Version Date: December 7, 2012
This guidance is designed to assist investigators with identifying when FERPA applies to human subjects research and when investigators must obtain consent for use of student education records for research purposes.
What is FERPA?
The Family Education Rights and Privacy Act (FERPA) is a federal law administered by the U.S. Department of Education; 34 CFR Part 99. FERPA applies to all educational agencies and institutions that receive federal funding from programs administered by the Secretary of the Department of Education. This includes virtually all public schools and school districts and most private and public postsecondary institutions, including medical and other professional schools. FERPA governs the privacy of personally identifiable information contained within student education records.
What student educational records are subject to FERPA?
Education records are those that are (1) directly related to a student, and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. Education records include (but are not limited to) class rosters, grade lists, student coursework (such as assignments, tests or quizzes), course evaluations, disciplinary records, and student health records maintained by the educational institution (e.g. those maintained by University Health Services).
Personally identifiable information includes (but is not limited to) identifiers directly related to the student, such as: student name, names of students’ parents and family members, address, social security number, student ID, or biometric record. Indirect identifiers include date of birth, place of birth, mother’s maiden name, and other information, alone or in combination, which may be used by a reasonable person within the community, who does not have personal knowledge of the relevant circumstances, to identify the student.
When does FERPA apply to Health Sciences research?
Examples of Health Sciences research using educational records include:
- Research conducted in educational settings, including medical schools, when the investigator will use an exam or course evaluation for a research purpose and the exam or course evaluation would be completed by the student regardless of the research.
- Studies that use class enrollment information or grades associated with a class.
- Research that uses student health records held by a university health clinic or data on the care received at a university health clinic (e.g. University Health Services).
What is needed for consent under FERPA?
Unless one of the exceptions to FERPA’s consent rule applies (see below), the use of personally identifiable information from educational records for research purposes requires documented, written consent. An electronic form with an electronic signature is allowed. The consent form must:
- Specify the records to be disclosed
- State the purpose of the disclosure
- Identify the party or class of parties to whom the disclosure is to be made
- Include a place for a date and signature of the student (who is either 18 years of age or older or who is attending a postsecondary educational institution), or his/her parent or guardian.
What are the exceptions to FERPA’s consent rule?
Exceptions allowing for the use of personally identifiable information from educational records for research purposes without consent include:
- The only personally identifiable information obtained constitutes “directory information” (see https://registrar.wisc.edu/ferpa_key_terms.htm) and the student has not opted out of having his/her information included in the directory. The Registrar’s Office maintains the list of students who have opted out of the directory.
- The release is to an authorized representative of state / local educational authorities for an audit or evaluation of federal or state supported education programs, or for the enforcement of or compliance with federal legal requirements related to those programs.
- The release is to organizations conducting studies for or on behalf of educational agencies or institutions to develop, validate or administer predictive tests; administer student aid programs; or improve instruction.
Per federal law, additional requirements apply. If you wish to obtain personally identifiable information from student education records without the consent of the student, you must complete the form titled, Request for Personally Identifiable Information from Student Education Records for Research Purposes.
If you are seeking to obtain information from student education records with the consent of the student or parent, you do not need to fill out this form. Rather, submit a copy of the signed consent form to the Office of the Registrar.