The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student educational records.  FERPA provides students access to their educational records and prohibits dissemination of educational records without student consent.

Investigators are required to comply with FERPA, human subject protection regulations, and UI policy when accessing student education records for research purposes.

Researchers seeking to use UI student educational records for research purposes must obtain an approval/agreement memo from the UI Office of the Registrar FERPA Team. Attach this memo to the HawkIRB application.

Special attention should be given to ensure the subject recruitment process complies with FERPA.  Student educational records (e.g. class rosters etc.) may not be shared with individuals not otherwise affiliated with the academic course without student consent. This includes members of the study team who are not the instructor, or a teaching assistant assigned to the class.  However, an individual not affiliated with the course may provide an IRB-approved announcement about the research for the instructor to post on ICON, or may provide information about the study in a classroom presentation.  See UI IRB Standard Operating Procedures (SOP) & Researcher Guide, Section II, Part 7.K. Students as Subjects .

Student education records may not be used for research purposes without written consent from the student unless disclosure is permitted through one of the FERPA consent exceptions discussed below.

Student educational records often requested for research purposes include:

• course enrollment or registration information, including class rosters
• student work, including graded papers and exams
• student transcripts
• emails, notes, or online documents containing information about a student 

To comply with FERPA, a researcher must obtain a signed and dated written consent from students in order to use their educational records for research purposes.  The written consent must:

• specify the records that may be disclosed
• state the purpose of the disclosure; and 
• identify the party or class of parties to whom the records may be disclosed (e.g., the principal investigator, the study coordinator, the statistician).  It is not acceptable to state that the records will be disclosed to ‘research team members’

Note that this may require a researcher to obtain signatures from students in situations where human subjects research regulations do not require signatures (e.g. exempt research studies). In such cases, researchers must comply with the more restrictive FERPA requirements. The IRB cannot waive any part of the FERPA requirements. 

If the research project involves the use of web-based survey platforms (e.g. Qualtrics or REDCap), the survey must begin with the appropriate informed consent document or exempt information sheet.  In addition to the standard template language, the consent document must:

• specify the records that may be disclosed
• state the purpose of the disclosure
• identify the party or class of parties to whom the records may be disclosed; and 
• include an attestation of understanding or consent acknowledgment statement confirming that subjects have read and understand the informed consent document and that they agree to participate in the project, as well as a checkbox or some other mechanism for acknowledging agreement.  It must be clear that submitting the document will enroll them in the study and records will be disclosed

Electronic signatures are permitted if: 

• the signature page is located on a HawkID-required authentication website (e.g., Qualtrics and ICON)
• the consent document contains an attestation or consent acknowledgment statement and checkbox, as described above (under Informed Consent Using Web-Based Platforms)

FERPA allows educational agencies or institutions to disclose personally identifiable information from a student’s education record without consent, in limited circumstances [34 CFR § 99.31].  Specifically, if the receiving organizations are conducting studies for, or on behalf of, educational agencies or institutions to:

• develop, validate, or administer predictive tests
• administer student aid programs
• improve instruction 

Under FERPA, student education records may also be released without consent for research purposes if all personally identifiable information has been removed. Identifiers include: 

• student name and/or other direct personal identifiers such as university ID number or HawkID 
• indirect identifiers, such as parent or family member names, addresses, date and place of birth, and mother’s maiden name, and personal characteristics and/or other information that could allow the student’s identity to be traceable
• biometric records, including one or more measurable biological or behavioral characteristics that could be used for automated recognition of an individual, including physical image, voice, facial characteristics, and handwriting
• other information, alone or in combination, that is linked or linkable to a specific student and could allow a reasonable person in the campus community who does not have personal knowledge of the relevant circumstances to identify the student with reasonable certainty

Researchers should contact the UI Office of the Registrar FERPA Team for the most up-to date information and to determine if the above exceptions apply. 

Informed consent

If the study requires a full informed consent document, include:

• records to be disclosed
• purpose of the disclosure
• name of individual(s) to whom the disclosure is to be made (not their title or role in the study, such as ‘research team member(s),’ ‘PI,’ etc.)
• subject signature, date and printed name, as provided in the template
  • Electronic signatures are permitted if the signature page is located on a HawkID required authentication website

Exempt Information Sheet

If the study qualifies for exempt status and use of an exempt information sheet, include:

• records to be disclosed
• purpose of the disclosure
• identify the party or class of parties to whom the records may be disclosed (e.g., the principal investigator, the study coordinator, the statistician).  It is not acceptable to state that the records will be disclosed to ‘research team members’. 
• subject signature, date and printed name
  • Electronic signatures are permitted if the signature page is located on a HawkID required authentication website

Electronic Consent and Web-based Platforms

• Survey must begin with informed consent/exempt information sheet with all required elements
• Must be clear that by submitting the consent document the student will be enrolled in the study and that educational records will be used as described
  • Authenticated HawkID login can be considered a valid e-signature and date if the signature page is located on a HawkID required authentication website
• An attestation/consent acknowledgement statement
• A checkbox or other mechanism for acknowledging agreement

General FERPA Information:

University of Iowa Office of the Registrar

FERPA Specific Questions:

FERPA Frequently Asked Questions

FERPA Research Approval:

University of Iowa FERPA Team

General IRB Questions:

Human Subjects Office (HSO)

IRB Compliance Questions:

HSO Compliance Team

UI Investigators’ Guide:

https://hso.research.uiowa.edu/get-started/guides-and-standard-operating-procedures-sops