Information may be disclosed if the institution has reason to
believe that a student poses a threat to him- or herself or to
others. FERPA allows the institution to take into account the
totality of the circumstances at the time pertaining to the threat. If
the institution determines that there is significant threat,
it may disclose information to any person whose knowledge of the information
is necessary to protect the health and safety of the student and other
individuals.
FERPA explicitly allows that a contractor, consultant,
volunteer, or other party, to whom an agency or institution
has outsourced institutional services or functions, may be
considered a school official.
The institution may also release information to an organization
conducting a study as long as they have a written agreement with
the organization that specifies the purpose of the study and
any applicable restrictions on disclosure and destruction of
information requirements.
In Addition…