FERPA and research with student records

The Family Educational Rights and Privacy Act (FERPA) is a federal law regarding the privacy of student records and the obligations of the institution, primarily in the areas of release of the records and the access provided to these records. Any educational institution that receives funds under any program administered by the U.S. Secretary of Education is bound by FERPA requirements. Institutions that fail to comply with FERPA may have funds administered by the Secretary of Education withheld.

Student education records are considered confidential and may not be released to third parties without written consent from the student unless disclosure is permitted through one of the FERPA signed consent exceptions.

What are education records?

Education records are defined as records, files, documents, and other materials that contain information directly related to a student and are maintained by Indiana University or by a person acting for the University. Education records take many forms, including paper and electronic.

Education records include things like:

  • graded papers
  • exams
  • transcripts
  • class rosters
  • notes from a conversation with a student
  • computer screens displaying student information
  • emails containing information about a student

Education records do not include things like:

  • sole possession (lap drawer) records
  • peer graded papers
  • online forums (e.g., Oncourse/Canvas chats)
  • law enforcement unit records
  • employment records (unless employment is based on student status)
  • medical records
  • alumni records

Is there any student information not subject to FERPA restrictions?

Schools may disclose, without consent, “directory” information, however, students have the right to request that their information be excluded from this list. Directory information includes such things as:

  • name
  • address
  • email address
  • phone number
  • major
  • dates of attendance
  • admission or enrollment status
  • campus
  • school
  • class standing
  • degrees and awards
  • activities
  • sports
  • athletic information

Who can access student records?

School officials may not disclose a student’s education records, nor permit inspection of these records, without written permission from the student unless such action is covered by exceptions permitted by FERPA. A notable exception is disclosing information to school officials determined by the institution to have a legitimate educational interest. Access by these officials is restricted where practical, and only to that portion of the student record necessary for the discharge of assigned duties. For example, a faculty member would have access to the class rosters and grades from courses they teach, but would not have access to the records of all students with a particular major.

Under IU policy, student records may be accessed for research purposes without obtaining signed permission if all of the following conditions are met:

  1. The researcher is a school official and the research is specifically for effectiveness of their instructional technique or method.
  2. The researcher is only using grades from their courses, not the grades their students receive in other courses or what is reviewed on their transcript.
  3. The researcher follows the institutional requirement to aggregate data (no personally identifiable information, name, address, ID, etc.) and no data with less than 10 cell size is presented. For instance, no class section containing less than 10 students could be presented or if other identifiers such as race/ethnicity or gender are used the 10 cell size would also be a requirement.

How do I obtain permission from students to access their records?

In order for a researcher to access student records for which they do not already have legitimate educational interest, they must obtain signed and dated permission from each student for the release of their records. At Indiana University signed permission may be obtained electronically if the signature page is located behind CAS authentication.

The written release must:

  • Specify the records that may be disclosed
  • State the purpose of the disclosure, and
  • Identify the party or class of parties to whom the disclosure may be made.

Note that this may require a researcher to obtain signatures from subjects in instances where human subjects research regulations do not require signatures. In these cases, researchers must comply with the more restrictive FERPA regulations. The IRB does NOT have the authority to waive any part of this requirement. When signed releases are obtained to access student records, they should be stored indefinitely.

Researcher responsibilities regarding FERPA-protected data:

Approval to use student educational record data in your research is contingent on your agreement to:

  • Use the information only for purposes of your IRB approved research project. Any new use of the information requires new approval.
  • Provide adequate protection for the information to ensure that it is not compromised or subject to unauthorized access.
  • Ensure that no one outside of the research team members who are specifically listed on the IRB application have access to the personally identifiable information.
  • Ensure that all data shared in aggregate form is properly de-identified to avoid unauthorized disclosure to third parties. IU’s disclosure avoidance procedure is to restrict any cell size that is smaller than 10 when paired with restricted data.

Examples of FERPA violations and possible corrections:

Professor Mathwin and her graduate student assistant Elayne wish to conduct a study which will involve recruiting students who are enrolled in SPEA-E 162. They plan to ask the instructors of each of the class sections to provide them with class rosters to that they can email the students to recruit them for the study.

This recruitment strategy would require the course instructors to violate FERPA regulations because class rosters and student schedules are considered to be confidential information and should not be shared with third parties. The researchers could request that the class instructors send out an email on their behalf and then provide additional information to students who initiate contact.

Professors Cauthon and Aybara wish to test the effectiveness of Professor Cauthon’s introductory course. To do this, they will use pre- and post-test surveys to evaluate the students’ understanding of course material and review their class work, which includes short papers. Professor Cauthon plans to remove student names from the papers and surveys and replace them with subject numbers before any analysis begins.

Professor Aybara does not have authority to access the class work from Professor Cauthon’s class. Note that removing the student names from papers is not a valid way of de-identifying the assignments, as writing samples are considered to be identifiable. Professors Cauthon and Aybara will need to obtain written permission from the students in order for Professor Aybara to have access to their papers.

Professor Ramman, an anthropology professor, wants to research the correlation between Pell grant eligibility and GPA of history majors. To do this, he plans to request a copy of the names of all history majors and their GPAs from the Registrar’s office and a copy of all Pell grant recipients from the financial aid office. After merging the two lists, he will remove all student names.

This information will not be provided to Professor Ramman by either office, as he does not have a legitimate educational interest as part of his university duties to access this data. It may be possible for him to obtain a de-identified list of history majors, their GPAs and Pell eligibility.