Policy Brief: FERPA, Athlete Data & Institutional Compliance Considerations

October 14, 2025

Disclaimer: The information provided in this post is for general informational purposes only and does not constitute legal advice or create an attorney–client relationship. Readers should not act or refrain from acting on the basis of this information without seeking appropriate legal or other professional advice based on the particular facts and circumstances at issue.

Executive Summary

With the increasing use of wearables, biometric tracking, and performance monitoring in collegiate athletics, compliance officers must reassess the scope and application of FERPA. Institutions are exposing themselves to legal, ethical, and reputational risk when handling athlete data without clear boundaries between FERPA, HIPAA, and third-party vendors.

Regulatory Foundations

Law	Coverage Area	Applies to
FERPA	Educational records (grades, disciplinary, some health records)	Schools/Universities
HIPAA	Protected Health Information (PHI)	Health providers
State Laws	Data privacy, biometric data, informed consent	Varies by state

Considerations

1. Clarify Data Ownership & Custodianship

• Check third-party contracts and applicable laws to determine who owns athlete performance data. Standardize ownership where possible.

• Determine if athlete performance data is managed by educational records officers, medical staff, athletic department staff, external tech partners, or others.

• If a third-party vendor (e.g., wearable provider) collects the data, FERPA may not apply, and data may lack regulatory protection.

• Implement a program to manage athlete data rights.

  
  

2. Consent Must Be Informed & Voluntary

• FERPA allows some disclosures with student consent, but often this is coerced as a condition of participation.

• Compliance officers should review all waiver forms for fairness, language clarity, and legality.

  
  

3. Limit Data Sharing

• Avoid broad sharing of data across coaches, trainers, administrators, and third parties.

• Ensure access controls are aligned with legitimate educational interest.

  
  

4. Review Contracts with Tech & Data Vendors

• Require all vendors handling performance data to comply with FERPA-equivalent standards.

• Include data ownership clauses and limits on secondary use or sale of data.

  
  

5. Educate Staff on Dual Compliance

• Trainers and team doctors may fall under both HIPAA and FERPA.

• Provide regular and at least annual training on how to classify and share student-athlete data legally.

• Update trainings based on new practices and internal policies and procedures related to athlete performance data.

Common Pitfalls to Avoid

Pitfall	Impact
Using performance data to justify scholarship cuts without due process	FERPA violation & potential legal action
Releasing athlete health info to media or donors in violation of regulatory requirements	Breach of confidentiality
Coercing athletes into signing or agreeing to biometric tracking waivers	Violation of ethical standards & state privacy laws

Action Checklist

• Audit all wearable tech and performance data systems.

• Review consent forms for FERPA, HIPAA and other privacy law alignment.

• Establish data governance policies specific to athletics.

• Implement vendor vetting processes for compliance compatibility.

• Manage athlete data with best practices and update regularly.

• Design incident response plan for data misuse or breaches.

Conclusion

Athlete data is not just a performance asset—it is protected personal information. Compliance officers must lead in creating frameworks that honor both competitive needs and student rights under FERPA, HIPAA and other privacy laws.