Family Educational Rights and Privacy Act (FERPA)

FERPA is a federal law protecting the privacy of student education records. FERPA applies to both adult learners and children who are students. Generally, researchers must obtain signed, written permission from a parent or eligible student before accessing personally identifiable information from education records. 

While there are limited exceptions to written consent under FERPA (such as specific studies conducted for or on behalf of schools), researchers should generally anticipate needing signed written parental permission to access identifiable education records. 

Any plans to obtain FERPA-protected data without signed written consent will need to be discussed with the educational institution to determine if an exception is allowable. 

Applicability 

FERPA applies when research involves the use or disclosure of education records. For FERPA to apply, these records must be directly related to a student and maintained by an educational agency or institution. 

  • Where it Applies: FERPA applies to institutions receiving U.S. Department of Education funding, including public schools, Local Educational Agencies (LEAs), and postsecondary institutions (like the UO). Private and parochial K-12 schools generally do not receive this funding and are exempt, but researchers should always verify with the school.

Key Definitions

  • Disclosure: A disclosure under FERPA means accessing, releasing, transferring, or other communication of personally identifiable information contained in education records by any means to any party except the party identified as the party that provided or created the record. When teachers or school officials access identifiable education records for research purposes that are not considered a legitimate educational interest necessary to fulfill their professional duties, that access is FERPA regulated even if they never send identifiable data to external researchers. 
     
  • Education records: materials directly related to a student and maintained by an educational agency or institution. These include academic records such as grades, transcripts, and class schedules; applications for enrolled students; attendance records; assignments, discussion board posts; student financial records and special education records such as Individualized Education Programs (IEPs) and related assessments. 
     
  • Students:  any individual who is or has been in attendance at a school. 
     
  • Personally Identifiable Information (PII) includes, but is not limited to:
    • The student's name;
    • The name of the student's parent or other family members;
    • The address of the student or student's family;
    • A personal identifier, such as the student's social security number, student number, or biometric record; Note: biometric records are measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints, retina and iris patterns, voiceprints, DNA sequences, facial characteristics, and handwriting.

FERPA Requirements Impacting Human Subjects Research

Unless a formal FERPA exception is granted by the educational institution holding the records, researchers must obtain signed and dated written consent from the parent (or adult student) before accessing records. 

  • No Passive Consent: Opt-out or passive consent does not meet FERPA requirements. However, exceptions may be possible.
  • Electronic Signatures: Must identify and authenticate a specific person as the source of the consent.
  • Required Consent Elements: In addition to standard IRB requirements, a FERPA consent form must specify:
    1. The specific education records to be disclosed.
    2. The purpose of the disclosure.
    3. The specific party or class of parties receiving the records.
    4. A statement that the school will provide a copy of the disclosed records to the parent/student upon request.
  • Requesting a FERPA Review: All studies involving FERPA protected data associated with UO students will need review by the UO registrar. For non-UO institutions, the official responsible for conducting the FERPA review may vary. The RCS/IRB cannot grant a FERPA exception; it must be granted by the educational institution holding the records. 
    • For UO Records: Contact the UO Registrar (email both registrar@uoregon.edu  and kaira@uoregon.edu).
    • For Non-UO Schools: The decision-maker varies (e.g., Principal, District Privacy Official, or Registrar).