FERPA (Family Educational Rights and Privacy Act)

FERPA — the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99) — is the U.S. federal law that gives eligible students privacy rights over their education records and restricts any institution receiving U.S. Department of Education funds from disclosing personally identifiable information from those records without consent. For research administrators, the operational question is narrower than “what is FERPA”: a project is subject to FERPA whenever it accesses, uses, or receives education records the institution already maintains on students — transcripts, grades, enrollment status, financial aid data, disciplinary records — as distinct from data a researcher collects directly from consenting participants. When a study touches records the registrar, financial aid office, or student information system already holds, the institution may disclose them only under a recognized FERPA exception (most commonly the school-official exception for internal researchers or the studies exception for external ones) or with the written consent of the eligible student. FERPA is a separate legal requirement from IRB/Common Rule human-subjects review — a study can need both, one, or neither, and clearing one does not automatically clear the other (see below).

When a research project falls under FERPA

FERPA applies to any public or private elementary, secondary, or postsecondary institution that receives funding under a program administered by the U.S. Department of Education — which in practice covers essentially every U.S. college and university. It governs education records: records directly related to a student and maintained by the institution or a party acting for the institution (34 CFR § 99.3). Once a student turns 18 or enrolls in a postsecondary institution at any age, FERPA rights transfer from the parent to the student (the “eligible student”).

The practical trigger for a research administrator is whether a project needs the institution to disclose records it already holds, versus collecting new data directly from participants:

• Covered by FERPA: pulling transcript, GPA, enrollment, advising, or financial-aid records from the student information system to study retention, learning analytics, or program outcomes; a school district sharing identifiable student records with an outside evaluator; an institutional-research office matching survey responses to academic records by student ID.
• Not education records under FERPA: data a researcher collects directly from participants who consent to take part (a new survey, an interview, biospecimens collected for the study) — that data was never part of the institution’s existing education records, so FERPA’s disclosure restrictions do not apply to it, even though it may still require IRB review as human-subjects research.

The school-official exception: internal research and analytics

Under 34 CFR § 99.31(a)(1), an institution may disclose education records without consent to “school officials…whom the [institution] has determined to have legitimate educational interests.” This is the exception that covers most internal institutional research: an institutional-research office, an internal program evaluator, or an employee of the institution analyzing student records to improve instruction, retention, or advising can typically rely on it, provided the institution has formally designated that legitimate educational interest (usually in its annual FERPA notification or a data-governance policy). Contractors and consultants can also qualify as “school officials” if they (a) perform an institutional function under the institution’s direct control over the use and maintenance of the records, and (b) are subject to the same redisclosure restrictions that apply to the institution itself. A common failure mode: assuming a school-official designation for an external research collaborator who is not actually under the institution’s direct control — that arrangement needs the studies exception instead, not a stretched school-official designation.

The studies exception: external researchers and data-sharing agreements

34 CFR § 99.31(a)(6) — commonly called the studies exception (the U.S. Department of Education’s own guidance is explicit that it is a “studies exception,” not a general “research exception”) — lets an institution disclose identifiable education records without consent to an organization conducting a study for or on behalf of the institution, for the purpose of developing or validating predictive tests, administering student aid programs, or improving instruction. It is the mechanism most external research partnerships with schools, districts, or universities actually rely on. The disclosure is conditioned on a written agreement that must:

• specify the purpose, scope, and duration of the study and the information disclosed;
• require the organization to use personally identifiable information only to meet the study’s stated purpose, as defined in the agreement;
• require the study to be conducted in a manner that does not permit personal identification of students by anyone other than representatives of the organization with legitimate interests in the information; and
• require the organization to destroy, or return to the institution, all personally identifiable information when it is no longer needed for the purposes specified, and specify the time period for destruction.

Two points research administrators and prospective institutional partners routinely get wrong: the institution is never required to initiate or agree to a study under this exception — it can decline any research request that would use it — and the exception authorizes the disclosure of records, not the substance of the study itself; it does not substitute for whatever ethics review the study separately requires.

De-identified and coded data for research

34 CFR § 99.31(b) gives institutions two additional routes that avoid needing an exception or consent at all:

• 99.31(b)(1): an institution may release records after removing all personally identifiable information, provided it has made a reasonable determination that the student’s identity is not personally identifiable, whether through single or combined datasets, and taking into account other reasonably available information.
• 99.31(b)(2): for research specifically, an institution may disclose de-identified student-level data that carries a code, provided the code cannot be used to identify the student without access to a separate crosswalk the institution keeps under its control, and the code is not, and is not derived from, the student’s Social Security number or other personal identifier. This lets a researcher match records across time or datasets without ever receiving directly identifying information.

Neither route is automatic — both require the institution to actually make and document the de-identification determination described in the regulation, not simply strip obvious identifiers like name and student ID and assume the result is no longer an education record.

Directory information and participant recruitment

Separately from the exceptions above, institutions may designate certain categories as directory information (name, institutional email, enrollment status, dates of attendance, and similar low-sensitivity items) and disclose them without consent under 34 CFR § 99.37, unless a student has opted out. This is the provision that most often comes up during research recruitment — contacting students by institutional email to invite study participation typically relies on directory information rather than on the studies or school-official exception, and researchers using it need to confirm the institution’s current directory-information policy and honor any student opt-outs before using contact lists this way.

FERPA and IRB/Common Rule review are separate, non-substitutable gates

FERPA and human-subjects research ethics review operate under different statutory authorities and answer different questions, and satisfying one does not satisfy the other:

• FERPA (20 U.S.C. § 1232g) governs whether and how an institution may disclose education records it holds — a records-privacy question.
• The Common Rule (45 CFR Part 46) and IRB review govern whether a project constitutes human-subjects research and, if so, what ethical safeguards — informed consent, risk minimization, data security — it requires. See CASRAI’s guide to the IRB/REC approval process for what triggers review and what qualifies for exemption.

A project that uses existing, identifiable student records for secondary research can, in practice, need both gates cleared independently: a FERPA basis for the institution to disclose the records (an exception or consent), and a Common Rule determination of whether the secondary use of that data is exempt, expedited, or full-board human-subjects research. An IRB exemption determination under the Common Rule’s secondary-research-use category does not, by itself, authorize the institution to disclose the underlying records — FERPA still requires its own basis for that disclosure, and the two determinations are made independently, often by different offices, even though they frequently arrive at the research administrator’s desk as a single review request.

Worked examples

School-official exception: A university’s institutional-research office pulls de-identified enrollment and GPA records from the student information system to analyze retention patterns for an internal report. Because the analysts are institutional employees performing an institutional function under the office’s direct control, and the institution has designated that legitimate educational interest, the disclosure is covered by the school-official exception (34 CFR § 99.31(a)(1)) — no separate written studies agreement is needed.

Studies exception: An external university research team partners with a school district to evaluate a reading intervention using identifiable student assessment records. The district discloses the records under the studies exception (34 CFR § 99.31(a)(6)), via a written agreement specifying the study’s purpose, scope, and duration, restricting use of the data to that purpose, and requiring destruction of the personally identifiable information once the study concludes.

Not an education-records disclosure (counter-example): A researcher recruits currently enrolled, consenting students to complete a new anonymous survey the researcher designed and administers directly — no data is drawn from the registrar’s or any other office’s existing files. Because the institution never discloses any record it maintains, FERPA’s disclosure restrictions do not apply to that data collection at all, even though the study will still typically need IRB review as human-subjects research.

Frequently asked questions

Does getting IRB approval also satisfy FERPA?

No. IRB/Common Rule review and FERPA are independent requirements administered under different authorities. An IRB approval or exemption addresses the ethics of the human-subjects research; it does not by itself give the institution a legal basis to disclose education records to a researcher. That basis still has to come from a FERPA exception (school official, studies exception, directory information) or the eligible student’s written consent.

Can an external researcher get identifiable student records without student consent?

Only if the disclosure fits a recognized FERPA exception — most commonly the studies exception (34 CFR § 99.31(a)(6)), which requires a written agreement meeting the regulation’s specific conditions, or the audit/evaluation exception for programs the institution itself administers. The institution decides whether to enter into that agreement; there is no general right for a researcher to obtain student records.

Is de-identified student data still subject to FERPA?

Not once the institution has made and documented the determination required by 34 CFR § 99.31(b)(1) that the information is no longer personally identifiable, or has applied the coded-data provision at 99.31(b)(2) for matching purposes. Simply removing a student’s name and ID number without that documented determination is not sufficient on its own.

Does FERPA apply to data a researcher collects directly from students?

No. FERPA governs the institution’s disclosure of education records it already maintains. New data a researcher collects directly from consenting participants — a survey, an interview, a biospecimen — was never part of the institution’s education records, so FERPA’s disclosure rules do not apply to it, though IRB/human-subjects review still may, as a separate matter.

Who enforces FERPA?

The U.S. Department of Education’s Student Privacy Policy Office (successor to the former Family Policy Compliance Office) investigates FERPA complaints and can, as its ultimate remedy, terminate an institution’s eligibility for federal education funding. FERPA does not create a private right of action for individuals to sue directly.

References

• 20 U.S.C. § 1232g — Family Educational Rights and Privacy Act
• 34 CFR Part 99 — Family Educational Rights and Privacy Act regulations (U.S. Department of Education)
• 34 CFR § 99.31 — Conditions for disclosure without consent, including the school-official (99.31(a)(1)) and studies (99.31(a)(6)) exceptions and the de-identified/coded-data provisions (99.31(b))
• 34 CFR § 99.37 — Conditions for disclosure of directory information
• U.S. Department of Education, Student Privacy Policy Office, studentprivacy.ed.gov/ferpa
• 45 CFR Part 46 — the Common Rule, for the separate human-subjects-research framework discussed above