Compliance decisions
IEPs and student support plans in AI
Do not upload an IEP simply because staff already have access to it. Establish the applicable disclosure authority, then review which fields the task needs. Names, disability details and contextual clues can identify a student; removing the name alone does not make the record anonymous or authorise its disclosure.
For Special-education leads, district privacy teams and education IT
A general classroom resource may not need an individual student’s plan.
All student, school and support details are invented. No disclosure authority, professional assessment or legal de-identification is established.02
Describe the educational task in ordinary language
A request to make general group-work instructions clearer is different from asking a model to revise an individual student’s IEP. The first task may need only a description of the activity and the desired reading level. It may not need a student’s identity, diagnosis, family history or complete support plan.
Write the purpose and intended output before selecting fields. Identify who will check the educational accuracy and suitability of the output. An AI draft is not a professional assessment or a legally adopted plan, and a data-security tool does not validate either.
Source context: US Department of Education: FERPA regulations · US Department of Education: IDEA 300.622 consent
03
Map direct identifiers and contextual clues
FERPA’s personally identifiable information definition includes direct identifiers and other linked or linkable information that can identify a student with reasonable certainty under its stated test. A rare combination of school, year group, support needs and events may remain identifying after a name is removed.
The fictional field map below includes a name, student number, small-class context, disability detail and a functional classroom support. It shows how to question each field rather than replacing every sensitive term with a generic label and declaring the result anonymous.
Source context: US Department of Education: FERPA regulations
04
Prepare the smallest useful input
For the general resource task, use an invented classroom scenario and the functional instruction needed: short steps, a clear sequence or a particular presentation format. Keep the individual plan in its approved source system. If the real task genuinely requires student-specific information, return to the authorised scope and privacy review rather than improvising an exception.
Inspect the complete attachment before release. A selected paragraph may leave names, review dates, comments or previous assessments elsewhere in the file. Check copied outputs too, because they can repeat details or add unsupported inferences about the student.
Source context: US Department of Education: FERPA regulations
05
Keep the plan owner and input-control roles separate
The educator or relevant professional remains responsible for evaluating an educational draft; the institution remains responsible for disclosure and record handling. Record the service, task and permitted fields so staff can follow the decision without repeatedly interpreting the law.
Use synthetic examples to check whether the selected input policy addresses names and contextual disclosure on the actual supported path. A successful test does not establish FERPA or IDEA compliance. Reassess when the task expands from general materials to individual recommendations, or when a new recipient or feature is added.
Source context: US Department of Education: FERPA regulations · US Department of Education: IDEA 300.622 consent
Put it into practice
Synthetic IEP input field map
A fictional teacher wants clearer general group-work instructions. The task is deliberately narrower than preparing or amending an individual IEP.
All student, school and support details are invented. No disclosure authority, professional assessment or legal de-identification is established.
Full invented record
Identity, context, diagnosis and support history
Name-only edit
Distinctive school and support details remain
Not established as anonymous.
Generic resource input
Short steps and a predictable sequence
The educator still checks the output.
| Invented field | Why it matters | Choice for the general resource task |
|---|---|---|
| Jordan Example; student TEST-IEP-17 | Direct identifiers for the fictional record. | Omit; the generic classroom instructions do not need identity. |
| Example School, only student in a small support group | Context may make a person identifiable even without a name. | Use an invented classroom context without a unique school or group description. |
| Fictional diagnosis and assessment history | Sensitive student-specific information not needed for wording the general activity. | Keep out of the input for this task. |
| Needs short written steps and predictable sequence | Functional presentation requirement relevant to the generic resource. | Describe the support generically without linking it to a student. |
| Parent contact and review meeting date | Additional identifying and family information. | Omit from both the prompt and any attachment. |
| Generated classroom instructions | May contain errors or unsupported assumptions. | Educator checks the draft before use; this exercise does not amend an IEP. |
Work through your review
Use the checks to organise the evidence you need. Your selections stay in this tab.
0 of 3 reviewed
Example files for this task
Keep the source material and the instructions together. You can also download the complete worksheet or matrix as CSV.
iep-ai-input-field-map.mdInspect
# Synthetic IEP input field map
All student, school and support details are invented. No disclosure authority, professional assessment or legal de-identification is established.
A fictional teacher wants clearer general group-work instructions. The task is deliberately narrower than preparing or amending an individual IEP.
| Invented field | Why it matters | Choice for the general resource task |
| --- | --- | --- |
| Jordan Example; student TEST-IEP-17 | Direct identifiers for the fictional record. | Omit; the generic classroom instructions do not need identity. |
| Example School, only student in a small support group | Context may make a person identifiable even without a name. | Use an invented classroom context without a unique school or group description. |
| Fictional diagnosis and assessment history | Sensitive student-specific information not needed for wording the general activity. | Keep out of the input for this task. |
| Needs short written steps and predictable sequence | Functional presentation requirement relevant to the generic resource. | Describe the support generically without linking it to a student. |
| Parent contact and review meeting date | Additional identifying and family information. | Omit from both the prompt and any attachment. |
| Generated classroom instructions | May contain errors or unsupported assumptions. | Educator checks the draft before use; this exercise does not amend an IEP. |
## Review steps
- Confirm the disclosure route: Check applicable FERPA, IDEA and other requirements before selecting any real student fields.
- Use the minimum useful context: Explain why each student-specific detail is needed; prefer invented generic context where it meets the task.
- Inspect input and output: Review the whole file and the generated draft, not just the selected paragraph or visible name.
## Entirely invented source excerpt
Jordan Example, student TEST-IEP-17, attends Example School and is the only student in a small support group. A fictional assessment describes Example Condition. Classroom materials should use short written steps and a predictable sequence. Parent contact and review dates are recorded elsewhere in the invented plan.
## Name-only edit, still problematic
“Student A is the only student in Example School’s small support group and has Example Condition.” Context remains identifying in the fictional scenario.
## Reduced-input alternative
“Create generic group-work instructions using short written steps and a predictable sequence. Use an invented classroom scenario. Do not infer an individual student’s diagnosis or needs.”
No real plan has been uploaded or changed. Observed product result: not run.
## Source and scope
Guide: https://aona.ai/resources/guides/iep-student-data-ai-assistants/
Source check: 21 September 2026. General information, not professional approval or a completed control test.
- US Department of Education: FERPA regulations: https://studentprivacy.ed.gov/ferpa
- US Department of Education: IDEA 300.622 consent: https://sites.ed.gov/idea/regs/b/f/300.622
Download iep-ai-input-field-map.mdiep-ai-input-field-map.csvInspect
Invented field,Why it matters,Choice for the general resource task
Jordan Example; student TEST-IEP-17,Direct identifiers for the fictional record.,Omit; the generic classroom instructions do not need identity.
"Example School, only student in a small support group",Context may make a person identifiable even without a name.,Use an invented classroom context without a unique school or group description.
Fictional diagnosis and assessment history,Sensitive student-specific information not needed for wording the general activity.,Keep out of the input for this task.
Needs short written steps and predictable sequence,Functional presentation requirement relevant to the generic resource.,Describe the support generically without linking it to a student.
Parent contact and review meeting date,Additional identifying and family information.,Omit from both the prompt and any attachment.
Generated classroom instructions,May contain errors or unsupported assumptions.,Educator checks the draft before use; this exercise does not amend an IEP.
Download iep-ai-input-field-map.csvBefore you proceed
Keep these distinctions clear
- Access is not onward-disclosure authority
- Being allowed to read the IEP does not automatically permit sending it to another service.
- Context can identify the student
- A unique school, group and condition can defeat a simple name replacement.
Apply it to employee AI use
Bring your actual data path.
Aona can help evaluate sensitive-input policies for supported employee browser and native AI paths.
It does not approve FERPA or IDEA disclosures, create legally valid IEPs or assess a student’s educational needs.
Compare the three invented input versions and record what the selected policy and input path actually do.
Review your use caseFAQ
Questions for this decision
Can staff upload a plan because they already have access?
Does replacing the name make an IEP anonymous?
Does IDEA require the same consent for every disclosure?
Can AI output become the student’s final plan?
Evidence behind the guide
Sources and scope
Prepared by Aona. Sources checked 2026-09-21. The cited material supports the specific points below; it does not certify a product or your use case.
- US Department of Education: FERPA regulations
34 CFR 99 definitions, annual notice, school-official exception, legitimate educational interests and use/redisclosure restrictions.
law · checked 2026-09-21 - US Department of Education: IDEA 300.622 consent
Consent for disclosure of personally identifiable information and the specified FERPA and participating-agency conditions.
law · checked 2026-09-21