destroy cycle, immunization documentation) converts a physical liability — misfiled paper, single-point-of-failure storage rooms, staff time spent pulling files for open-records or litigation-hold requests — into a searchable, access-logged digital record. That directly supports the FERPA access-log requirement and the §99.10(e) pending-request bar, since a digitized, indexed record is far easier to flag and hold than a folder in a warehouse. Reynolds' document scanning services support this kind of program as part of a broader records management approach for school district back-office functions.
This guide does not extend into the retention rules for district employment, personnel, or payroll records — those are covered in Reynolds' cross-domain guide, Pennsylvania Records Retention Guide, which addresses the municipal/PHMC framework and general business-record categories that also apply to school district back-office functions.
28 Pa. Code §23.85 requires a school to maintain a certificate of immunization on file (or in a computer database) while the child is enrolled, and to return or transfer that record when the child withdraws, transfers, is promoted, graduates, or otherwise leaves the school. No specified post-enrollment retention duration for immunization records was found in Pennsylvania regulation — that gap should be confirmed against your district's own health-records policy.