Federal Privacy Laws That Shape What You Can Access
FERPA, HIPAA, DPPA — a plain-language breakdown of the federal laws that carve privacy protections out of the public record system.
Photo: searchopenrecords editorial
—— In This Article
Why Privacy Laws Exist Alongside Transparency Laws
The U.S. public records system is built on a fundamental tension: the public's right to know competes with individuals' right to privacy. Congress has resolved this tension differently depending on the type of information involved. The result is a patchwork of federal statutes — each carving out specific categories of data from the broader landscape of accessible public records.
Understanding these laws isn't just an academic exercise. If you're conducting a background check, searching for genealogy records, or trying to access someone's driving history, federal privacy statutes determine what you can legally obtain — and what is simply off-limits regardless of how you ask. See our overview of federal vs. state records frameworks for context on how these layers interact.
FERPA
The Family Educational Rights and Privacy Act, a 1974 federal law that protects the privacy of student education records held by federally funded schools and universities.
HIPAA
The Health Insurance Portability and Accountability Act, which establishes national standards for protecting individually identifiable health information held by covered healthcare entities.
DPPA
The Driver's Privacy Protection Act, a federal law that limits who may access personal information from state motor vehicle records and for what purposes.
Permissible Purpose
A legally recognized reason that justifies access to otherwise protected records. Under the DPPA, for example, only specific uses — such as law enforcement or insurance underwriting — qualify as permissible purposes.
De-identified Data
Information that has been stripped of all personal identifiers, such that it cannot reasonably be used to identify a specific individual. HIPAA allows more flexible use of de-identified health data.
FOIA Exemption 6
A provision within the Freedom of Information Act that shields personnel, medical, and similar files from disclosure when release would constitute a clearly unwarranted invasion of personal privacy.
The Major Federal Privacy Statutes at a Glance
Three federal laws come up most frequently when public records access runs into a privacy wall. Each targets a distinct domain of personal information.
| FERPA Enacted | 1974 (U.S. Department of Education) |
| HIPAA Enacted | 1996 (U.S. Department of Health & Human Services) |
| DPPA Enacted | 1994 (U.S. Department of Justice) |
| FOIA Privacy Exemptions | 3 of 9 exemptions touch privacy (5 U.S.C. § 552) |
| Privacy Act Scope | Federal agencies only (5 U.S.C. § 552a) |
| DPPA Permissible Uses | 14 defined categories (18 U.S.C. § 2721) |
FERPA: Education Records
The Family Educational Rights and Privacy Act (FERPA), enacted in 1974, restricts access to students' educational records held by institutions that receive federal funding — which covers virtually every U.S. public school and university. Parents of minor students, and students themselves once they turn 18, control who sees those records. Third parties — including employers, members of the public, and most government agencies — cannot obtain transcripts, grades, disciplinary records, or other personally identifiable education information without written consent. Limited exceptions apply for court orders, school safety threats, and certain auditing functions.
HIPAA: Health Information
The Health Insurance Portability and Accountability Act (HIPAA) protects individually identifiable health information held by covered entities — hospitals, insurers, clinics, and their business associates. Medical records, diagnoses, and treatment histories are not public records under any standard interpretation of HIPAA. Even death records, which are generally public, do not include the underlying clinical detail. Researchers and public health agencies may access de-identified data under specific protocols, but that information cannot be traced back to individuals.
DPPA: Driver and Vehicle Information
The Driver's Privacy Protection Act (DPPA) restricts access to personal information contained in state motor vehicle records — including names, addresses, phone numbers, and photographs tied to driver's licenses and vehicle registrations. State DMVs may only release this data for a defined list of permissible uses: law enforcement, court proceedings, vehicle safety recalls, insurance underwriting, and licensed private investigation, among others. General curiosity is not a permissible purpose. This law directly affects what you can and cannot find online when searching by license plate or VIN.
How These Laws Interact With FOIA and the Privacy Act
The Freedom of Information Act (FOIA) gives the public a right to request federal agency records, but it includes nine exemptions — and Exemption 6 specifically shields personnel, medical, and similar files whose disclosure would constitute a clearly unwarranted invasion of personal privacy. FERPA- and HIPAA-protected records that happen to be held by a federal agency would still be protected under FOIA's exemption framework. See our plain-language FOIA explainer for how this process works in practice.
The federal Privacy Act of 1974 adds another layer: it governs how federal agencies collect, maintain, and disclose records about individuals stored in their systems. Agencies generally cannot disclose those records without the individual's consent, subject to 12 statutory exceptions. The Privacy Act's role in limiting public records access is an important counterweight to FOIA's transparency mandate.
Together, these statutes mean that even a valid FOIA request can be lawfully denied when the responsive records fall into a protected category. The balance between public interest and personal privacy is ultimately drawn case by case, often by agency staff and — when disputed — by federal courts.
This article provides general legal information for educational purposes only and is not a substitute for advice from a licensed attorney about your specific situation.
Public Records 101 Editorial Team
Public Records 101 Editorial Team is the collective byline for our editorial team and contributor network. Articles published under this byline or an editorial pen name are researched, written, and reviewed according to our editorial standards for clarity, consistency, and independence before publication.
View author profile