This section of the Investigator Manual outlines when the Family Educational Rights and Privacy Act (FERPA) human research.
FERPA Overview
If a researcher wishes to use student education records as part of a research study, the Family Education Rights and Privacy Act (FERPA) generally applies. FERPA is a Federal law administered by the U.S. Department of Education; 34 CFR Part 99. FERPA applies to all educational agencies and institutions that receive federal funding. FERPA aims to protect the privacy of Student Education Records. Education records include any record containing personally identifiable information (PII) directly related to the student. PII is not limited to name but may include indirect identifiers as well. Note that student medical records from University Health Services (UHS) are considered student records and subject to FERPA regulations.
To use student records for research purposes, you must first obtain informed consent from those students (with certain exceptions) or from the parents/guardians when the student is a minor.
Examples of research using educational records include:
- Research conducted in educational settings, including medical schools, when the investigator will use an exam or course evaluation for a research purpose and the exam or course evaluation would be completed by the student regardless of the research.
- Research that uses student health records held by a university health clinic or data on the care received at a university health clinic (e.g. University Health Services).
- Research involving documents with a student’s name, ID number, or other identifier
For details on FERPA requirements in human research, refer to HRP 331-WORKSHEET-FERPA Compliance. Additional information about FERPA may also be found on the Office of the Registrar’s website.
Review Requirements
The researcher must specify the exact fields that will be requested/obtained from academic records. This includes indicating the number of data pulls that are being requested (one time, each semester, for the participant’s entire time at UW-Madison) and detailing how data will be obtained (from Registrar’s Office, from departmental administrator, etc.).
De-identified student records may not require consent, but de-identification requires more than just removing names or ID numbers. De-identification to FERPA standards requires that all direct and indirect identifiers that could be used in combination to identify an individual be removed; for example, demographic information that creates small cells of individuals must be removed from a data set.
Consent is required for access to identifiable student records for research purposes, with limited exceptions. It is the researcher’s responsibility to obtain consent that is IRB approved and FERPA compliant. If the consent language and consent process do not meet the requirements of FERPA, FERPA-protected data from the student record generally cannot be released to researchers. Researchers are strongly encouraged to consult with the Office of the Registrar (for UW-Madison) or staff with a similar role (for K-12 districts/schools) early in the planning of studies that will include a request for information from the FERPA-protected student record.
In order to address FERPA, electronic consent must not only include a statement of the records to be disclosed, for what purpose, and to whom, but must also include a process to 1) identify and authenticate the person providing consent; and 2) indicate this person’s approval of the information contained in the electronic consent.
Exceptions to Consent
Information that constitutes “directory information”, as designed by the university here, may be accessed for research purposes without consent.
For UW-Madison educational records: Under limited circumstances, a DUA may be obtained in lieu of consent. A determination must be made by the Registrar’s Office that the research is being conducted for or on behalf of the institution in order to develop, validate, or administer predictive tests; administer student aid programs; or improve instruction. If this determination is made, the Registrar’s Office will enter into a DUA with the researcher.
For UHS records:
- When not obtaining consent of the students, someone in UHS administration, acting as a school official, can de-identify the records and release the records to the study team without the consent that would otherwise be required by FERPA to conduct this research provided that the UHS administrator makes “a reasonable determination that a student’s identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information.”
- UHS records can be accessed by researchers without consent under an exception for school officials, including faculty, within the institution that have a “legitimate educational interest.” However, it only applies to clinician/researchers conducting clinical research. This is because as part of their job duties, clinician/researchers who conduct clinical research have a “legitimate educational interest” in research using medical records. At present, this would be applicable to those individuals with appointments within UHS or health sciences schools (SMPH, SoN or SoP), if the latter group were given access to the record from UHS, when the research is designed to assess or improve the quality of care provided to students by the university, and/or to understand and address health problems or conditions that may affect their academic performance or retention.
- This would NOT apply to the faculty/professors who conduct more typical educational research (e.g., those in Education, Business, etc.). Those research projects would still need to fall under the exception for research designed develop, validate, administer predictive tests; to improve instruction; or to administer student aid programs.
Additional Considerations
- For research at educational sites outside UW-Madison there may be policies or procedures specific to external research studies to be conducted at the site that could affect/inform research design. It is acceptable prior to IRB approval for UW research teams to reach out to the entities at those sites (e.g. K-12 district administration) to inquire about applicable policies/procedures ONLY. Any communications with these entities that would be considered recruitment for human subjects research should NOT be done without first obtaining IRB approval.
- Interns, residents, and fellows are not students; these records are not considered “education records” subject to FERPA
- Once directory information is combined with non-directory information, it ceases to be directory information.
- In many cases student education records are accessible to and used by instructors, teachers, and administrators for the purposes of conducting the duties of their job. For example, as part of a teacher’s job, there is natural access to student’s assignments, test scores, and attendance records in order to evaluate performance and ultimately assign a grade. However, this same teacher cannot use this natural access for other intents and purposes, such as research. If a teacher/instructor wants to use student data for research purposes, FERPA applies and consent is required, unless one of the exceptions to consent as outlined in FERPA is met. The study team should check with the Registrar’s Office to ensure compliance with campus policy.
- UW employees who have access to student academic records as part of their position at the university may NOT provide data to faculty or staff for research purposes. Only the Registrar’s Office has the authority to make those determinations.