MSU HRPP Manual Section 2-2-D-i

Family Educational Rights and Privacy Act

The Family Educational Rights and Privacy Act (FERPA) of 1974 (as amended) is a federal law that sets forth requirements for the protection of privacy of students’ educational records. This policy addresses the applicability of FERPA to human subject research reviewed by the Michigan State University (MSU) Human Research Protection Program (HRPP). Individuals engaged in human subject research are responsible for complying with FERPA when applicable, including exempt research. The MSU Office of the General Counsel may be contacted if there are questions about FERPA in human research studies.

Applicability

FERPA applies to educational agencies or institutions to which funds have been made available under any program administered by the Secretary of the U.S. Department of Education if the institution provides educational services or instruction to students and is authorized to direct and control public elementary, secondary, or post-secondary educational institutions. 34 CFR 99.1(a). Funds include those provided to the institution by grant, cooperative agreement, contract, subgrant, or subcontract or if funds are provided to the students attending the institution. If there is a question about the applicability of FERPA to an educational institution, 34 CFR 99.1 should be reviewed.

When a research study submitted to the HRPP may involve FERPA, the study will be assigned to the Compliance office for review. The Compliance office will communicate with the investigator when needed to determine whether FERPA is applicable. If FERPA is applicable, the Compliance office will provide information to the researcher about the researcher’s obligation to assure that FERPA requirements have been met. Information may also be provided to the Institutional Review Board when applicable.

Education Records

The education records protected by FERPA are those records that directly related to a student and are maintained by an educational agency or institution or by a party acting for the agency or institution. 34 CFR 99.3. FERPA applies when researchers obtain student records or personal education information from an education program defined as any program principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education.  See the “Definitions” section below for further information on what is not considered an education record and for other relevant definitions. When FERPA is applicable, consent from the parent or student is required in order for the educational institution to disclose the education record or the disclosure must meet an exception criteria found in 34 CFR 99.31. Such disclosures may be requested to obtain student records as part of a human subject research study.

Written Consent

Unless the request meets an exception in 34 CFR 39.31, signed and dated written consent must be obtained from the parent or eligible student before the educational institution discloses the personally identifiable information. 34 CFR 99.30(a). Written consent must include the following elements (34 CFR 90.30(b)):

1. Specify the records that may be disclosed

2. State the purpose of the disclosure; and

3. Identify the party or class of parties to whom the disclosure may be made

Signed and dated written consent under 34 CFR 99.30 may include a record and signature in electronic format that:

1. Identifies and authenticates a particular person as the source of the electronic consent; and

2. Indicates such person’s approval of the information contained in the electronic consent. (34 CFR 99.30(d)

Exceptions to Parental Permission or Student Consent

If the request involves an exception to parental permission or student consent, the request must meet an exception provided in 34 CFR 99.31(a). The exceptions relevant to research include 34 CFR 99.31(a)(6) or 34 CFR 99.31(11). Such exceptions to informed consent must also be reviewed and approved by the IRB for non-exempt research in accordance with HRPP Manual 6-4-B “Waiver or Alteration of Informed Consent.”

Exception under 34 CFR 99.31(11)

The exception under 34 CFR 99.31(11) permits educational institutions or agencies to release “directory information” from students without consent so long as the conditions under 34 CFR 99.37 are met. A researcher may receive directory information from an educational institution without student or parental consent as required by FERPA. If a student’s social security number or other non-directory information is used alone or combined with other data elements to identify or help identify the student or the student’s records, informed consent must be obtained. 34 CFR 99.37(d)

Exception under 34 CFR 99.31(6)

The exception under 34 CFR 99.31(6) allows release of confidential student records for use in research without consent under specified conditions. These requirements include restrictions placed on the MSU researchers, including limitations on personal identification of parents and students, destruction of data, and a written agreement between the educational agency or institution and MSU or the researcher.

The disclosure must be to an organization (MSU) conducting studies for, or on behalf of, educational agencies or institutions to:

1. Develop, validate, or administer predictive tests;

2. Administer student aid programs; or

3. Improve instruction

In order for the student records to be disclosed, MSU or the researcher on behalf of MSU must enter into a written agreement with the educational agency or institution. The written agreement must contain the following elements (34 CFR 99.31(6)(ii)(C)):

1. Specifies the purpose, scope, and duration of the study or studies and the information to be disclosed

2. Requires the organization to use personally identifiable information from education records only to meet the purpose or purposes of the study as stated in the written agreement

3. Requires the organization to conduct the study in a manner that does not permit personal identification of parents and students by anyone other than representatives of the organization with legitimate interests

4. Requires the organization to destroy or return to the educational agency or institution all personally identifiable information when the information is no longer needed for the purposes for which the study was conducted and specifies the time period in which the information must be returned or destroyed

The researcher should work with the non-MSU educational institution (e.g. local school district) to assure that the written agreement is compliant with the FERPA requirements and is consistent with the project as submitted in the IRB application and as described in the consent document. The researcher is responsible for complying with the FERPA requirements.

Once the information is disclosed to the MSU researchers, the limitations outlined in the written agreement on use of the student data must be followed. 34 CFR 99.31(6)(ii). These include:

1. The data can only be used to meet the purposes or purposes of the study as stated in the written agreement

2. The study is conducted in a manner that does not permit personal identification of parents and students by individuals other than representatives of MSU that have legitimate interests in the information.

3. The information must be destroyed when no longer needed for the purposes for which the study was conducted

MSU Office of the Registrar

At MSU, requests for MSU student records protected by FERPA are subject to the MSU Registrar Office’s policy on “Michigan State University Access to Student Information.” The Registrar’s Office will be assigned as an ancillary reviewer to studies that involve MSU student records protected by FERPA for compliance with FERPA requirements. Exceptions to parental permission and student consent will also be reviewed by the IRB for non-exempt research in accordance with HRPP Manual 6-4-B “Waiver or Alteration of Informed Consent.” Research requests for student records subject to FERPA made to a non-MSU educational institution are reviewed by the applicable non-MSU educational institution (e.g., school district) in accordance with local district requirements and FERPA requirements.

FERPA Definitions (34 CFR 99.3)

Directory information means information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed.

(a) Directory information includes, but is not limited to, the student’s name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; enrollment status (e.g., undergraduate or graduate, full-time or part-time); dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors and awards received; and the most recent educational agency or institution attended.

(b) Directory information does not include a student’s—

(1) Social security number; or

(2) Student identification (ID) number, except as provided in paragraph (c) of this section.

(c) Directory information includes a student ID number, user ID, or other unique personal identifier used by the student for purposes of accessing or communicating in electronic systems, but only if the identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user’s identity, such as a personal identification number (PIN), password, or other factor known or possessed only by the authorized user.

Disclosure means to permit access to or the release, transfer, or other communication of personally identifiable information contained in education records by any means, including oral, written, or electronic means, to any party except the party identified as the party that provided or created the record.

Education records.

(a) The term means those records that are:

(b) The term does not include:

(3)(i) Records relating to an individual who is employed by an educational agency or institution, that:

(ii) Records relating to an individual in attendance at the agency or institution who is employed as a result of his or her status as a student are education records and not excepted under paragraph (b)(3)(i) of this definition.

(4) Records on a student who is 18 years of age or older, or is attending an institution of postsecondary education, that are:

(i) Made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assisting in a paraprofessional capacity;

(ii) Made, maintained, or used only in connection with treatment of the student; and

(iii) Disclosed only to individuals providing the treatment. For the purpose of this definition, ‘‘treatment’’ does not include remedial educational activities or activities that are part of the program of instruction at the agency or institution; and

(5) Records created or received by an educational agency or institution after an individual is no longer a student in attendance and that are not directly related to the individual’s attendance as a student.

(6) Grades on peer-graded papers before they are collected and recorded by a teacher.

Educational agency or institution means any public or private agency or institution to which this part applies under § 99.1(a).

Eligible student means a student who has reached 18 years of age or is attending an institution of postsecondary education.

Parent means a parent of a student and includes a natural parent, a guardian, or an individual acting as a parent in the absence of a parent or a guardian.

Personally Identifiable Information. The term includes, but is not limited to—

(a) The student’s name;

(b) The name of the student’s parent or other family members;

(c) The address of the student or student’s family;

(d) A personal identifier, such as the student’s social security number, student number, or biometric record;

(e) Other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name;

(f) Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or

(g) Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.

Biometric record, as used in the definition of personally identifiable information, means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting.

Record means any information recorded in any way, including, but not limited to, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche.

FERPA Regulatory Requirements

34 CFR 99.31(a). An educational agency or institution may disclose personally identifiable information from an education record of a student without the consent required by § 99.30 if the disclosure meets one or more of the following conditions:

34 CFR 99.31(6)

(i) The disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions to:

(ii) An educational agency or institution may disclose information under paragraph (a)(6)(i) of this section only

if—

(A) The study is conducted in a manner that does not permit personal identification of parents and students by individuals other than representatives of the organization that have legitimate interests in the information;

(B) The information is destroyed when no longer needed for the purposes for which the study was conducted; and

(C) The educational agency or institution enters into a written agreement with the organization that—

(1) Specifies the purpose, scope, and duration of the study or studies and the information to be disclosed;

(2) Requires the organization to use personally identifiable information from education records only to meet the purpose or purposes of the study as stated in the written agreement;

(3) Requires the organization to conduct the study in a manner that does not permit personal identification of parents and students, as defined in this part, by anyone other than representatives of the organization with legitimate interests; and

(4) Requires the organization to destroy or return to the educational agency or institution all personally identifiable information when the information is no longer needed for the purposes for which the study was conducted and specifies the time period in which the information must be returned or destroyed.

(iii) An educational agency or institution is not required to initiate a study or agree with or endorse the conclusions or results of the study.

(iv) If this Office determines that a third party outside the educational agency or institution to whom information is disclosed under this paragraph (a)(6) violates paragraph (a)(6)(ii)(B) of this section, the educational agency or institution may not allow that third party access to personally identifiable information from education records for at least five years.

(v) For the purposes of paragraph (a)(6) of this section, the term organization includes, but is not limited to, Federal, State, and local agencies, and independent organizations.

34 CFR 39.31(11). The disclosure is information the educational agency or institution has designated as ‘‘directory information’’, under the conditions described in § 99.37.

This policy and procedure supersedes those previously drafted.

Approved By: Vice President of Research and Graduate Studies, 12-9-2015. Revision 1 approved by Assistant VP Regulatory Affairs on 8-16-2019.

Related HRPP Manual Sections

• 6-4-B, Waiver or Alteration of Informed Consent