FERPA Requirements

If your study involves data from student education records (e.g. class work, grades, attendance records, communications, projects, classroom tests, standardized tests, journals, SAT/ACT scores, etc.) you will need to be mindful of the FERPA requirements. Please note that this list of records is not exhaustive and FERPA regulations apply even when you are using your own records (from your classes/students) that you may already have. Please see section 1.6 of the IRB manual for more information on FERPA records.

 

Existing, De-identified Records: If you are obtaining or using existing education records that have been completely de-identified and contain no personally identifiable information, you need to explain in the IRB application how the records will be kept safe and confidential. De-identified records must not contain names, addresses, phone numbers, emails, student numbers, etc. and there can be no link or code that connects the data with any identifying information.

Identifiable Records with Informed Consent: For existing education records that contain personally identifiable information, and/or for access to education records that will be created during your research, you can obtain permission for access to the records in the informed consent form. The consent form must contain all the required elements of consent (as found in the model informed consent form) and include a description of the records that will be disclosed, the purpose of the disclosure, and to whom records are being disclosed. If any students are under 18, parental permission must be obtained. In some cases, you may be able to justify a waiver of consent for the parental permission. The FERPA requirements can be met with a waiver of parental permission as long as the student still signs the consent form. A waiver of documentation of consent or a waiver of consent for the student participant can only be used if the researcher is a “school official” with a “legitimate educational interest.” According to GSU’s FERPA Policy, a “school official” includes a person employed by the University in an administrative, supervisory, academic, research, or support staff position. The FERPA Policy also states that a school official has a legitimate educational interest if, among other things, the official is performing a task that is specified in his or her position description or contract agreement. Therefore, those GSU employees whose job descriptions include conducting research would be considered school officials with a legitimate educational interest. Students conducting research for academic/coursework purposes (as opposed to their employment by GSU) may not view any identifiable data without consent. If the researcher is collaborating with another researcher not employed by GSU, he or she must de-identify the information before disclosing it to the other researcher. If the outside researcher needs access to identifiable information, the GSU researcher should contact the Office of Legal Affairs for assistance prior to submitting the IRB application.

Identifiable Records without Informed Consent: For existing education records that contain personally identifiable information, and/or for access to education records that will be created during your research, you may be able to request and justify a waiver of consent for the use of the data under FERPA if you are a “school official” with a “legitimate educational interest.” According to GSU’s FERPA Policy, a “school official” includes a person employed by the University in an administrative, supervisory, academic, research, or support staff position. The FERPA Policy also states that a school official has a legitimate educational interest if, among other things, the official is performing a task that is specified in his or her position description or contract agreement. Therefore, those GSU employees whose job descriptions include conducting research would be considered school officials with a legitimate educational interest. Students conducting research for academic/coursework purposes (as opposed to pursuant to their employment by GSU) may not view any identifiable data without consent. If the researcher is collaborating with another researcher not employed by GSU, he or she must de-identify the information before disclosing it to the other researcher. If the outside researcher needs access to identifiable information, the GSU researcher should contact the Office of Legal Affairs for assistance prior to submitting the IRB application.

De-identified Records: A letter from the educational institution maintaining the education records must be attached to the IRB application. The letter must indicate approval to conduct the study at/with that institution, the educational institution’s commitment to FERPA compliance, and an explanation as to how the data will be de-identified. The FERPA compliance commitment can just be a brief statement that they follow FERPA and are in compliance. The explanation of how the educational records will be de-identified should include a statement that no personally identifying information will be available to the researcher. De-identified records must not contain names, addresses, phone numbers, emails, student numbers, etc. and there can be no link or code that connects the data with any identifying information.

Identifiable Records with Informed Consent: For educational records that are personally identifiable and signed informed consent is obtained, a letter of permission must be uploaded to the application from the school or institution from which the records are obtained. The letter must indicate approval for the research to be conducted at or educational records obtained from the institution, the education institution’s commitment to FERPA compliance, and an explanation as to how the FERPA consent will be obtained (e.g. FERPA release provided by educational institution). The FERPA compliance commitment can just be a brief statement that they follow FERPA and are in compliance. Many schools have a separate FERPA release form that is signed to release the records to a third party. If the school elects to use such a form, the school is responsible for ensuring the form is signed before the informed consent form and before any release or collection of data. If the students are under 18 the FERPA release should be signed by the parent/guardian. Some schools may ask that FERPA information be included in the informed consent forms. If this is the case, the consent form must contain all the required elements of consent (as found in the model informed consent form) and include a description of the records that will be disclosed, the purpose of the disclosure, and to whom records are being disclosed. If any students are under 18 years old, parental/guardian permission must be obtained. If the FERPA information is included in the consent form, it must be signed – the IRB cannot approve use of the waiver of documentation of consent unless the researcher is a school official with a legitimate education purpose (see the section, identifiable records and no consent, with a school official).

Identifiable Records and no Consent, with a School Official: Identifiable education records with no informed consent can be obtained if the researcher is a “school official” collecting or obtaining data for a “legitimate educational purpose”. This means the researcher must be an employee or other school official that has access to the records because he or she is involved in the education of the student. A letter from the educational institution or school must be attached to the IRB application. The letter must indicate approval for the research to be conducted at or data obtained from the institution, the education institution’s commitment to FERPA compliance, and verification by the educational institution that the investigator is a “school official” with a “legitimate educational purpose.” The FERPA compliance commitment can just be a brief statement that they follow FERPA and are in compliance. In this case, only the school official can have access to any identifiable education records. Any other researchers associated with the study cannot have access to personally identifiable education records if they are not school officials with a legitimate educational purpose.

Identifiable Records and no Consent, with a Contract: Identifiable education records with no informed consent can be obtained if GSU has contracted with an educational institution to develop, validate, or administer predictive tests; administer study aid programs; or improve student instruction. The fully executed contract that has been approved by the Office of Legal Affairs or the Office of Sponsored Programs and Awards for the services must be attached in the documents section of the IRB application.