Overview

If you plan to obtain information from student education records as part of your research, be aware that the Federal Education Rights and Privacy Act (FERPA) sets forth consent requirements (and exceptions) for accessing information in education records., with parental consent (if the student is in K-12) or student’s consent (for students 18 or older or at a postsecondary institution.)

For more information on FERPA, please review Lehigh University’s FERPA Policy.

Please note: FERPA applies to students of any institution that receives funds from the US Department of Education; these requirements are not limited to Lehigh students. 

If an institution denies an investigator access to information in an education record, the IRB cannot overrule the decision.

As a general rule, schools must have written permission from the parent (K-12) or eligible student (over age 18 or at a postsecondary institution) to release information from a student's education record. Please consult with representatives from your partner school(s) to ensure you are meeting all FERPA requirements as you conduct your research. When FERPA authorization is required,  schools should supply the FERPA authorization forms that must be completed by parents and eligible students. Please submit a copy of the FERPA authorization forms that will be sent to parents and eligible students as part of your IRB protocol.

Unless the research qualifies for a FERPA exception to the general rule of parental/eligible student consent, the IRB cannot waive consent.

Please note: information provided directly by students to researchers that is not part of a class-related graded assignment may not be subject to FERPA.  

Exceptions to the general rule of parental/student consent under FERPA

FERPA sets out various exceptions to the general rule that consent must be obtained for release of personally identifiable information from education records.  The exceptions most likely to be relevant for Lehigh University researchers are described below.

Directory information

FERPA allows schools to designate and disclose, without consent, certain items of information as "directory information”, such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance.
Each educational institution designates what information is considered directory information. FERPA requires that students be given the opportunity to file a request to prevent disclosure of directory information, commonly known as “opting out”. An institution will not release any information on a student, even directory information, if a student has “opted out”.
The Investigator should contact each institution from which they propose to access education records and follow that institution’s FERPA policy and procedures when accessing directory information.

Under FERPA, the following items may be considered directory information:

  • Address
  • Telephone listings
  • E-mail address
  • Photograph
  • Major Field of Study
  • Participation in officially recognized activities and sports
  • Weight and height of members of athletic teams
  • Dates of Attendance
  • Enrollment Status
  • Degrees and awards received
  • Most recent previous educational institution attended by the student
De-identified information

An educational institution may release information from education records without the consent required under FERPA after all personally identifiable information has been removed from the records, provided that the educational institution has made a reasonable determination that a student's identity would not be personally identifiable.  Thus, a school official with legitimate access (other than the researcher) may strip the records of any identifying information and provide the data to the researcher.

Use of coded data: An educational institution can release de-identified student level data from education records for the purpose of education research by attaching a code to each record that may allow the recipient to match information, provided that the educational institution does not disclose any information about how it generated and assigned the code, or that would allow the recipient to identify a student based on a code; the code is not used for any purpose other than identifying a de-identified record for purposes of education research; and the code is not based on a student's social security number or other personal information.

Research conducted for or on behalf of educational institutions

Personally identifiable information (PII) from education records may be disclosed by an educational institution/agency to researchers when the disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions to: 1) develop, validate, or administer predictive tests; 2) administer student aid programs; or 3) improve instruction.  If PII from education records will be disclosed to a researcher under this exception, the researcher must enter into a written agreement with the educational institution that contains specific assurances on data confidentiality.  See 34 CFR Section 99.31(a)(6).

For information about how FERPA applies for studies conducted with Lehigh students, please visit the Lehigh registrar’s website at https://ras.lehigh.edu/content/policies#privacy
 
Lehigh provides guidance for faculty's general responsibilities surrounding FERPA: https://ras.lehigh.edu/content/facultystaff-guides/ferpa-faculty
 
For information about how FERPA applies to students at another institution where the research will be conducted, please contact that institution.
 
For further information on FERPA, see the U.S. Department of Education website at http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html. 
 
U.S. Department of Education webinars explaining FERPA are very informative and are available online at: http://www2.ed.gov/policy/gen/guid/fpco/hottopics/index.html
 
This guidance was adapted from the Unversity of Chicago webpage "Research in Schools and with Education Records" and the University of Kentucky Registar webpage "FERPA & Privacy"