All About 603 CMR 23.00:

Understanding Your Rights Under Massachusetts Student Records Law

All About 603 CMR 23.00: Student Records Regulations in Massachusetts grants four core rights regarding student educational records: access, privacy, amendment, and destruction. These regulations, established under M.G.L. c.71, §§34D and 34F, protect student information while ensuring parents and students can inspect, correct, and control their records.

Quick Answer: What You Need to Know

• Rights Holders: Parents hold rights until a student turns 14 or enters 9th grade, at which point rights are shared between parent and student.
• Protected Information: All student data is protected, divided into permanent transcripts (kept 60 years) and temporary records (destroyed after 7 years).
• Access: Schools must provide records within 10 days of a request.
• Privacy: Written consent is required to share records with most third parties.
• Amendment: You can challenge and appeal to correct inaccurate or misleading information.

For K-12 IT Directors, protecting student data now involves guarding digital records against modern cybersecurity threats. Non-compliance with 603 CMR 23.00 can lead to lost funding, while a data breach can expose sensitive student information, creating significant legal and security risks.

These Massachusetts regulations work with the federal Family Educational Rights and Privacy Act (FERPA) but provide more specific rules on record destruction and amendments. They apply to all Massachusetts public elementary and secondary schools and private schools with publicly-funded special education programs, governing everything from record retention to access control.

All About 603 CMR 23.00: Student Records Regulations in Massachusetts vocabulary:

• All About FERPA: The Federal Student Privacy Law That Still Matters in 2025
• All About New York’s Education Law § 2-d: Student Data Privacy, Explained
• All About SOPPA: What Illinois Schools Must Know About Student Data Protections

The Anatomy of a Massachusetts Student Record

All About 603 CMR 23.00: Student Records Regulations in Massachusetts defines a "student record" as any information organized by a student's name or other identifier, whether on paper or stored digitally. This broad definition ensures nearly all data a school keeps on a student is protected.

The student record is divided into two parts: the transcript (permanent record) and the temporary record. They serve different purposes and have distinct retention periods.

The Permanent Transcript: What's Included and How Long It's Kept

The transcript is the permanent, official academic resume of a student. It contains essential administrative and academic data, including:

• Student's name, address, phone number, and date/place of birth
• Parent or guardian contact information
• Course titles, grades, and credits earned
• Grade level completed
• Massachusetts Comprehensive Assessment System (MCAS) performance results

This record must be maintained by the school and can only be destroyed 60 years after the student graduates, transfers, or withdraws. This long retention period ensures individuals can access their academic history for future employment, education, or personal needs, such as verifying a high school diploma for Social Security benefits.

The Temporary Record: A Detailed Look

The temporary record contains all other information relevant to a student's education. This includes standardized test scores (e.g., SATs, AP exams), class rank, extracurricular activities, teacher evaluations, disciplinary records, health records, and special education documents like Individualized Education Programs (IEPs).

Unlike the transcript, the temporary record must be destroyed no later than seven years after the student leaves the school system. This balances the need for comprehensive records during a student's K-12 career with privacy considerations. Some exceptions apply; for instance, certain special education and financial records are kept for seven years for auditing purposes, and immunization records are kept for at least 10 years per 105 CMR 220.500.

Before destruction, schools must provide written notice to parents and eligible students, giving them an opportunity to obtain copies. This notice should be delivered directly, such as in a graduation packet, rather than just a general newspaper announcement.

Your Rights: Accessing, Amending, and Controlling Student Records

All About 603 CMR 23.00: Student Records Regulations in Massachusetts empowers parents and students with control over educational records. Parents have the right to inspect their child's records at any age, as guaranteed by M.G.L. c. 71, section 34E. This right extends to guardians and non-custodial parents unless limited by a court order.

A student becomes an eligible student at age 14 or upon entering ninth grade, whichever comes first. At this point, the student shares the rights to access, amend, and control their records with their parents. They can exercise these rights jointly or independently. Once a student turns 18, they assume primary control, though parents retain inspection rights unless the student limits them in writing.

How to Access and Interpret Your Student's Records

Accessing student records is a straightforward process:

1. Request Procedure: Submit a written request to a school official, such as the principal. Using email or certified mail creates a paper trail.
2. Access Timeline: Schools must provide access to the entire record within ten days of the request.
3. Right to Interpretation: You can ask for a meeting with qualified school staff to explain any part of the record you don't understand.
4. Fees for Copies: Schools can charge a reasonable fee for copies but cannot charge a fee if it would prevent you from exercising your right to inspect the records. The fee should only cover reproduction costs (e.g., $.20 per page is a common benchmark for public records). Schools cannot withhold report cards or diplomas over unpaid fees.

All About 603 CMR 23.00: Student Records Regulations in Massachusetts: Challenging and Amending the Record

You have the right to challenge information in a student's record that you believe is inaccurate, misleading, or violates privacy. This is a powerful tool for correcting errors.

The process begins with a written request to the principal, identifying the disputed information, explaining why it's wrong, and stating the desired change (e.g., removal, correction). The school must respond to your request within approximately one week.

If the principal denies the request, you can follow a formal appeal process:

1. Appeal to the Superintendent: Submit a written appeal. The superintendent must respond within two weeks.
2. Request a Fair Hearing: If still unsatisfied, you can request a hearing before the school committee. The hearing must occur within four weeks. At the hearing, you can present evidence and make your case.
3. Final Decision: The school committee issues a written decision within two weeks of the hearing.

This multi-level process ensures your concerns are thoroughly reviewed. If you believe the school has violated state or federal regulations (like FERPA), you can file a complaint with the Massachusetts Department of Elementary and Secondary Education or the U.S. Department of Education, respectively.

All About 603 CMR 23.00: Student Records Regulations in Massachusetts: Disclosure and Confidentiality

At its core, All About 603 CMR 23.00: Student Records Regulations in Massachusetts establishes that student records are private. The default rule is that schools must obtain specific, informed written consent from a parent or eligible student before sharing personally identifiable information with a third party. To ensure accountability, schools must maintain a log of access for each student's record, documenting who accessed it, when, and why.

This confidentiality applies equally to paper and digital records. Schools have a serious responsibility to protect digital files with robust cybersecurity measures. A data breach can have severe consequences, making staff training on threats like phishing essential. You can assess your school's readiness with a complimentary Phishing Audit for your school.

When Can Schools Disclose Records Without Consent?

The regulations include specific exceptions to the consent rule to allow for normal school operations and emergencies:

• Directory Information: Schools can release basic information (name, address, activities, awards) but must provide families with annual notice and the opportunity to opt out.
• Health and Safety Emergencies: In an immediate threat, schools can share necessary information with law enforcement or medical personnel without prior consent.
• Court Orders and Subpoenas: Schools must comply with legal orders but are required to make a reasonable effort to notify the parent/student before releasing records, unless prohibited by the order.
• Authorized School Personnel: Teachers, counselors, and administrators may access records they need to perform their professional duties. This access is limited to a "need-to-know" basis.
• Transferring Schools: A student's former school can send the complete record to their new school without consent, provided parents were given prior notice of this policy.
• Education Officials: Federal, state, and local officials may access records for audits or program evaluation, but they are bound by strict confidentiality rules.

All About 603 CMR 23.00: Student Records Regulations in Massachusetts: Sharing Information with State Agencies and Law Enforcement

Specific rules govern disclosures to government agencies:

• Department of Children and Families (DCF): As mandated reporters, school staff can share record information without consent when reporting suspected child abuse or neglect or cooperating with a DCF investigation.
• Department of Youth Services (DYS): Schools may share records for youth in DYS custody when requested under G.L. c. 119, section 69A or via a court order.
• Police: Beyond reporting crimes or responding to emergencies, sharing student records with police generally requires written consent or a court order/subpoena. The school must attempt to notify the family in advance.
• School Resource Officers (SROs): If the SRO is a school employee, they are considered authorized personnel. If they are employed by an outside police department, they are treated as law enforcement and subject to stricter disclosure rules.

When transferring records to a new school, the complete record, including disciplinary incidents, must be sent. Sensitive health records should be transferred directly from nurse to nurse to maintain confidentiality.

Frequently Asked Questions about 603 CMR 23.00

Here are answers to common questions about All About 603 CMR 23.00: Student Records Regulations in Massachusetts.

Can a school withhold a report card or diploma for unpaid fees?

No. Schools cannot withhold a report card, diploma, or any other part of the student record due to unpaid fees (like for lunches or library books) or unreturned property. The regulations are clear that eligible students and parents have a right to access and receive copies of their records. Schools must use other administrative means to collect outstanding debts.

What happens to student records if a school closes permanently?

The regulations ensure records are preserved. For a private school that closes, records of current students are transferred to their new school. Records of all other students (including alumni) are sent to the Massachusetts Department of Elementary and Secondary Education. For a public school that closes, records are transferred to the school district's central office for continued maintenance under standard retention policies.

Are a teacher's private notes or grade book part of the official student record?

It depends. A teacher's private notes, kept for their own use and not shared with other school personnel, are generally not considered part of the official student record. Parents and students do not have a right to access these private files under 603 CMR 23.00.

However, if information like a grade book is organized by student name and made accessible to other authorized staff (beyond a substitute teacher), it is likely part of the official student record. At that point, it becomes subject to all access and privacy rules. Districts should have clear policies defining what constitutes an official record versus a teacher's personal file.

Conclusion: Upholding Student Privacy in the Digital Age

All About 603 CMR 23.00: Student Records Regulations in Massachusetts provides a vital framework for safeguarding student privacy and empowering families with rights of access, amendment, and control. These regulations are a commitment to protecting the sensitive data of students.

Protecting these records is more complex than ever. Digital student data is a prime target for cyberattacks, and a breach can have devastating consequences. Regulatory compliance must be paired with robust cybersecurity. At CyberNut, we believe a well-informed school community is the first line of defense. Cybersecurity training for K-12 schools, especially on threats like phishing, is essential for building a resilient and secure learning environment.

Protecting student privacy requires a proactive approach. Don't let your school become a statistic.

Are your staff prepared to recognize and deflect the phishing attacks that target student data?Get a complimentary Phishing Audit for your school and strengthen your defenses.

For more insights and tools to secure your educational institution, Explore CyberNut's cybersecurity resources for K-12 schools.