FERPA

The Family Educational Rights and Privacy Act (FERPA) is a federal law regarding the privacy of student records and the obligations of the institution, primarily in the areas of release of the records and the access provided to these records. Any educational institution that receives funds under any program administered by the U.S. Secretary of Education is bound by FERPA requirements. Institutions that fail to comply with FERPA may have funds administered by the Secretary of Education withheld.

Student education records are considered confidential and may not be released to third parties without written consent from the student unless disclosure is permitted through one of the FERPA signed consent exceptions.

What are education records?

Education records are defined as records, files, documents, and other materials that contain information directly related to a student and are maintained by an educational agency or institution or by a party acting for such agency or institution. Education records take many forms, including paper and electronic.

Education records include things like:

  • graded papers
  • exams
  • transcripts
  • class rosters
  • notes from a conversation with a student
  • computer screens displaying student information
  • emails containing information about a student

Education records do not include things like:

  • sole possession (lap drawer) records
  • peer graded papers
  • online forums (e.g., Oncourse/Canvas chats)
  • law enforcement unit records
  • employment records (unless employment is based on student status)
  • medical records
  • alumni records

Is there any student information not subject to FERPA restrictions?

Schools may disclose, without consent, “directory” information, however, students have the right to request that their information be excluded from this list. Directory information includes such things as:

  • name
  • address
  • email address
  • phone number
  • major
  • dates of attendance
  • admission or enrollment status
  • campus
  • school
  • class standing
  • degrees and awards
  • activities
  • sports
  • athletic information

Who can access student records?

School officials may not disclose a student’s education records, nor permit inspection of these records, without written permission  unless such action is covered by exceptions permitted by FERPA. A notable exception is disclosing information to school officials determined by the institution to have a legitimate educational interest. Access by these officials is restricted where practical, and only to that portion of the student record necessary for the discharge of assigned duties. For example, a faculty member would have access to the class rosters and grades from courses they teach, but would not have access to the financial aid or disciplinary records of students as part of teaching.

Under IU policy, legitimate education interest includes research purposes when the research is necessary in order for the school official to fulfill his or her professional responsibilities and the research is designed to study the effectiveness of an instructional technique, curricula, or classroom management method in an IU course.

  1. Note that this access is on an individual basis, and it is possible that one member of a research team may have access to identifiable student records while another may not.
  2. This policy only applies to IU affiliates accessing IU student records. Access to student records at other institutions is subject to the hosting institution’s policies.

How do I obtain permission from students to access their records?

In order for a researcher to access student records for which they do not already have legitimate educational interest, they must obtain signed and dated permission from the parent or eligible student for the release of their records. FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when they reach the age of 18 or attend a school beyond the high school level.

At Indiana University, signed permission may be obtained electronically if the signature page is located behind CAS authentication.

The written release must:

  • Specify the records that may be disclosed
  • State the purpose of the disclosure, and
  • Identify the party or class of parties to whom the disclosure may be made.

Note that this may require a researcher to obtain signatures from subjects in instances where human subjects research regulations do not require signatures. In these cases, researchers must comply with the more restrictive FERPA regulations. The IRB does NOT have the authority to waive any part of this requirement. When signed releases are obtained to access student records, they should be stored indefinitely.

Researcher responsibilities regarding FERPA-protected data:

Approval to use student educational record data in your research is contingent on your agreement to:

  • Use the information only for purposes of your approved research project.  Any new use of the information requires new approval.
  • Provide adequate protection for the information to ensure that it is not compromised or subject to unauthorized access.
  • Ensure that only members of the research team who have a legitimate educational interest access student records without signed permission from the parent or eligible student.
  • Ensure that no one outside of the research team members who are specifically listed on the protocol have access to the personally identifiable information.
  • Ensure that all data shared in aggregate form is properly de-identified to avoid unauthorized disclosure to third parties.  IU’s disclosure avoidance procedure is to restrict any cell size that is smaller than 10 when paired with restricted data.

Examples of working with FERPA-protected data at IU:

Professor Mathwin and her graduate student assistant Elayne wish to conduct a study that will involve recruiting students who are enrolled in SPEA courses and interview them about their opinions about campus safety. They plan to ask the instructors of various classes to provide them with class rosters so that they can email the students to recruit them for the study.

This recruitment strategy would require the course instructors to violate FERPA regulations. Class rosters and student schedules are student records information and should not be shared with third parties. The researchers in this case are not studying the effectiveness of instructional techniques, curricula, or classroom management, and thus are not eligible to review student records for this research. They could request that the class instructors send out an email on their behalf and then provide additional information to students who initiate contact.

Professors Cauthon and Aybara wish to test the effectiveness of Professor Cauthon’s introductory course. To do this, they will use pre- and post-test surveys to evaluate the students’ understanding of course material and review their class work, which includes short papers.

At IU, this would be permissible so long as both researchers are IU affiliates. If one of the two researchers were not an IU affiliate, then a signed release from students would be required in order for the student record data to be accessed by that person.

Noal, a graduate student in anthropology, wants to research the correlation between Pell grant eligibility and the GPA of math majors. To do this, he plans to request a copy of the names of all math majors and their GPAs from the Registrar’s office and a copy of all Pell grant recipients from the financial aid office. After merging the two lists, he will remove all student names.

Noal does not have a legitimate educational interest as part of his professional duties at IU to access this data because he does not teach the courses in question and has no responsibility for their conduct or effectiveness.