34 C.F.R. § 303.401
(b) Confidentiality procedures. As required under sections 617(c) and 642 of the Act, the regulations in §§ 303.401 through 303.417 ensure the protection of the confidentiality of any personally identifiable data, information, and records collected or maintained pursuant to this part by the Secretary and by participating agencies, including the State lead agency and EIS providers, in accordance with the protections under the Family Educational Rights and Privacy Act (FERPA) in 20 U.S.C. 1232g and 34 CFR part 99. Each State must have procedures in effect to ensure that—
(c) Applicability and timeframe of procedures. The confidentiality procedures described in paragraph (b) of this section apply to the personally identifiable information of a child and the child's family that—
(d) Disclosure of information.
(1) Subject to paragraph (e) of this section, the lead agency must disclose to the SEA and the LEA where the child resides, in accordance with § 303.209(b)(1)(i) and (b)(1)(ii), the following personally identifiable information under the Act:
(e) Option to inform a parent about intended disclosure.
(2) If a parent (in a State that has adopted the policy described in paragraph (e)(1) of this section) objects during the time period provided by the State, the lead agency and EIS provider are not permitted to make such a disclosure under paragraph (d) of this section and § 303.209(b)(1)(i) and (b)(1)(ii).
(Authority: 20 U.S.C. 1412(a)(8), 1412(a)(9), 1417(c), 1435(a)(5), 1437(a)(9), 1439(a)(2), 1439(a)(4), 1439(a)(6), 1442)