How to Sue a District of Columbia School for FERPA and Student Medical Privacy Violations

Discovering that an administrator at a public, charter, or independent school in Capitol Hill, Cleveland Park, or Columbia Heights emailed your child's confidential psychological evaluation to unauthorized staff, handed over your protected home address to an abusive ex-spouse barred by a court order, or exposed your child's Social Security number and IEP files in a third-party software hack is a profound violation of trust. Parents naturally assume they can immediately file a federal lawsuit for money damages under the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g).

However, a critical legal trap awaits unprepared families: in Gonzaga University v. Doe, 536 U.S. 273 (US Supreme Court 2002), the U.S. Supreme Court ruled that FERPA does not grant parents or students a private right to sue a school for financial damages in court, leaving federal FERPA enforcement strictly to administrative complaints with the U.S. Department of Education. Fortunately, residents of Washington, D.C. possess powerful local statutory and common-law weapons that bypass the federal FERPA roadblock. By leveraging the District of Columbia Mental Health Information Act (D.C. Code § 7-1201.01), local invasion-of-privacy torts under Vassiliades v. Garfinckel's, Brooks Brothers, Miller & Rhoades, Inc., 492 A.2d 580 (DC Court of Appeals 1985), private school tuition contract claims, and the D.C. Consumer Protection Procedures Act (D.C. Code § 28-3904) against commercial EdTech vendors, D.C. families can sue directly in court for statutory damages, emotional distress, and mandatory attorney fees.

Step-by-Step Process in the District of Columbia

Whether the privacy breach occurred at a District of Columbia Public Schools (DCPS) campus, a public charter school, or a private independent school in Northwest D.C., taking legal action requires a coordinated administrative and judicial strategy.

Step 1: Demanding the Student Record Access Log and Preserving Evidence

Under 34 C.F.R. § 99.32 and D.C. municipal student record rules at 5-E D.C.M.R. § 2600, every public and charter school in the District is legally required to maintain a written or electronic record of each request for access to and each disclosure of personally identifiable information (PII) from a student's education records. Submit a formal written demand to the school principal and registrar to inspect your child's complete cumulative file, special education SEDS audit trail, and disclosure log, while saving all leaked emails, screenshots, data breach notification letters, and custody orders onfile with the school.

Step 2: Serving a Mandatory 6-Month Notice of Claim for DCPS Lawsuits

If your claim seeks monetary damages in civil court against a traditional D.C. public school (District of Columbia Public Schools, Office of the General Counsel, Washington) for invasion of privacy, negligence, or violations of the D.C. Mental Health Information Act, you must strictly comply with D.C. Code § 12-309. Under this statute, no tort or unliquidated damages lawsuit can be maintained against the District of Columbia unless the parent or adult student serves written notice of the approximate time, place, cause, and circumstances of the injury upon the Mayor within 6 calendar months of the unauthorized disclosure via the Executive Office of the Mayor, Office of Risk Management, Washington.

Step 3: Filing a Federal FERPA Complaint Within 180 Days

To trigger a federal investigation and compel systemic corrective action at the school, submit Form SPPO-1, FED, U.S. Department of Education, FERPA Complaint Form to the U.S. Department of Education, Student Privacy Policy Office, Washington (SPPO) within 180 days of the date you learned of the unauthorized disclosure pursuant to 34 C.F.R. § 99.64. If the violation occurred at a D.C. public charter school, file a concurrent oversight complaint with the District of Columbia Public Charter School Board, Washington.

Step 4: Auditing Claims Under the D.C. Mental Health Information Act

Examine whether the leaked school records contained psychological evaluations, psychiatric diagnoses, therapy notes, or behavioral health assessments prepared by a licensed psychologist, social worker, or mental health professional. Unlike FERPA, the District of Columbia Mental Health Information Act (D.C. Code § 7-1201.01) strictly prohibits the unauthorized disclosure or redisclosure of mental health information and-crucially-grants an explicit private cause of action in court under D.C. Code § 7-1207.01 for actual damages sustained by the client, statutory damages of not less than $1,000 for willful or intentional disclosures, and mandatory attorney fees.

Step 5: Filing a Civil Lawsuit in D.C. Superior Court or Federal Court

To recover financial compensation, your attorney files a civil lawsuit in the Superior Court of the District of Columbia, Civil Division, Washington using Form CV-496, District of Columbia, Superior Court, Civil Action Information Sheet and Form CV-3110, District of Columbia, Superior Court, Civil Action Summons (or in the U.S. District Court for the District of Columbia, Washington if federal Section 504/IDEA or multi-state data breach class claims are joined). Depending on the facts, the complaint asserts counts for violation of the District of Columbia Mental Health Information Act (D.C. Code § 7-1207.01), common-law invasion of privacy (public disclosure of private facts), breach of private school enrollment contract, and-against commercial software vendors-violations of the D.C. Data Breach Notification Law (D.C. Code § 28-3852) and the D.C. Consumer Protection Procedures Act (D.C. Code § 28-3905).

High-Risk Student Privacy Scenarios in Washington, D.C.

Three specific privacy failures account for the vast majority of school records disputes and civil lawsuits in the District of Columbia.

Non-Custodial Parent Access Disputes and Protective Orders

Under 34 C.F.R. § 99.4 and 5-E D.C.M.R. § 2600, a school must give both biological or adoptive parents equal access to a student's education records unless the school has been provided with evidence that there is a court order, District statute, or legally binding document relating to divorce, separation, or custody that specifically revokes these rights. Disaster strikes when a custodial parent in D.C. provides the school registrar with a Civil Protection Order (CPO) issued by the Domestic Violence Division or a Family Court custody order stripping the other parent of educational access or concealing the family's safe address, and a careless front-office clerk emails report cards, emergency contact sheets, or dismissal pickup schedules containing the mother's confidential address to the restricted parent. When a school breaches a court order on file and exposes a domestic violence survivor's location, the family can sue for negligence, intentional or negligent infliction of emotional distress, and invasion of privacy.

Third-Party Educational Software (EdTech) Data Breaches

D.C. schools outsource student grading, behavioral tracking, counseling logs, and college readiness to dozens of cloud-based EdTech platforms under FERPA's 'school official' vendor exception at 34 C.F.R. § 99.31 (subsection (a)(1)(i)(B)). While the school itself is shielded from direct FERPA lawsuits by Gonzaga University v. Doe, 536 U.S. 273 (US Supreme Court 2002), for-profit EdTech software companies are commercial merchants. When an EdTech vendor suffers a ransomware data breach exposing D.C. students' Social Security numbers, medical records, or IEP files-or illegally monetizes student data for targeted advertising-parents can sue the software company directly under the D.C. Data Breach Notification Law (D.C. Code § 28-3852, enforced via D.C. Code § 28-3853) and the D.C. Consumer Protection Procedures Act (D.C. Code § 28-3905), claiming $1,500 per violation or treble actual damages plus mandatory attorney fees.

Unauthorized Disclosure of Psychological Evaluations to General Education Teachers

Parents frequently submit sensitive neuropsychological evaluations, psychiatric hospitalization discharge summaries, or family trauma histories to a school's IEP or 504 coordinator strictly to establish eligibility for accommodations. Under 34 C.F.R. § 99.31 and 34 C.F.R. § 300.622, internal school staff may only access those records if they have a legitimate educational interest-meaning general education teachers typically need to see the student's classroom accommodation sheet or IEP snapshot, not the raw psychological evaluation detailing parent mental health histories or private psychiatric therapy notes. When a school psychologist or coordinator blasts the full confidential psychiatric evaluation to electives teachers, coaches, or parent volunteers, or gossips about the diagnosis in a faculty lounge, the disclosure violates both the common-law tort of public disclosure of private medical facts recognized in Vassiliades v. Garfinckel's, Brooks Brothers, Miller & Rhoades, Inc., 492 A.2d 580 (DC Court of Appeals 1985) and Wolf v. Regardie, 553 A.2d 1213 (DC Court of Appeals 1989), and triggers statutory liability under the District of Columbia Mental Health Information Act (D.C. Code § 7-1201.01).

How Much Does It Cost in the District of Columbia?

Pursuing administrative and judicial remedies for a student privacy violation in Washington, D.C. involves the following costs:

• Federal SPPO & Local Oversight Complaints: $0 to file a FERPA complaint with the U.S. Department of Education, Student Privacy Policy Office, Washington or the District of Columbia Public Charter School Board, Washington.
• D.C. Superior Court Filing Fees: Filing a civil lawsuit in the Superior Court of the District of Columbia, Civil Division, Washington costs $120 (or $5 to $45 in the Small Claims Branch for claims up to $10,000).
• Federal District Court Filing Fee: Filing a complaint in the U.S. District Court for the District of Columbia, Washington costs $405.
• Privacy and Education Lawyer Fees: Because both the District of Columbia Mental Health Information Act (D.C. Code § 7-1207.01) and the D.C. Consumer Protection Procedures Act (D.C. Code § 28-3905) mandate that violating defendants pay the plaintiff's reasonable attorney fees, many D.C. privacy and litigation attorneys handle EdTech data breaches and mental health disclosure lawsuits on a contingency fee basis, while standalone administrative or private-school contract disputes may require a flat or hourly retainer ($300 to $550/hour).

How Long Does the Process Take?

Strict statutory deadlines govern student privacy actions in the District of Columbia:

• 6-Month Municipal Tort Notice (CRITICAL): Under D.C. Code § 12-309, if you intend to sue DCPS or the District government for monetary damages in tort, you must serve written notice on the Mayor within 6 months (180 days) of the unauthorized disclosure.
• 180-Day Federal FERPA Deadline: Under 34 C.F.R. § 99.64, administrative complaints to the U.S. Department of Education SPPO must be filed within 180 days of the date you knew or reasonably should have known of the violation. SPPO investigations typically take 6 to 14 months.
• Civil Statutes of Limitations: Under D.C. Code § 12-301, common-law invasion of privacy (public disclosure of private facts), breach of private school contract, D.C. Mental Health Information Act claims, and CPPA data breach claims generally carry a 3-year statute of limitations (note that certain intentional torts such as defamation carry a 1-year limit under D.C. Code § 12-301(4)).

Consult a Washington, D.C. Student Privacy and Litigation Lawyer

Filing a lawsuit citing only FERPA will almost certainly result in quick dismissal under federal precedent-which is why framing your case under District of Columbia mental health privacy statutes, consumer data breach laws, and common-law invasion of privacy torts is vital. Through our directory of United States lawyers, you can connect with an experienced Washington, D.C. education and privacy litigation attorney who can serve timely notice under D.C. Code § 12-309, preserve electronic audit trails, and fight for maximum statutory compensation.

Frequently Asked Questions (FAQ)