(2007)

The Honorable S.G. Samuel Moxley

You have requested an opinion whether the Baltimore County Auditor may inspect records of the Baltimore County Public Schools relating to student eligibility for enrollment based on residency.

For reasons outlined below, we conclude that the County Auditor may not inspect records relating to student residence as part of a performance audit evaluating the adequacy of the Board of Education's policy regarding acceptable proof of residency. However, the County Auditor may inspect such records in order to conduct a financial audit of tuition and out-of-county payments pursuant to the State education law. In any such audit, care must be taken by the County Auditor and the school system to comply with privacy protections mandated by federal law.

I Background

A. Residency Requirements for Enrollment in Baltimore CountyPublic Schools

Maryland law provides that all children who are 5 years of age or older, but under the age of 21, "shall be admitted free of charge to the public schools of this State." Annotated Code of Maryland, Education Article ("ED"), § 7-101(a). State law further states that "each child shall attend a public school in the county where the child is domiciled with the child's parent, guardian, or relative providing informal kinship care . . ." ED § 7-101(b)(1).¹ According to the policy of the Maryland State Department of Education ("MSDE"), each local school system establishes acceptable proof of residency that is documented in student records. See MSDE Fact Sheet 40 (Revised October 2004); see also M aryland Student Records System Manual 2007 at B-4 (incorporated by reference in COMAR 13A.08.02.01).

State law further grants the county su perinten dent the authority "in accordance with a county board's policies concerning residency" to "allow a child to attend school in the county even if the child is not domiciled in that county. . . ." ED § 7-101(b)(2). However, "[i] f a child fraudulently attends a public school in a county where the child is not domiciled," State law provides that the parent or guardian is subject to a penalty payable to the county for the pro rata share of the tuition for the time the child fraudulently attends a public school in the county. ED § 7-101(b)(3).

In Baltimore County, a rule of the County Board of Education ("County Board") lists acceptable documents for verification of domicile to allow a child to attend the County's public schools free of charge.² Board Rule 5150, § II.A. The rule outlines policies relating to nonresident students, including circumstances when a parent or guardian of a nonresident student must pay tuition to attend the County's public schools. Id., § IV. The rule also describes the procedures in the event it is determined that a student has fraudulently enrolled in the County schools. Id., § V.A. Finally, the rule establishes accounting procedures for tuition payments for nonresident students. Id., § VII.

According to budget documents of the Baltimore County Public Schools, the operating budget for Fiscal Year 2007 included revenues of more than $4 million in payments to the Board for nonresident students. That figure consisted of nonresident tuition, as well as payments from other Maryland jurisdictions to reimburse Baltimore County Public Schools for their resident students enrolled in the County's schools pursuant to Out-of-County Living Arrangements.See Baltimore County Public Schools, Adopted Operating Budget (Fiscal Year 2007) at 36-38.

B. Baltimore County Auditor

The Baltim ore County Charter provides for the County Council to appoint a County Auditor, who serves at the pleasure of the County Council. Baltimore County Charter, § 311. Among other things, the Charter authorizes the Auditor to "conduct a financial audit of any organization funded in whole or in part by county funds, if directed by a majority of the county council." Id. The Charter also includes among the Auditor's duties, as directed by the County Council, "operational and performance auditing of any office, department or agency funded in whole or in part by county funds. . . ." Id.

C. County Audit Resolution and Public Information Request

On March 6, 2006, the Baltimore County Council passed a resolution authorizing the County Auditor to conduct an audit, pursuant to ED § 5-109, of the accounts and records of the County Board and the Baltim ore County Public Schools "relating to students who are not residents of Baltimore County and who are not eligible to enroll at Baltimore County Public Schools in the current Fiscal Year and any previous fiscal years, as deemed appropriate by the Auditor." County Council of Baltimore County, Resolution No. 12-06 (March 6, 2006). According to your letter, the County Board refused to permit the audit.

On behalf of the Auditor, the Baltimore County Office of Law then filed a Public Information Act ("PIA") request for records that the County Board had received from parents or legal guardians "to prove verification of domicile." Letter of Assistant County Attorney Michael E. Field to Superintendent Joe A. Hairston (July 5, 2006). The County Board apparently did not produce any records. Rather, it asked for a clarification of the time period of the records sought in the request. The County Board also indicated that it believed that the requested records were "student records" subject to certain privacy restrictions under federal law, specifically the Family Educational Rights and Privacy Act of 1974 ("FERPA"), which are incorporated into the PIA. It asked the County Attorney to clarify whether his request fit within the review permitted by FERPA. The County Board also indicated that it was willing to make the records available with "unique student identifiers to protect student confidentiality." Letter of Margaret-Ann F. Howie, Legal Counsel to the Superintendent, to Michael E. Field, Assistant County Attorney (July 17, 2006). You indicate that the County Attorney considered the Board's response as a denial of his request. You then asked for this opinion.

II Analysis You have asked whether the County Auditor has a "right" to inspect the Board's records relating to student eligibility for enrollment based on residency. The Auditor has attempted to access those records in two ways: (1) pursuant to a direction of the County Council to audit the Board's records; and (2) pursuant to a request under the Public Information Act ("PIA").

A. Access to Records Pursuant to an Audit

1. County Funding of Local Schools

It is well established under Maryland law that county boards of education are State agencies. See Chesapeake Charter, Inc. v. AnneArundel County Board of Education, 358 Md. 129, 136-137, 747 A.2d 625 (2000). State law sets forth the budget process and requirements for the financing of the public schools. ED § 5-101 et seq. This Office has previously concluded that the State has preempted the area of education financing. 75 Opinions of the Attorney General 172, 178 (1990). "In fact, the Court of Appeals has held that the area of public education is preempted by the General Assembly." 79 Opinions of the AttorneyGeneral 132, 134 (1994) (citing McCarthy v. Board of Education,280 Md. 634, 374 A.2d 1135 (1977)). Nevertheless, as State law recognizes, a county government has a significant financial stake in the operation of local schools.

State educational aid is premised largely on a complex formula established in State law known as the "annual per pupil foundation amount." ED § 5-202(a)(2). A county is also required to contribute a minimum amount according to a formula set out in ED § 5-202(a)(7). Counties may surpass this "maintenance of effort" amount, but also may deny budget requests from the local school board that exceed the minimum funding requirement. ED § 5-103.

In addition to the State and County funds provided under the statutory formulas, the County Board also receives additional funds for nonresident students. In particular, a local education agency is entitled to funding from the State and other counties for each child placed in the county schools by a State agency, a licensed placement agency or a court when another county is financially responsible for the education of that child. ED § 4-122. As outlined in Part I.A. above, the policy of the County Board also specifies the circumstances when a parent or guardian of a nonresident child must pay tuition for his or her child to attend a public school in Baltimore County. See Baltimore County Public Schools Rule 5150, § II.A. Under that policy, the County Board may collect monetary penalties for students fraudulently enrolled in the County's public schools.

2. Audits of Public School Systems By County Governments

The General Assembly has preserved the authority of local governments to examine the finances of the local education board. ED § 5-109(d). But the "county's authority to control expenditures of the local board of education is limited by statute." 75 Opinions of the AttorneyGeneral at 178. Each county board must "provide for an annual audit of its financial transactions and accounts." ED § 5-109(a). In addition to the audit required by ED § 5-109, "the county commissioners or county council may conduct an audit using auditors employed by the county." ED § 5-109(d).

Attorney General Curran construed ED § 5-109(d) in two opinions which concluded that the statute authorizes a county government to audit a school system's financial transactions and accounts, but not to conduct a performance audit. See 91 Opinions of the Attorney General 145 (2006) (Montgomery County inspector general may audit the board of education's financial transactions and accounts, but the county council could not require the board to submit to a performance audit by the inspector general); 75 Opinions of the Attorney General 172 (1990) (audit by Carroll County Commissioners of county board of education limited to an audit of financial transactions and accounts). If a county governing body wishes to obtain a performance audit of a local educational program or entity, it may only do so with the assent of the local school system; otherwise, it must request such an audit through MSDE. ED § 5-110.

A "financial audit" has been described as "a review of an entity's financial statements, or segments of them, for two purposes: to determine whether the statements fairly present the audited entity's financial position in accordance with generally accepted accounting principles; and to determine whether the entity has complied with legal requirements governing those transactions and events that may have a material effect on the financial statements." 75 Opinions of theAttorney General at 174. The Education Article defines a performance audit as "an assessment of an entity's or program's practices to determine whether the entity or program is operating economically and efficiently and whether corrective actions for improving its performance are appropriate." ED § 5-110(a).

Thus, whether the County Auditor may review the records in question pursuant to the authority to conduct an audit of the County Board under ED § 5-109(d) depends, in the first instance, on the nature of the audit. Would it be a financial audit or a performance audit?

3. Financial Audit v. Performance Audit

In our view, the County Auditor would be acting within the authority of ED § 5-109(d) if the audit were for the purpose of reconciling the accounts regarding tuition payments — i.e., whether the figures reported by the County Board regarding enrollment, tuition, and out-of-county payments are supported by the underlying documents. Such a review could include an examination of whether the schools are assessing and collecting tuition and penalties in accordance with the County Board's rules.

On the other hand, the County Auditor does not have authority to conduct an audit to evaluate the merits of the County Board's current policies and procedures for verifying domicile.³ In our opinion, such an audit that would intrude in areas over which the County Board has been given authority. Cf. 75 Opinions of the Attorney General at 179 (county government could not review the board's personnel policies including promotional policies, general hiring criteria and experience, nor could the local government examine the "feasibility/desirability of combining purchasing departments" of the board and the county government); 91 Opinions of the Attorney General at 149 (county inspector general's "general audit authority" granted by the county council does not extend to the county board of education because that power directs the inspector general to identify ways to enhance the productivity, effectiveness, or efficiency of programs, and thus is akin to a performance audit).

Questions about education law and education policy are the purview of the State Board of Education, as head of the Maryland State Department of Education ("MSDE"). Clinton v. Board of Education, 315 M d. 666, 675,556 A.2d 273 (1989). MSD E's policy allows the local boards to determine acceptable proof of residency. See MSDE Fact Sheet 40. This policy could be changed by MSDE or by State law. See, e.g., ED § 7-102 (directing the board in Prince George's County to require an affidavit from parents or guardians attesting to their legal residence). The Baltimore County Council has no authority to change the residency policy for enrollment in the County's public schools. Moreover, in our view, an examination of the effectiveness of the current policy by the County Auditor would assess how well the policy determined residency. Such an examination would be a performance audit, and not allowed under State law, absent the assent of the County Board or the involvement of MSDE.

There remains, however, the question whether student privacy provisions of federal law would prevent the County Auditor from inspecting records documenting student domicile as part of a financial audit.

4. Federal Restrictions on Disclosure of Education Records

FERPA prohibits educational institutions receiving federal funds from disclosing student educational records except in limited circumstances.See 20 U.S.C. § 1232g. FERPA lists the persons allowed to have access to student educational records and establishes privacy rights in those records subject to some exceptions. 20 U.S.C. § 1232g(b). Among those allowed access to student education records are State and local officials in connection with the evaluation or audit of educational programs. The statute provides:

(3) Nothing contained in this section shall preclude authorized representatives of . . . (C) State educational authorities from having access to student or other records which may be necessary in connection with the audit and evaluation of Federally-supported education programs, or in connection with the enforcement of the Federal legal requirements which relate to such programs: Provided, That except when collection of personally identifiable information is specifically authorized by Federal law, any data collected by such officials shall be protected in a manner which will not permit the personal identification of students and their parents by other than those officials, and such personally identifiable data shall be destroyed when no longer needed for such audit, evaluation, and enforcement of Federal legal requirements.

. . .

(5) Nothing in this section shall be construed to prohibit State and local educational officials from having access to student or other records which may be necessary in connection with the audit and evaluation of any federally or State supported education program or in connection with the enforcement of the Federal legal requirements which relate to any such program, subject to the conditions specified in the proviso in paragraph (3).

20 U.S.C. § 1232g(b)(3), (5); see also 34 CFR § 99.31(a)(3), § 99.35(a) (regulations adopted by United States Department of Education implementing the statute). Like the statute, the federal regulations mandate that state and local officials given access to student educational records must protect personally identifiable information from disclosure to anyone except those allowed access to it and destroy the information when it is no longer needed. 34 CFR § 99.35(b). Thus, State and local "educational" officials may have access to student records in connection with an audit of an educational program.

Although the federal statute and regulations use the qualifying term "educational" with regard to the state and local officials allowed access to student records, the United States Department of Education has stated that "this statutory exception should be interpreted to include State auditors, including those working for the legislative branch . . ." Letter from LeRoy S. Rooker, Director, Family Policy Compliance Office, United States Department of Education, to Ardith Lynch, Associate General Counsel, University of Alaska (May 23, 2005).⁴ The Department issued the letter in response to a request from the University of Alaska for guidance when Alaska legislative auditors sought to review the university's compliance with that state's residency requirements regarding payment of in-state tuition. The Department determined that such a review was permissible under FERPA. However, the letter further specified that states should limit use of the exception to the FERPA privacy requirements for auditors to audits of education programs "and apply the broader disclosure [exception] for `evaluation' purposes only to State or local `educational' authorities." Id.

Likewise, in our opinion, FERPA would not bar the County Auditor from inspecting student verification records for purposes of a financial audit as outlined in the previous section of this opinion, if the required privacy protections were maintained.⁵

B. Access to Records under the Public Information Act

Finally, we consider whether the PIA provides the County Auditor with an alternative means of obtaining access to records apart from the County's audit authority. The PIA, codified at Annotated Code of Maryland, State Government Article ("SG"), § 10-611 et seq., accords a broad right of access to public records to government officials and entities, as well as to members of the general public. See SG § 10-614(a) (setting forth procedures under which "a person or governmental unit" may seek to inspect a public record). A public record is presumptively available for inspection and copying, by the individual or entity making a PIA request for the record, unless the record (or part of it) is exempt from disclosure for any of the various reasons recognized in the PIA. 92 Opinions of the Attorney General 26, 28-30 (2007).

However, the PIA generally incorporates whatever limits other law may set on the disclosure of a public record. Thus, access to a record may be limited — or expanded — by other law. See SG § 10-615 (custodian may or must deny inspection if record is confidential "by law"); § 10-616 (certain records exempt from disclosure "unless otherwise provided by law"); § 10-617 (certain information exempt from disclosure "unless otherwise provided by law"); § 10-618 (providing custodian some discretion to withhold records from disclosure "unless otherwise provided by law").

Records collected by the County Board to document the domicile of students are "public records" subject to the PIA. See SG § 10-611(g)(1) (defining "public record" to include "any documentary material . . . made . . . or received [by a unit of State or local government] in connection with the transaction of public business"). However, there are at least two possible exceptions to the general rule of disclosure that may apply to such records. First, because the PIA always defers to "other law" as to whether a record should be disclosed, the PIA incorporates any limitations imposed by federal statutes and regulations. SG § 10-615(2)(ii). It thus incorporates any restrictions under FERPA.

Second, there is a specific exception in the PIA itself for school records relating to students. SG § 10-616(k). In particular, it provides that a school board or other custodian of records must deny inspection of "a school district record about the home address, home phone number, biography, family, physiology, religion, academic achievement, or physical or mental ability of a student." SG § 10-616(k)(1). Inspection is permitted by the person in interest — i.e., the student — or by "an elected or appointed official who supervises the student." SG § 10-616(k)(2).⁶ Records relating to verification of a student's domicile concern the "home address" and "family" of the student and therefore likely fall within this category of records. But, as noted above, this exception may be trumped by other federal or State law that permits access to the records. Thus, to the extent that ED § 5-109(d) affords the County Auditor access to these records, this exception would not block such access.

In summary, the County Auditor obtains no greater access to these records through a PIA request than the Auditor has under the County's authority to audit the Board's records pursuant to ED § 5-109(d).

III Conclusion In our opinion, the County Auditor may not inspect records relating to student residence as part of a performance audit evaluating the adequacy of the County Board's policy regarding acceptable proof of residency. However, the County Auditor may inspect such records in order to conduct a financial audit of tuition and out-of-county payments pursuant to the State education law. In any such audit, care must be taken by the County Auditor and the school system to comply with privacy protections mandated by federal law. If the County Council wishes to undertake a broader audit of the Board's records, it may only do so with the County Board's assent or by requesting such an audit through MSDE.

Douglas F. Gansler Attorney General

Sandra Benson Brantley Assistant Attorney General

Robert N. McDonald Chief Counsel Opinions and Advice

¹ "Informal kinship care" is defined as a living arrangement in which certain relatives of a child provide for the care and custody of a child due to a "serious family hardship." The latter phrase in turn is defined to include a variety of circumstances, including the incarceration or serious illness of the child's parent or legal guardian. ED § 7-101(c). The statute sets forth procedures for documenting those circumstances. Id.

² Under the County Board's rule, parents or guardians must show at least four of the acceptable forms of proof of name and address listed in the regulations, as well as a photo identification. Rule 5150, Section II.A.

³ For example, we do not believe that an auditor conducting a financial audit of tuition records may further investigate whether a particular student should be enrolled in County's school where the parent or guardian has met the requirements for verification of residency under the County Board's rules.

⁴ Available athttp://www.ed.gov/policy/gen/guid/fpco/ferpa/library/univako52305.ht ml.

⁵ We understand that, subsequent to the request for this opinion, the County Board of Education requested advice from the United States Department of Education concerning the permissible access of County employees under FERPA to student records related to residency. The Department of Education has apparently not yet provided a substantive response to this inquiry. If the Department were to revise its prior interpretation of FERPA concerning access by legislative auditors, we would revisit this conclusion.

⁶ The custodian is also given discretion to provide access to the information to certain other parties, including "a person engaged by a school or board of education to confirm a home address or home phone number." SG § 10-616(k)(3)(i)3. *Page 148