Release of Student Education Record Information for Research

FERPA (Family Education Rights and Privacy Act) refers to a federal law that protects the privacy of individuals' educational record information. An educational record is defined as any information recorded in any way—including, but not limited to, handwriting, print, computer media, videotape or audiotape, electronic files, film, microfilm, and microfiche—that are maintained by education agencies or institutions, or individuals acting on their behalf. Personal notes by teachers or other staff, kept in the sole possession of the maker, used only as a memory aid, and not accessible or revealed to any other person except a temporary substitute, are not considered part of the education record (34 CFR 99.3). Instructors' grading records are educational records.


An educational institution is legally responsible for vigorously protecting student education record confidentiality and restricting the usage of that information. This personal information was not gathered for research purposes; however, such information often does constitute a rich resource for important research pursuits. Thus, there are clearly defined processes through which investigators may access such data. These processes are designed to protect the rights of the individuals from whom these data originate. To facilitate this process of releasing records and maintaining individuals' privacy, the roles of the IRB, the investigator, and the educational institution are critical and exacting. These types of research projects tend to fall into one of the three categories summarized below.

The institution agrees to provide de-identified information to an investigator (34 CFR 99.3). This means that the investigator is absolutely prevented from knowing or determining the identity of any individual whose data informs the study. The means by which identities are censored by the institution range from a formal prohibition to destroying any sort of master key used to organize the data set before release to the investigator. Specific and general elements relating to identity must be excluded (see Table 1). If these conditions are met, the FERPA-1 form, whereby the institution and the investigator attest to these constraints, is used to register with the IRB.


Table 1. List of identifiers that cannot be included in a de-identified data set.
Student name
Address of student
Name of parent(s) or other family members
Address of student's family
Personal identifiers (e.g., SSN, institutionally assigned ID number)

List of characteristics or other information that make identity easily traceable*

*This includes, but is not limited to, factors such as physical description (race, sex, appearance, etc.); date and place of birth; religion; national origin; participation in sports, clubs, or other activities; academic performance; employment; disciplinary actions or criminal proceedings; and small sample or cell sizes in aggregated information.


The institution agrees to provide personally identifiable information to an investigator under conditions that do not require consent from the student and/or parent (34 CFR 99.31). If all four of the following constraints are met, the FERPA-2 form and a fully completed proposal must be submitted for IRB review.

The institution agrees to provide personally identifiable information to an investigator, but only with the permission of the individuals whose records will inform the study (34 CFR 99.30). In this situation, the institution collaborates with an investigator to contact individuals (i.e., recruit) in order to request permission to use their information. Written consent must be obtained and must include at least:

This type of request requires submission of the FERPA-3 form and a fully completed proposal for IRB review.

For questions about submission requirements and schedule changes, please contact your school's IRB representative or