FERPA (Family Education Rights and Privacy Act) refers to a federal law that protects the privacy of individuals' educational record information. An educational record is defined as any information recorded in any way — including, but not limited to, handwriting, print, computer media, videotape or audiotape, electronic files, film, microfilm, and microfiche — that are maintained by education agencies or institutions, or individuals acting on their behalf. Personal notes by teachers or other staff, kept in the sole possession of the maker, used only as a memory aid, and not accessible or revealed to any other person except a temporary substitute, are not considered part of the education record (34 CFR 99.3). Instructors' grading records are educational records.
An educational institution is legally responsible for vigorously protecting student education record confidentiality and restricting the usage of that information. This personal information was not gathered for research purposes; however, such information often does constitute a rich resource for important research pursuits. Thus, there are clearly defined processes through which investigators may access such data. These processes are designed to protect the rights of the individuals from whom these data originate. To facilitate this process of releasing records and maintaining individuals' privacy, the roles of the IRB, the investigator, and the educational institution are critical and exacting. These types of research projects tend to fall into one of the three categories summarized below.
FERPA and Waiving Consent
If you are requesting a FERPA-1 or FERPA-2 Waiver, please also complete the Request to Alter or Waive Informed Consent.
The institution agrees to provide de-identified information to an investigator (34 CFR 99.3). This means that the investigator is absolutely prevented from knowing or determining the identity of any individual whose data informs the study. The means by which identities are censored by the institution range from a formal prohibition to destroying any sort of master key used to organize the data set before release to the investigator. Specific and general elements relating to identity must be excluded (see Table 1). If these conditions are met, the FERPA-1 form, whereby the institution and the investigator attest to these constraints, is used to register with the IRB.
Table 1. List of identifiers that cannot be included in a de-identified data set.
Address of student
Name of parent(s) or other family members
Address of student's family
Personal identifiers (e.g., SSN, institutionally assigned ID number)
List of characteristics or other information that make identity easily traceable*
*This includes, but is not limited to, factors such as physical description (race, sex, appearance, etc.); date and place of birth; religion; national origin; participation in sports, clubs, or other activities; academic performance; employment; disciplinary actions or criminal proceedings; and small sample or cell sizes in aggregated information.
The institution agrees to provide personally identifiable information to an investigator under conditions that do not require consent from the student and/or parent (34 CFR 99.31). If all four of the following constraints are met, the FERPA-2 form and a fully completed proposal must be submitted for IRB review.
The information will be released only to:
- A member of the institution formally deemed by an appropriate institutional official as having a legitimate educational interest; or
- An organization conducting the study for or on behalf of the institution
The purpose of the study is to:
- develop, validate, or administer predictive tests; or
- Administer student aid programs; or
- Improve instruction
- The information must be managed such that only the investigator(s) could possibly identify the participating students (and parents)
- The information must be destroyed when it is no longer needed for the study
The institution agrees to provide personally identifiable information to an investigator, but only with the permission of the individuals whose records will inform the study (34 CFR 99.30). In this situation, the institution collaborates with an investigator to contact individuals (i.e., recruit) in order to request permission to use their information. Written consent must be obtained and must include at least:
- Specification of the records to be disclosed;
- The specific purpose of the disclosure;
- Identification of to whom the information will be provided; and
- Offer to provide a copy of the disclosed information
This type of request requires submission of the FERPA-3 form and a fully completed proposal for IRB review.