Confidentiality, Legal Requirements, and Digital Record-Keeping

Why Confidentiality Matters in Early Childhood Assessment

Every time you observe a child, complete a developmental checklist, or photograph a child's work, you are creating a record. That record contains sensitive information about a real child and family. Protecting it is not optional — it is a legal and ethical obligation. Two major frameworks govern how you handle these records: the Family Educational Rights and Privacy Act (FERPA) and your state's child-care licensing regulations. Understanding both is essential for anyone working in a preschool setting.

FERPA in Early Childhood Settings

FERPA is a federal law that protects the privacy of student education records. It applies to any school or program that receives federal funding, which includes many Head Start programs, publicly funded pre-K programs, and school-district preschools. When FERPA applies, parents and legal guardians have the right to inspect and review their child's education records, request corrections to records they believe are inaccurate, and control the disclosure of those records to outside parties.

Under FERPA, an "education record" is broadly defined. It includes written observations, developmental checklists, assessment portfolios, photographs used for instructional purposes, videos, and digital files linked to an identifiable child. If a record contains information directly related to a child and is maintained by the program, it is likely an education record.

FERPA generally requires written consent from a parent or guardian before you share a child's education record with anyone outside the program. There are narrow exceptions — for example, records may be shared without consent with other school officials who have a legitimate educational interest, or in genuine health and safety emergencies. Routine sharing — such as sending a developmental checklist to a speech therapist at a different agency — requires written parental consent first.

Not every early childhood program is covered by FERPA. Private preschools that do not receive federal funding may fall outside its scope. However, those programs are still bound by state licensing confidentiality rules and by professional ethics. Treat any program's child records as confidential regardless of which specific law applies.

What May and May Not Be Shared

A practical rule: before sharing any information that identifies a child, ask yourself two questions. First, is sharing this information in the child's educational or safety interest? Second, do I have written consent from the parent or guardian, or does a legal exception clearly apply?

Sharing a child's portfolio photo on social media is prohibited without explicit written consent — and even with consent, most program policies ban it entirely because photos can spread beyond the original audience. Emailing a developmental checklist to a speech therapist at an outside clinic requires written consent before the email is sent. Discussing a child's progress with the child's own classroom co-teacher who works with that child daily is generally allowed because that co-teacher has a legitimate educational interest.

Physical records — paper checklists, printed portfolios, signed consent forms — must be stored in locked cabinets accessible only to authorized staff. Never leave paper records on a desk where other families or volunteers can see them.

Digital Record-Keeping: Safe Practices

Digital records carry the same legal weight as paper records and introduce additional risks because they can be copied, forwarded, or accessed remotely. Follow these practices every time you create or manage digital child records.

Password protection: Any device or folder containing child records must be password-protected. Use strong, unique passwords — not the child's name or your own name. Programs typically assign shared staff accounts for record-keeping software; never use a personal account.

Folder structure and access control: Organize digital records in a clear folder structure (for example, a top-level folder for the classroom, sub-folders by child's last name or ID number). Set folder permissions so that only authorized users can open them. On shared school computers, log out completely after every session.

No personal devices without policy approval: Avoid photographing or storing child records on personal smartphones or tablets unless your program has a written policy explicitly permitting it and specifying how those images must be transferred and deleted.

Secure transmission: Never send child records through personal email or unsecured messaging apps. Use the program's approved, encrypted communication system. If your program does not have one, consult your director before transmitting any records electronically.

Retention and disposal: Programs set retention schedules for records. When a record is no longer needed, paper records must be shredded; digital files must be permanently deleted using the program's approved method — simply moving a file to the Recycle Bin and emptying it may not be sufficient on shared drives.

Volunteers, Families, and Social Media

Volunteers present a specific risk because they are not employees and may not realize that confidentiality rules apply to them. Before a volunteer enters the classroom, they should receive a confidentiality orientation and sign an agreement. That agreement should make clear that they may not photograph children, share children's names or details outside the program, or discuss what they observe in the classroom with anyone not authorized to know.

Social media is never an appropriate channel for child assessment information or identifiable photos, even if a parent has given general photo consent. A consent form for a printed newsletter does not automatically extend to a public Instagram post. When in doubt, do not post.

Connecting to Your Credentials

Both the CDA credential and state child-care licensing require you to demonstrate competence in protecting families' privacy and maintaining professional ethics. Licensing inspectors may review your program's record-keeping practices, and CDA advisors assess your understanding of family confidentiality. The habits you build now — locked cabinets, password-protected folders, written consent before sharing — will serve you throughout your career.