Using or Creating Educational Records for Research

Summary

FERPA applies when records are created or used for research, provided they were created while the student was enrolled at an educational institution. In that case, FERPA and IRB regulations apply.

Full Description

Any questions about FERPA-protected Information should be directed to: ferpa@wm.edu 

Definitions

Please note that these definitions are specific to William & Mary FERPA Policy. Other institutions may have different definitions/processes to access FERPA-protected information.  

• Family Educational Rights and Privacy Act (FERPA): federal law that protects the privacy of student education records.  
• FERPA Information: Includes education records, which are any documents, files, and/or other materials that contain information directly related to a student, are personally identifiable to that student, and are maintained by the University or a University agent.  
• Education Records include but are not limited to course grades and graded coursework, transcripts, class lists, student course schedules, health records, student financial information, and student discipline files. This information may be recorded in any way, including, but not limited to, handwriting, print, computer media, videotape, audiotape, film, microfilm, microfiche, and e-mail. 
• Personally Identifiable Information includes direct personal identifiers (such as a student’s Social Security number), indirect identifiers (such as a student’s date of birth or mother’s maiden name), and other information that alone or in combination is linked or linkable to a specific student that would allow a reasonable person to identify the student.  
• Medical information that is also in student records generally is not subject to additional protections, except for records of the Student Health Center and the Counseling Center that are protected by the Virginia Health Records Privacy Act.   
  • The Health Insurance Portability and Accountability Act of 1996 (HIPAA) does not apply to education records, even if these records contain medical information.  
  • HIPAA exempts education records from its privacy regulations, because these records are protected by FERPA. (See Section C of W&M FERPA policy) 
• “Readily Ascertainable”: If the researcher has access to a master list, and there are no indirect identifiers that could lead to re-identification, this is considered readily ascertainable. 
  •  Indirect identifiers that can be triangulated to re-identify an individual are considered “readily ascertainable.”  
  •  An investigator who obtains coded private information/specimens about or “from living individuals may unexpectedly learn the identity of one or more living individuals, or for previously unforeseen reasons now believe that it is important to identify the individual(s). If, as a result, the investigator knows, or may be able to readily ascertain, the identity of the individuals to whom the previously obtained private information or biospecimens pertain, then the research activity now would involve human subjects under the HHS regulations.”  
  •  When a researcher can re-identify an individual because of their access to technology or their access due to their role or expertise 
  •  When a researcher is accessing datasets that are individually de-identified but when paired together, can lead to re-identification, the datasets are considered re-identifiable.  
  • When one research team member has access to a master list linking identifiers to codes on the data.   
• Primary Data Collection: When a researcher implements an activity for research purposes that generates data.  
  •  If the researcher had NOT implemented the activity for the research project, the data would not exist.  
  • In the case of generating FERPA data as a part of research, primary data collection is when the researcher implements an activity solely for research purposes (such as an interview, survey, focus group, educational activity or educational intervention) and it is built into the curriculum at an educational institution where the activity implemented is required for the students to complete. 
• Secondary Data Collection: When a researcher wants to access information that has already been created/generated for any purpose other than the proposed research project. In the case of accessing secondary FERPA information as research data, this means that the FERPA information was, is, or will be generated regardless of the proposed research question being asked. 

Who governs FERPA-protected information at the institutional level?  

The William & Mary (W&M) FERPA Data Steward/institutional records holder is the University Registrar

Other institutions may have different definitions/processes to access FERPA-protected information. Researchers should contact the institution to determine how to access FERPA-protected information. 

What happens when researchers want to use FERPA-protected information for research?  

Both FERPA and the IRB regulations apply. The IRB protocol/application must specify how FERPA information will be accessed and how permission to access those records will be granted. It must also address how Informed Consent under the IRB regulations will be obtained. This can occur in the same document. Informed Consent cannot be waived if the project does not also meet the FERPA exception, under which FERPA records can be released without direct permission from the eligible student or their parent/guardian.  

Please note that while typically directory information does not require permission to access, W&M policy requires permission from the student or the W&M FERPA Data Steward 

 FERPA-protected education records can be generated when researchers implement an activity for research purposes in a required course at an educational institution. Permission must be sought to use those generated records.  

The W&M FERPA Data Steward must provide researchers with permission to access their own course records for research purposes, even if the researcher plans to de-identify the records before analysis. This is because faculty cannot give themselves permission to use FERPA information for research purposes, as it violates FERPA and is unethical.  

Examples when FERPA does apply

1. Use of identifiable/re-identifiable student grades or test/quiz scores for research purposes
2. Use of identifiable/re-identifiable student writing (e.g., Canvas posts, class writing exercises, correspondence about a course) for research purposes  
3. Students in a specific class are required to participate in an activity (e.g., complete a survey, participate in a focus group, etc.) as part of the class requirements, and the outcomes/responses will also be used for research purposes.
4. Observation of students’ behavior in the classroom for research purposes, and the students are recorded by the instructor or other school official (audio/video) 

Examples when FERPA does not apply 

1. 1. Observation of students’ behavior in the classroom for research purposes, and the researcher is only watching students and taking notes or only the researcher is recording the events. 
   2. Student evaluations of instructors unless this is implemented solely due to answering a research question.  
   3. Student course evaluations that will only be used to improve instruction, with no intention to generalize or publish findings 
   4. Use of de-identified student grades or other student records for research purposes, if obtained in a de-identified format and the researcher cannot re-identify an individual from the records. 

How do researchers obtain “permission” to access educational records?  

• Researchers should first seek direct permission from the adult students or the parents/guardians of the minor students/participants.  
  • FERPA requires specific language in the permission forms, and signatures must be obtained. 
  • A researcher can combine Informed Consent and FERPA Permission into a single document. See FERPA consent templates on the W&M website depending on the review level of your research protocol. 
• If it is not feasible to obtain direct permission from the adult student, or if the student is a minor, the student and their parent/guardian, your proposed project must be eligible for the “FERPA Exception” and be granted permission by an institutional records holder. 
  
  • At W&M, researchers must complete the Request to Access FERPA-Protected Information Form that is routed to the University Registrar 
  • Feasible means that it would be impossible to contact the students, or that requesting permission from them would increase risk. Stating that the “students are no longer in your class” must be coupled with an additional reason you cannot access them. For example, if the students graduated more than five years ago, it would most likely not be feasible to request permission from them. You must justify in your IRB application/protocol why direct permission is not feasible.  
  • Permission from the FERPA records holder can happen concurrently with the IRB review process. However, if the records holder denies your request after the IRB protocol has been approved, you must submit a modification to either:   
    • Update your IRB protocol to remove use of the FERPA information, or  
    • Request FERPA permission directly from the students/participants or the parent/guardian of the minor students/participants  
• The IRB cannot override the decision of the institutional records holder regarding access to FERPA records.  

Request to Access W&M FERPA-Protected Information (Qualtrics form)

 IRB Review Process:  

1.  First, determine whether you are using primary data collection, secondary data, or both 
   • If both primary and secondary data are used, determine one type at a time. If the result for one option warrants expedited review, the entire study must be reviewed at the expedited level. 
2. Use the Education Research Flow Chart (Canva) or information below to determine the review category for your research 

Primary Data Collection Review Process: 

• If you will be generating FERPA-protected information as part of the educational intervention, you must obtain signed permission from adult students or, if the student is a minor, the student and their parent/guardian prior to implementing the intervention. 
• Your study could be reviewed as either Exempt 1, Exempt 3, FLEX exempt, or Expedited 7, depending on the research population and procedures. 
  • Exempt 1: Your study will be reviewed under Exempt 1 if you are seeking to implement an educational intervention for research purposes:
    • that will take place in a normal educational environment, 
    • is related to the education/training taking place, and  
    • will not adversely impact students' opportunity to learn required educational content or the assessment of educators who provide instruction 
    • Example: implementing a new literacy curriculum for an entire class of students to improve reading skills, or implementing a course evaluation that includes a survey students are required to complete as part of the course. 
  • Exempt 3: Your study will be reviewed under Exempt 3 if you are seeking to implement an educational intervention for research purposes: 
    • Includes only adult participants (+18 y/o) 
    • If it meets one or more of the following 
      1. that will not take place in a normal educational environment,  
      2. is not related to the education/training taking place, or  
      3. will adversely impact students' opportunity to learn required educational content or the assessment of educators who provide instruction 
  • FLEX Exempt: Your study will be reviewed under W&M FLEX Exempt if you are seeking to implement an educational intervention for research purposes that includes minor participants (<18 y/o). If it meets one or more of the following: 
    • that will not take place in a normal educational environment,
    • is not related to the education/training taking place, or
    • will adversely impact students' opportunity to learn required educational content or the assessment of educators who provide instruction 
    • Meets all the criteria to be reviewed under FLEX Exempt. A study is only eligible for W&M FLEX exemption if it is not:  
      • externally funded or has potential to ever be externally funded; or 
      • is subject to additional contractual terms or regulations from any agency institution; or 
      • is considered cooperative research 
  • Expedited 7: Your study will be reviewed under W&M Expedited Category 7 if you are seeking to implement an educational intervention for research purposes that includes minor participants (<18 y/o) or adult participants. If the intervention meets one or more of the following:  
    • will not take place in a normal educational environment,
    • is not related to the education/training taking place, or
    • will adversely impact students' opportunity to learn required educational content or the assessment of educators who provide instruction, and
    • Does not meet all the criteria to be reviewed under FLEX Exempt

Secondary Data Collection Review Process 

Your study could be reviewed as either exempt 1, FLEX exempt, or expedited 5 depending on the identifiability of the secondary information, the timing of permission and consent, and if the study is funded, collaborative, or contractually obligated to follow certain rules.  

• Exempt 1: Studies using FERPA information as secondary data can be eligible under Exempt 1 if: 
  • The identities of the students are “readily ascertainable,” to anyone on the research team at any point; or  
  • The data was/is identifiable or re-identifiable to anyone on the research team at any point. 
  • You are granted prospective permission to access the FERPA information for research. The permission is either granted by:  
    • the adult student or the parent/guardian of the minor to access their FERPA information for research. 
    • institutional records holder for the access and use of FERPA records as research data 
    • Permission from the institutional records holder can happen concurrently with the IRB review.  However, if you do not get permission, you cannot use the records for research and must submit a modification to the protocol (see above section of this Guidance) 
• FLEX Exempt: Your study will be reviewed under W&M FLEX Exempt if you want to access past identifiable/re-identifiable FERPA information where you must get “records release” permission, and you cannot get informed consent from students or their parents/guardians. If it meets all the criteria to be reviewed under FLEX Exempt. A study is only eligible for W&M FLEX exemption if it is not: 
  • externally funded or has potential to ever be externally funded; 
  • is subject to additional contractual terms or regulations from any agency institution; or 
  • is considered cooperative research 
• Expedited 5: Your study will be reviewed under Expedited 5 if you want to access past identifiable/re-identifiable FERPA information where you must get “records release” permission and cannot get prospective FERPA permission from eligible students or their parents/guardians or prospective Informed Consent from eligible students or their guardians under the IRB regulations and your study is: 
  • externally funded or has potential to ever be externally funded; or 
  • is subject to additional contractual terms or regulations from any agency institution; or 
  • is considered cooperative research

References list for guidance

References:  Federal Law: https://studentprivacy.ed.gov/ferpa   W&M FERPA Policy: https://www.wm.edu/offices/registrar/confidentiality-privacy/ferpa-policy/   OSU: https://research.oregonstate.edu/ori/irb/policies-and-guidance-investigators/decision-trees/ferpa-applicability-research   Cornell: https://researchservices.cornell.edu/resources/use-student-data-human-participant-research   NC State: https://research.ncsu.edu/administration/compliance/research-compliance/irb/irb-policies-rules-and-regulations/   UNM: https://irb.unm.edu/library/documents/guidance/family-educational-rights-and-privacy-act-ferpa.pdf