Family Education Rights and Privacy Act (FERPA) Guidance

Version Date: December 7, 2012

This guidance is designed to assist investigators with identifying when FERPA applies to human subjects research and when investigators must obtain consent for use of student education records for research purposes.

What is FERPA?

The Family Education Rights and Privacy Act (FERPA) is a federal law administered by the U.S. Department of Education; 34 CFR Part 99. FERPA applies to all educational agencies and institutions that receive federal funding from programs administered by the Secretary of the Department of Education.  This includes virtually all public schools and school districts and most private and public postsecondary institutions, including medical and other professional schools. FERPA governs the privacy of personally identifiable information contained within student education records.

What student educational records are subject to FERPA?

Education records are those that are (1) directly related to a student, and (2) maintained by an educational agency or institution or by a party acting for the agency or institution.  Education records include (but are not limited to) class rosters, grade lists, student coursework (such as assignments, tests or quizzes), course evaluations, disciplinary records, and student health records maintained by the educational institution (e.g. those maintained by University Health Services).

Personally identifiable information includes (but is not limited to) identifiers directly related to the student, such as: student name, names of students’ parents and family members, address, social security number, student ID, or biometric record. Indirect identifiers include date of birth, place of birth, mother’s maiden name, and other information, alone or in combination, which may be used by a reasonable person within the community, who does not have personal knowledge of the relevant circumstances, to identify the student.

When does FERPA apply to Health Sciences research?

Examples of Health Sciences research using educational records include:

What is needed for consent under FERPA?

Unless one of the exceptions to FERPA’s consent rule applies (see below), the use of personally identifiable information from educational records for research purposes requires documented, written consent. An electronic form with an electronic signature is allowed. The consent form must:

What are the exceptions to FERPA’s consent rule?

Exceptions allowing for the use of personally identifiable information from educational records for research purposes without consent include:

Per federal law, additional requirements apply. If you wish to obtain personally identifiable information from student education records without the consent of the student, you must complete the form titled, Request for Personally Identifiable Information from Student Education Records for Research Purposes.

If you are seeking to obtain information from student education records with the consent of the student or parent, you do not need to fill out this form. Rather, submit a copy of the signed consent form to the Office of the Registrar.