Skip Navigation Links

NASP Communiqué Vol. 30 #1
September 2001

Test Protocols, Part II: Storage and Disposal

By Andrea Canter, NCSP

Procedures governing the periodic destruction of outdated or no longer useful information do not exist in most systems. Moreover, the cumulative nature of most record-keeping systems makes a fresh start difficult or impossible for most pupils. ­Russell Sage Foundation, 1970

In 1969, the Russell Sage Foundation convened a conference on the legal and ethical aspects of school record keeping, identifying many abuses that led to such policies as the Family Education Rights and Privacy Act (FERPA). Among the problems identified by conference participants were the lack of parent notice as to what pupil records were maintained by the school, where such records were located and what procedures, if any, were established for the destruction of outdated records. With the implementation of laws and regulations for students with disabilities, the nature of materials defined as "school records" grew considerably beyond registration, attendance and group test data to include an ever-expanding variety of medical, educational and psychological evaluation and treatment records, including comprehensive assessment and reassessment data, Individual Education Plans and conference notes.

For any given student with a disability, the Special Education record alone can account for several inches of paper space in a Due Process file, expanding each year that the student is enrolled and receiving Special Education services. For students identified for special education services at age five or six, it is conceivable that the Due Process record will include data from at least four evaluations, twelve IEPs and dozens of team conferences; for students with significant medical conditions, add to that file at least annual reports from physicians and other specialists and perhaps another thick file of school health records documenting medications, surgeries, etc. Does the student have significant behavior challenges? Add to the record numerous behavior plans, manifestation determination records and perhaps suspension records.

There is no doubt that the special education system - regardless of location - generates considerable documentation for every child with a disability, as well as for those suspected of having a disability. This accumulation presents a number of challenges for school personnel, from the clerical staff charged with filing and retrieving records, to the administrators responsible for adhering to regulations and district policies, to the practitioners who may face conflicts between ethical standards and administrative directives.

Record-keeping dilemmas pose significant concerns for school psychologists. On the one hand, we are committed to insuring compliance with our principles of ethics that call for assuring authorized use of our data, safeguarding confidential material and protecting test security (NASP, 2000a; Canter, 2001). Further, we are committed to practices that are in the best interest of students and protect their due process rights. On the other hand, we are expected to adhere to state and local policies and regulations governing the storage and disposal of records, including psychological records. Such policies and practices at the state and district level  are typically guided more by convenience and economics than by legal mandate.

This article summarizes legal and ethical foundations for policies addressing storage and disposal of school records, including records of school psychological services and, particularly, test protocols; reviews reported practices and specific examples of local policies and practice; and suggests "best practice" guidelines. As is true in developing policies regarding access to and copying records including protocols, the reader is cautioned to consider state and local regulations that can vary considerably across jurisdictions (see Canter, 2001).

Legal Foundations for School Records Policies

Q. Are there federal mandates regarding the storage and disposal of educational records?

  • Yes. But these policies are very general and open to considerable interpretation by state and local agencies.


FERPA defines "educational records" as records maintained by the schools (or their agent) pertaining to the individual student (34 CFR §99.3). IDEA ’97 essentially reiterates the definition of "educational record" under FERPA (§300.560(b). Although at times some psychologists and administrators may claim that test protocols are "personal notes," a number of federal policy documents, as well as at least one court ruling, have defined protocols as "educational records" and therefore subject to any regulation of such records (see Jacob-Timm & Hartshorne, 1998). FERPA further excludes professional "notes" from this definition of school records, while courts have ruled that raw test data and test protocols are not "private notes" and thus not subject to this exclusion (Canter, 2001; Jacob-Timm & Hartshorne, 1998).

"Destruction" of records is defined by IDEA ’97 regulations as "physical destruction or removal of personal identifiers from the information so that the information is no longer personally identifiable" (§300.560(a)).

Mandates regarding record-keeping

Both FERPA and IDEA ’97 mandate that each school agency establish policies regarding storage, retrieval and disposal of educational records. FERPA guarantees that parents (or students age eighteen or older) have access to school records and that they receive annual notice of their rights to inspect, review and request amendments of school records (34 CFR§99.7); on request, parents must be provided copies of district policies and procedures for reviewing and amending records, including a list of types and locations of all educational records (34 CFR §99.6 and IDEA ’97 regulation§300.565). However, neither FERPA nor IDEA provides specific guidance as to the nature of these policies - records must be "accessible" while their storage must also guarantee confidentiality.

Destruction of records

Parent access to student educational records is based on multiple due process safeguards, not the least of which is the parent’s right to challenge the information and request an amendment if information is inaccurate, misleading or out-of-date. If records are not available, or have been destroyed, the parent’s right to challenge the information is compromised; at the same time, the school district’s ability to document its services and decisions is severely limited.

While neither FERPA nor IDEA explicitly address policies and procedures for destroying school records, including protocols, interpretative guidance has been offered by the Office of Special Education Programs (OSEP) and the Office of Civil Rights (OCR) through policy memos. OSEP, for example, has stated unequivocally that parents have the right to review test protocols and test questions (see Canter, 2001). This ruling has prompted some districts and some practitioners to destroy raw data and protocols once reports are completed. Further, some state policies and district counsel have maintained that, once a report is written, that report becomes the educational record and the protocol may be destroyed in accordance with district policy (Desrochers, 1998).

However, OCR criticized this practice in ruling against an Illinois school district with such a policy: In a 1990 complaint investigation, OCR noted that test protocols were crucial documentation of assessment results and conclusions of the district school psychologist; when parents disputed the assessment results and subsequent recommendations, they were denied access to this information because the district had destroyed the test protocols upon completion of the assessment report. OCR ruled that such destruction of records violated Section 504, effectively denying parents access to relevant records (Reschly & Bersoff, 1999). Further, common sense and child advocacy should call this practice into question, regardless of policy:

"Slick ways to get around legal requirements such as destroying test protocols undermine the intent of the regulations and may place the educational agency at great risk for large legal fees. Moreover, it is hard to see how such destruction of records represents anyone’s conception of best professional practices." (Reschly & Bersoff, 1999, p. 1086)

Timelines for data storage

How long should test protocols be maintained in student records? Implied in both FERPA and IDEA is the notion that, at some point, data contained in school records may become out-of-date and no longer useful, and that disposal of such records is legitimate as long as parents are informed as to what will be destroyed, how and why (IDEA, §300.573 (a)). FERPA further mandates that records cannot be destroyed if there is an outstanding request to review them (34 CFR §99.10-11); IDEA requires that records be destroyed at parent request (§300.573(b)).

Given the OCR ruling cited above, when is it "safe" to destroy records? IDEA notes that information can be destroyed, with parent notification, when "no longer needed to provide educational services to the child." Common sense might suggest that data collected for special education eligibility and IEP planning become obsolete once the next reevaluation takes place, as that information replaces the initial data as the foundation for continuing services and developing the IEP.  Are assessment and treatment data subject to legal challenge beyond the three-year reevaluation cycle? As noted below, many districts adhere to their legal counsel recommendations that student records, including test protocols, be maintained for at least five years beyond that student’s discharge from special education or graduation/transfer from the school system.

A search for any statuatory or interpretative guidance at the federal level yielded one document, a 1990 OSEP letter to Breecher citing 34 CFR §76.730 and §76.731, noting that "local education agencies must retain (1) records to show compliance with EHA-B requirements; (2) records to show how EHA-B funds are used; and (3) other records to facilitate an effective audit. These records must be retained for a minimum period of five years following completion of the activity for which the grant or subgrant was used" (cited by Minnesota Department of Children, Families and Learning policy memo, 1996).  However, more than a decade has passed since the above "clarifications" were issued by OSEP and OCR, with no new set of standards provided at the federal level. Rather, beyond the provisions of FERPA and IDEA, states and local agencies are expected to set their own policies regarding timelines in formal "record retention policies" (Lombard, Minnesota Department of Children, Families and Learning; personal communication, 2001).

States may have their own regulations that help define the longevity of specific records. For example, North Carolina law obligates parents to file for due process within 60 days of an LEA decision and that parents receive clear and full notice of this timeline, which was upheld by the 4th U.S. Circuit Court of Appeals (CM by JM and EM v. Board of Education of Henderson County, 34 IDELR ¶57, 4th Cir. 2001). Destruction of test data after 60 days would likely be within the law in North Carolina.

Same timeline for all records? A further issue is the definition of a school record - while protocols are generally included in definitions of school records, are all documents so defined of equal value over time? Does a protocol have the same historical value to a student record as the assessment report and eligibility documentation, or the IEP itself? While it is clearly prudent to maintain records of services throughout a student’s school career, is it really necessary to retain raw data or test protocols beyond some reasonable limit of their validity and usefulness?

Location of educational records and protocols

While records clearly need to be stored in a manner that allows proper and timely access as well as protecting confidentiality, federal regulations do not limit how or where such records are maintained, nor do regulations limit the number of locations housing school records for an individual student. Districts are obligated under both FERPA and IDEA to inform parents as to the locations of all educational records.

Professional Standards

  • Q. Do standards for professional ethics and service delivery address storage and disposal of test protocols and related records?

  • A. Yes. NASP and APA standards tend to reiterate vague requirements stated in law, emphasizing confidentiality of information. APA policy guidelines, however, offer explicit recommendations regarding timelines for record retention.

Professional standards regarding record keeping require adherence to state and federal law as the basis of ethical conduct. In its 1997 revision, the National Association of School Psychologists’ Standards for the Provision of School Psychological Services provided the following guidance, clearly based on FERPA:

"School psychological records are systematically reviewed, and when necessary, purged, in keeping with relevant state and federal laws in order to protect children from decisions based on incorrect, misleading or out-of-date information" (Principle 3.6.6, NASP 1997).

However, the most recent revision (NASP, 2000b) provides less specific direction, stating only:

 "The school psychological services unit’s policy on student records is consistent with state and federal rules and laws and ensures the protection of the confidentiality of the student... The policy specifies the types of data developed by the school psychologist that are classified as school or pupil records... " (Unit Guideline 4.4). 

Additional but vague guidance is also provided in NASP’s revised Principles for Professional Ethics (NASP, 2000a), which notes that "school psychologists comply with all laws, regulations and policies pertaining to the adequate storage and disposal of records to maintain appropriate confidentiality of information" (Principle IV-D-5).

The American Psychological Association offers similar guidelines in its Principles of Ethics (APA, 1992):

1.24. "Records and Data. Psychologists create, maintain, disseminate, store, retain, and dispose of records and data relating to their research, practice, and other work in accordance with law and in a manner that permits compliance with the requirements of this Ethics Code."

5.04. "Maintenance of Records. Psychologists maintain appropriate confidentiality in creating, storing, accessing, transferring, and disposing of records under their control, whether these are written, automated, or in any other medium. Psychologists maintain and dispose of records in accordance with law and in a manner that permits compliance with the requirements of this Ethics Code."

However, APA’s Ethics offers some guidance regarding retention of outdated records that could help establish criteria for disposal:

2.07. "Obsolete Tests and Outdated Test Results. (a)Psychologists do not base their assessment or intervention decisions or recommendations on data or test results that are outdated for the current purpose."

5.10. "Ownership of Records and Data. Recognizing that ownership of records and data is governed by legal principles, psychologists take reasonable and lawful steps so that records and data remain available to the extent needed to serve the best interests of patients, individual or organizational clients, research participants, or appropriate others."

Finally, in a set of  "Record Keeping Guidelines," APA (1993) provided specific recommendations regarding timelines for storage of psychological records, and opened the door to develop policies that might set different timelines for different types of records:

"Retention of Records: The psychologist is aware of relevant federal, state and local laws and regulations governing records retention. Such laws and regulations supersede the requirements of these guidelines. In the absence of such laws and regulations, complete records are maintained for a minimum of 3 years after the last contact with the client. Records, or a summary, are then maintained for an additional 12 years before disposal. If the client is a minor, the record period is extended until 3 years after the age of majority. All records, active and inactive, are maintained safely, with properly limited access, and from which timely retrieval is possible" (p.984). (emphasis added)

Reported School District Practices

  • Q. In practice, are district policies regarding storage and disposal of records consistent?
  • A. Definitely not.

Information gathered from an informal survey of NASP’s state leaders in spring 2001 revealed a wide range of policies and practices regarding storage and disposal of test protocols.  Some respondents indicated that they were not aware of a formal policy at the district or state level. The following information should be considered to reflect individual district practices which may not be consistent with typical practices in that state, and is presented only for the purpose of illustrating the range of practice:

  • Massachusetts: At least one district’s policy is to shred test protocols after the evaluation is completed. However, state regulations define protocols as "personal records" if maintained only in the school psychologist’s own files and not released to any third party other than the parent. This would appear to be in direct contradiction to past rulings by OCR and OSEP that define protocols as "educational records."  Where protocols are contained in student files, Massachusetts considers them "temporary records;" as part of documentation supporting special education records, such protocols are to be retained for seven years (Massachusetts Department of Education, 1995; 603 CMR 10.21(9)).

  • Wisconsin: In Wisconsin, the protocol is considered part of the student’s education record if it identifies the student, thus falling under the definition of a " Behavioral record" under state law. For auditing purposes, special education records (including protocols) are to be kept for five years after the student leaves the school system (Wydeven, personal communication).

  • Florida: In one of Florida’s largest school districts, local policy calls for maintaining all student records, including test protocols, for five years after the student would be "reasonably" expected to graduate; such files are maintained in a confidential "central files" area (Leighton, personal communication).

  • Ohio: In a large urban Ohio district, records contain protocols and other materials from the most recent evaluation, while copies of all evaluation reports of a student with a disability are maintained "indefinitely;" for students assessed but not found to have a disability, such records are maintained for five years (Forcade, personal communication).

  • Iowa: Iowa’s largest Area Education Agency reports that its protocols are contained in special education files housed in a central location, not in schools. Records are destroyed after students graduate, and this destruction (shredding and recycling paper) is advertised (Boyle, personal communication).

  • North Carolina: One district reports variable timelines for destruction of records, with most information purged after five years (Flagler, personal communication). As noted above, North Carolina limits parents’ challenges of due process to sixty days.

Going Out on a Limb: Practice Guidelines

In the absence of specific regulation and in the presence of vague professional standards, the following are offered as guidelines for individuals and service units seeking to establish logical, legal and ethical procedures for the storage and disposal of school records, with particular attention to test protocols. Readers are cautioned that 1) these recommendations are offered by the author and are not official association guidelines; 2) individual states and/or districts may have existing regulations or policies that contradict (and supersede) these recommendations. In the absence of a local policy, these recommendations will hopefully help in establishing practice and guidelines. Where cumbersome or clearly inappropriate policy or practice exists, these recommendations will hopefully serve as a starting point for revising standards and practices.

Storage of Test Protocols and Other Psychological Records

A guiding principle for developing policies regarding the storage of records should be to balance students’ rights to due process and confidentiality with efficient and appropriate retrieval of relevant information. There are multiple means of achieving this end, and the size and organization of the school district will determine the most appropriate plan. It is not necessary (or even desirable) to maintain all school records in one location, but it is necessary that the location of all school records is disclosed to parents.

Where should psychologists’ records be kept? Commonly, student "cumulative" or registration records are housed in school offices for easy access by clerical and professional staff. More protections should be given to special education, health, psychological and other records containing confidential information.  Some districts will maintain all such records together in one file location - a single file may contain the IEPs, team assessment reports, health records and test protocols from all team members. However, this is not a recommended practice, as issues of confidentiality and test security are not constant across information sources. Further, test protocols are probably the most misused, misinterpreted and most rapidly outdated sets of information in a student’s file and require more stringent control than do reports and instructional plans. It is therefore recommended that psychological test protocols in particular be housed separately from other educational records to safeguard confidentiality and test security, and to limit direct, unsupervised access to individuals trained in interpreting this information.

Who should oversee storage of psychologists’ records? Ethical standards clearly call for school psychologists to assume responsibility for assuring confidentiality of records and test security. If the individual school psychologist is not directly responsible for storage of his or her records, then the service unit should assure proper storage and access by training assigned clerical staff and developing policies with appropriate facility officials. Note that these responsibilities apply equally to paper and electronic records.

Guidelines, Storage of Psychological Records:

  • Test protocols and other forms of raw data that identify a student should be stored and maintained under the direct control of either the relevant school psychologist or the administrator/supervisor of the Psychological Services Unit. It is recommended that test protocols and other forms of raw data be maintained separately from other due process records, such as IEPs.

  • Test protocols, other forms of raw data and all reports of psychological services should be stored in a manner that insures student confidentiality and test security, protects against inappropriate access and release of information, and allows for efficient retrieval of data in appropriate situations.

  • Non-school psychologists with responsibility for overseeing the storage and retrieval of psychological services records, including protocols, should receive sufficient training in test security, confidentiality and release of records to allow for legally and ethically responsible maintenance of records.

  • The location of all student records, including psychological reports and protocols, must be reported to district administration and parents. Procedures for accessing their child’s school records, and for challenging the accuracy of information, should be communicated to parents annually.

  • The district should develop timelines for storage of different types of school records and establish a plan to notify parents and relevant professionals when records are to be destroyed.

Disposal of Test Protocols and Other Psychological Records

The most common practice among school districts appears to be maintaining all student records well past graduation or termination of enrollment. Unless there are regulations that specifically address timelines for challenges to these records, maintaining "outdated" assessment data seems both inefficient and potentially harmful to the student. Much of the weight of a student’s due process file is due to the abundance of thick protocols, leading to expensive, environmentally unsound storage solutions. Electronic storage (on CD, tape, microfilm) solves some of the physical concerns but can be expensive and subjects the records to an entirely new array of potential hazards, including system crashes, hacker access and ethical dilemmas (e.g., Harvey & Kruger, 1998; Jacob-Timm & Hartshorne, 1998).

Simply, we should only maintain raw data and protocols as long as they are useful and legally subject to challenge. Beyond any statute of limitations on the rights to challenge this information, test protocols and similar data should be destroyed, with proper notice to both parent and the creator of the record, when their value to serving the student is clearly passed. When are such data "out of date" and of "no value to serving the student?" If the district’s policy includes advance notification to the school psychologist who gathered the data, the school psychologist can determine the probability that past evaluation data will be needed in making decisions or addressing complaints. While any formal statute of limitations will help us determine if future legal action pertaining to specific data is possible, understanding of the student’s current program will also help us determine if "old" data are likely to provide any assistance to future instructional planning. In systems where test protocols are maintained separately from other school records, such file maintenance and "clean up" will be much easier to implement.

In contrast to policies regarding raw data and protocols, reports or summaries of assessment results should be maintained as long as records of student services are kept. The prevailing practice of maintaining such records for a period beyond graduation or enrollment appears to serve districts well, given varying statues of limitations and the potential usefulness of certain records, such as IEPs, in supporting enrollment in adult services and post-secondary education programs. As in the case of test protocols, however, it would be wise for school districts to periodically review student files and remove any materials defined as "out of date" and not critical to documenting due process or student progress.

Guidelines: Disposal of Psychological Records and Protocols:

  • Test protocols and other raw data from psychological services should be maintained in appropriate student records at least until the completion of the next reevaluation or until the date required by state law. Within legal time limits, raw data and test protocols should be destroyed only after a determination that the information is no longer necessary to support the student’s instructional program and placement. Parents and the school psychologist should be notified in advance of the district’s intent to destroy such records. This guideline applies to test data in hard copy or electronic format.

  • Reports and summaries of psychological services should be maintained in appropriate school records following the timeline for all other due process records. It is recommended that these summary records of special education services be maintained until at least five years beyond the date of the student’s graduation or last day of enrollment, or until the date required by state law.

  • School psychologists adhere to relevant ethical and practice standards in the use and interpretation of all test data, and insure that current services are not based on outdated information.


American Psychological Association (1992). Ethical principles of psychologists. Washington, DC: Author.

American Psychological Association (1993). Record keeping guidelines. American Psychologist, 48 (9), 984-986.

Canter, A. (2001). Test protocols, part I: Right to review and copy. Communiqué, 29 (7), 30.

Desrochers, J. (1998). Ethics and professional practices committee: Test protocols disposition. The Connecticut School Psychologist, Spring 1998, 3-4.

Harvey, V. & Kruger, L. (1998, March). Computer mediated consultation: Ethical issues and guidelines. Communiqué, 26 (6), 6, 12.

Jacob-Timm, S. & Harsthorne, T. S. (1998). Ethics and law for school psychologists (third edition). New York: Wiley.

Minnesota Department of Children, Families and Learning (1996). Test protocols: Access and storage (policy memo). St. Paul: Author.

National Association of School Psychologists (1997). Principles for professional ethics (revised). Bethesda, MD: Author.

National Association of School Psychologists (2000a). Principles for professional ethics (revised). Bethesda, MD: Author (available online at www.nasponline.org).

National Association of School Psychologists (2000b). Guidelines for the provision of school psychological services (revised). Bethesda, MD: Author. (available online at www.nasponline.org).

Reschly, D.J. & Bersoff, D. N. (1999). Law and school psychology. In C.R. Reynolds & T.B. Gutkin (Eds.), Handbook of school psychology (3rd edition) (pp. 1077-1112). New York: Wiley.

Russell Sage Foundation (1970). Guidelines for the collection, maintenance and dissemination of pupil records.  New York: Author.

Andrea Canter, Ph.D., NCSP, is the Editor of the Communiqué, NASP Special Projects consultant and part-time supervisor and mentor with the Minneapolis Public chools.

Thanks to the following individuals for their assistance in preparing this article: Tom Fagan, Michael Forcade, Fred Grossman, Tom Lombard, John Desrochers, Perry Zirkel, Susan Jacob-Timm and respondents on the NASP Leadership Listserv. Part I regarding access and copying of test protocols appeared in the June 2001 issue.