30 Days Gen AI Risk Trial -Start Now
Skip to main content

Compliance decisions

IEPs and student support plans in AI

Do not upload an IEP simply because staff already have access to it. Establish the applicable disclosure authority, then review which fields the task needs. Names, disability details and contextual clues can identify a student; removing the name alone does not make the record anonymous or authorise its disclosure.

For Special-education leads, district privacy teams and education IT

Aona field notesC15
Start from the support task
Need, context and authority

A general classroom resource may not need an individual student’s plan.

All student, school and support details are invented. No disclosure authority, professional assessment or legal de-identification is established.

01

Resolve disclosure authority before field selection

An IEP can contain education-record information and sensitive details about a child and family. FERPA and IDEA confidentiality requirements may both be relevant, alongside state rules. Determine the proposed recipient and legal basis before copying the document into a third-party AI service.

IDEA 34 CFR 300.622 addresses parental consent for disclosure of personally identifiable information, with specified FERPA and participating-agency conditions and additional situations. It does not turn any purchased AI vendor into an authorised recipient. The separate school-official guide examines that particular FERPA route; this page focuses on the input after authority is established.

Source context: US Department of Education: FERPA regulations · US Department of Education: IDEA 300.622 consent

02

Describe the educational task in ordinary language

A request to make general group-work instructions clearer is different from asking a model to revise an individual student’s IEP. The first task may need only a description of the activity and the desired reading level. It may not need a student’s identity, diagnosis, family history or complete support plan.

Write the purpose and intended output before selecting fields. Identify who will check the educational accuracy and suitability of the output. An AI draft is not a professional assessment or a legally adopted plan, and a data-security tool does not validate either.

Source context: US Department of Education: FERPA regulations · US Department of Education: IDEA 300.622 consent

03

Map direct identifiers and contextual clues

FERPA’s personally identifiable information definition includes direct identifiers and other linked or linkable information that can identify a student with reasonable certainty under its stated test. A rare combination of school, year group, support needs and events may remain identifying after a name is removed.

The fictional field map below includes a name, student number, small-class context, disability detail and a functional classroom support. It shows how to question each field rather than replacing every sensitive term with a generic label and declaring the result anonymous.

Source context: US Department of Education: FERPA regulations

04

Prepare the smallest useful input

For the general resource task, use an invented classroom scenario and the functional instruction needed: short steps, a clear sequence or a particular presentation format. Keep the individual plan in its approved source system. If the real task genuinely requires student-specific information, return to the authorised scope and privacy review rather than improvising an exception.

Inspect the complete attachment before release. A selected paragraph may leave names, review dates, comments or previous assessments elsewhere in the file. Check copied outputs too, because they can repeat details or add unsupported inferences about the student.

Source context: US Department of Education: FERPA regulations

05

Keep the plan owner and input-control roles separate

The educator or relevant professional remains responsible for evaluating an educational draft; the institution remains responsible for disclosure and record handling. Record the service, task and permitted fields so staff can follow the decision without repeatedly interpreting the law.

Use synthetic examples to check whether the selected input policy addresses names and contextual disclosure on the actual supported path. A successful test does not establish FERPA or IDEA compliance. Reassess when the task expands from general materials to individual recommendations, or when a new recipient or feature is added.

Source context: US Department of Education: FERPA regulations · US Department of Education: IDEA 300.622 consent

Put it into practice

Synthetic IEP input field map

A fictional teacher wants clearer general group-work instructions. The task is deliberately narrower than preparing or amending an individual IEP.

All student, school and support details are invented. No disclosure authority, professional assessment or legal de-identification is established.

The task needs less than the plan
01

Full invented record

Identity, context, diagnosis and support history

02

Name-only edit

Distinctive school and support details remain

Not established as anonymous.

03

Generic resource input

Short steps and a predictable sequence

The educator still checks the output.

Synthetic IEP input field map
Invented fieldWhy it mattersChoice for the general resource task
Jordan Example; student TEST-IEP-17Direct identifiers for the fictional record.Omit; the generic classroom instructions do not need identity.
Example School, only student in a small support groupContext may make a person identifiable even without a name.Use an invented classroom context without a unique school or group description.
Fictional diagnosis and assessment historySensitive student-specific information not needed for wording the general activity.Keep out of the input for this task.
Needs short written steps and predictable sequenceFunctional presentation requirement relevant to the generic resource.Describe the support generically without linking it to a student.
Parent contact and review meeting dateAdditional identifying and family information.Omit from both the prompt and any attachment.
Generated classroom instructionsMay contain errors or unsupported assumptions.Educator checks the draft before use; this exercise does not amend an IEP.

Work through your review

Use the checks to organise the evidence you need. Your selections stay in this tab.

0 of 3 reviewed

Example files for this task

Keep the source material and the instructions together. You can also download the complete worksheet or matrix as CSV.

iep-ai-input-field-map.mdInspect
# Synthetic IEP input field map

All student, school and support details are invented. No disclosure authority, professional assessment or legal de-identification is established.

A fictional teacher wants clearer general group-work instructions. The task is deliberately narrower than preparing or amending an individual IEP.

| Invented field | Why it matters | Choice for the general resource task |
| --- | --- | --- |
| Jordan Example; student TEST-IEP-17 | Direct identifiers for the fictional record. | Omit; the generic classroom instructions do not need identity. |
| Example School, only student in a small support group | Context may make a person identifiable even without a name. | Use an invented classroom context without a unique school or group description. |
| Fictional diagnosis and assessment history | Sensitive student-specific information not needed for wording the general activity. | Keep out of the input for this task. |
| Needs short written steps and predictable sequence | Functional presentation requirement relevant to the generic resource. | Describe the support generically without linking it to a student. |
| Parent contact and review meeting date | Additional identifying and family information. | Omit from both the prompt and any attachment. |
| Generated classroom instructions | May contain errors or unsupported assumptions. | Educator checks the draft before use; this exercise does not amend an IEP. |

## Review steps

- Confirm the disclosure route: Check applicable FERPA, IDEA and other requirements before selecting any real student fields.
- Use the minimum useful context: Explain why each student-specific detail is needed; prefer invented generic context where it meets the task.
- Inspect input and output: Review the whole file and the generated draft, not just the selected paragraph or visible name.

## Entirely invented source excerpt

Jordan Example, student TEST-IEP-17, attends Example School and is the only student in a small support group. A fictional assessment describes Example Condition. Classroom materials should use short written steps and a predictable sequence. Parent contact and review dates are recorded elsewhere in the invented plan.

## Name-only edit, still problematic

“Student A is the only student in Example School’s small support group and has Example Condition.” Context remains identifying in the fictional scenario.

## Reduced-input alternative

“Create generic group-work instructions using short written steps and a predictable sequence. Use an invented classroom scenario. Do not infer an individual student’s diagnosis or needs.”

No real plan has been uploaded or changed. Observed product result: not run.

## Source and scope

Guide: https://aona.ai/resources/guides/iep-student-data-ai-assistants/

Source check: 21 September 2026. General information, not professional approval or a completed control test.

- US Department of Education: FERPA regulations: https://studentprivacy.ed.gov/ferpa
- US Department of Education: IDEA 300.622 consent: https://sites.ed.gov/idea/regs/b/f/300.622
Download iep-ai-input-field-map.md
iep-ai-input-field-map.csvInspect
Invented field,Why it matters,Choice for the general resource task
Jordan Example; student TEST-IEP-17,Direct identifiers for the fictional record.,Omit; the generic classroom instructions do not need identity.
"Example School, only student in a small support group",Context may make a person identifiable even without a name.,Use an invented classroom context without a unique school or group description.
Fictional diagnosis and assessment history,Sensitive student-specific information not needed for wording the general activity.,Keep out of the input for this task.
Needs short written steps and predictable sequence,Functional presentation requirement relevant to the generic resource.,Describe the support generically without linking it to a student.
Parent contact and review meeting date,Additional identifying and family information.,Omit from both the prompt and any attachment.
Generated classroom instructions,May contain errors or unsupported assumptions.,Educator checks the draft before use; this exercise does not amend an IEP.
Download iep-ai-input-field-map.csv

Before you proceed

Keep these distinctions clear

Access is not onward-disclosure authority
Being allowed to read the IEP does not automatically permit sending it to another service.
Context can identify the student
A unique school, group and condition can defeat a simple name replacement.

Apply it to employee AI use

Bring your actual data path.

Aona can help evaluate sensitive-input policies for supported employee browser and native AI paths.

It does not approve FERPA or IDEA disclosures, create legally valid IEPs or assess a student’s educational needs.

Compare the three invented input versions and record what the selected policy and input path actually do.

Review your use case

FAQ

Questions for this decision

Can staff upload a plan because they already have access?
Not automatically. Access within the school and disclosure to an external AI service are separate questions. Establish the applicable authority and recipient conditions first.
Does replacing the name make an IEP anonymous?
No. Student numbers, school context, rare needs and other linked information can remain identifying. Apply the actual legal and contextual analysis rather than a name-only rule.
Does IDEA require the same consent for every disclosure?
Section 300.622 has specified consent rules, exceptions and additional conditions. Assess the actual recipient and purpose with the institution’s responsible privacy or legal owner.
Can AI output become the student’s final plan?
This guide does not establish that. Educational and legal decision processes remain with the responsible people. The example concerns a generic classroom resource, not adoption or amendment of an IEP.

Evidence behind the guide

Sources and scope

Prepared by Aona. Sources checked 2026-09-21. The cited material supports the specific points below; it does not certify a product or your use case.

  1. US Department of Education: FERPA regulations

    34 CFR 99 definitions, annual notice, school-official exception, legitimate educational interests and use/redisclosure restrictions.

    law · checked 2026-09-21
  2. US Department of Education: IDEA 300.622 consent

    Consent for disclosure of personally identifiable information and the specified FERPA and participating-agency conditions.

    law · checked 2026-09-21
IEPs and student support plans in AI | Aona