Must a school have a written agreement or contract with a community-based organization to which it non-consensually discloses education records to outsource an institutional service under the school official exception?

No.  While FERPA does not require written agreements or contracts when a school chooses to outsource an institutional service or function to a community-based organization under the “school official” exception, it is a best practice to do so.  Written agreements help ensure that the community-based organization understands its obligations and responsibilities with respect to the use of and privacy protections accorded to the FERPA protected information.  Further, appropriate contractual provisions can establish the direct control required by FERPA under this exception.  Additionally, local or state policies or laws may require the use of written agreements or contracts for procurement.