Using FERPA-Protected Records in Human Subjects Research

Overview

The Family Educational Rights and Privacy Act (FERPA) is a federal law (20 U.S.C. § 1232g; 34 CFR Part 99) that protects the privacy of student education records. It applies to all educational institutions receiving U.S. Department of Education funding. When research involves student records, investigators must comply with FERPA and applicable human subjects regulations and/or policy requirements.

The UTA Office of the Registrar is the custodian of student records protected by FERPA, please visit their webpage for more information about FERPA or student records.

Education Records

An education record is any record directly related to a student and maintained by an educational institution or its agent.

Common records used by researchers:

  • Grades
  • Exams
  • Transcripts
  • Class rosters

Consent Requirements

  • Signed and dated written consent (signature) from the parent (for minors) or the eligible student (18+ or post-secondary) is required unless an exception applies.
  • The consent must:
    • Specify the records that may be disclosed
    • State the purpose of the disclosure, and
    • Identify the party or class of parties to whom the disclosure may be made.

Here is an example of the consent language that may be used.

“By signing below, you approve your demographic data (including date of birth, race, age, ethnicity, gender, Pell-Grant status, and first-generation college student status) to be collected from UTA records after you have completed the lab quiz and lecture exam 1.”

Exceptions to Consent

FERPA allows limited exceptions (e.g., directory information, studies conducted for or on behalf of the institution), but these rarely apply to independent research. Investigators should confirm with the Registrar before assuming an exception.

Preparing an IRB submission

  1. Consult the Office of the Registrar early to confirm plan for FERPA compliance.
  2. In the IRB protocol application, detail:
    • Data Access and Security of Education records:
      • Exact fields requested
      • Source of data (Registrar, departmental admin)
      • Frequency of data pulls (one-time vs. longitudinal)

    • Safeguards for privacy and confidentiality (secure storage, limited access, encryption).

    • Consent process or justification for exception


Frequently Asked Questions

Can I use FERPA-protected information for research purposes if it is de-identified?

Yes. A UTA official/custodian (who is not the researcher) with legitimate access to the FERPA-protected data may strip the records of any identifying information and provide the data to the researcher. Researchers cannot de-identify records themselves for it to be considered de-identified.

Can I use my own students' data for human subjects research without obtaining consent?

For humans subjects research, you must obtain written consent (with signature) or use de-identified data. 

Do students have the right to refuse participation in classroom-based research?

Yes, informed consent means participation must be voluntary. Students must be free to decline without penalty or impact on their grades or standing. 

Do I need consent if I'm using archival student records for research?

Yes, if the records are identifiable. FERPA protects all education records, regardless of when they were created. If you plan to use archival data (like past assignments or transcripts), you must either obtain consent or ensure that data is fully-de-identified. 

What counts as "education records" under FERPA? 

Any record directly related to a student and maintained by the institution, including grades, graded assignments, attendance, disciplinary records, and advising notes. If you plan to use these in research, they are subject to FERPA protections.