Overview
If you plan to obtain information from student education records as part of your research, be aware that the Federal Education Rights and Privacy Act (FERPA) sets forth consent requirements (and exceptions) for accessing information in education records.
FERPA is a federal law that regulates the disclosure of personally identifiable information from education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. FERPA stipulates that an educational institution has the authority to determine what information may be accessed from an education record. If an institution denies an investigator access to information in an education record, the IRB cannot overrule the decision.
FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when the student reaches the age of 18 or attends a school beyond the high school level (referred to as "eligible students"). As a general rule, schools must have written permission from the parent or eligible student to release information from a student's education record. Unless research that falls within FERPA qualifies for an exception under FERPA to the general rule of parental/eligible student consent, the IRB cannot waive consent.
FERPA regulations specify that a parent or eligible student must provide a signed and dated written consent for disclosure of personally identifiable information from education records, unless the disclosure falls within one of the exceptions discussed below. FERPA's consent provisions require that the consent information be specific about the records that may be disclosed, the purpose of the disclosure, and the identify of the individual or group to which the records will be disclosed.
Education records can be disclosed to school officials who have a legitimate educational interest without consent from the parent/eligible student under FERPA. Many educators who are also researchers are surprised to find that the education records they personally hold (e.g., graded student work, tests, journals, written assignments, etc.) are considered part of the official education records of a student. Even more surprising is the fact that, when conducting research, an educator may not be considered to have a legitimate educational interest in the records they otherwise handle on a regular basis. Please note: information provided directly by students to researchers that is not part of a class-related graded assigment is not subject to FERPA.
What are education records?
- Records — handwriting, print, computer, videotape, audiotape, film, microfilm, microfiche, or e-mail — of an institution that
- Contain information directly related to the student and
- Are maintained by an agency or institution or party acting in its behalf.
- Records/notes in sole possession of maker not accessible or revealed to any other person except a temporary substitute
- Medical records
- Employment records when employment is not contingent on being a student, provided the record is used only in relation to the individual's employment
- Records created and maintained by a law enforcement unit used only for that purpose, is revealed only to law enforcement agencies of the same jurisdiction, and the enforcement unit does not have access to education records
- Information on a person that was obtained when no longer a student (i.e., alumni records) and does not relate to the person as a student
Exceptions to the general rule of parental/student consent under FERPA:
FERPA sets out various exceptions to the general rule that consent must be obtained for release of personally identifiable information from education records. The exceptions most likely to be relevant for Lehigh University researchers are described below:
Directory information:
FERPA allows schools to designate and disclose, without consent, certain items of information as "directory information”, such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance.
Each educational institution designates what information is considered directory information. FERPA requires that students be given the opportunity to file a request to prevent disclosure of directory information, commonly known as “opting out”. An institution will not release any information on a student, even directory information, if a student has “opted out”.
The Investigator should contact each institution from which he/she proposes to access education records and follow that institution’s FERPA policy and procedures when accessing directory information.
- Address
- Telephone listings
- E-mail address
- Photograph
- Major Field of Study
- Participation in officially recognized activities and sports
- Weight and height of members of athletic teams
- Dates of Attendance
- Enrollment Status
- Degrees and awards received
- Most recent previous educational institution attended by the student
De-identified information:
An educational institution may release information from education records without the consent required under FERPA after all personally identifiable information has been removed from the records, provided that the educational institution has made a reasonable determination that a student's identity would not be personally identifiable. Thus, a school official with legitimate access (other than the researcher) may strip the records of any identifying information and provide the data to the researcher.
Use of coded data: An educational institution can release de-identified student level data from education records for the purpose of education research by attaching a code to each record that may allow the recipient to match information, provided that the educational institution does not disclose any information about how it generated and assigned the code, or that would allow the recipient to identify a student based on a code; the code is not used for any purpose other than identifying a de-identified record for purposes of education research; and the code is not based on a student's social security number or other personal information.
Research conducted for or on behalf of educational institutions:
Personally identifiable information (PII) from education records may be disclosed by an educational institution/agency to researchers when the disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions to: 1) develop, validate, or administer predictive tests; 2) administer student aid programs; or 3) improve instruction. If PII from education records will be disclosed to a researcher under this exception, the researcher must enter into a written agreement with the educational institution that contains specific assurances on data confidentiality. See 34 CFR Section 99.31(a)(6).