FERPA in Research

Exempt Category 1 involves research conducted in established or commonly accepted educational settings that specifically involves normal education practices that are not likely to adversely impact students' opportunity to learn required educational content or the assessment of educators who provide instruction. Researchers can conduct studies that fall under Exempt Category 1 without the use of Student Education Records. This could include observing classroom instructional methods, evaluating teaching strategies, or assessing student attitudes toward learning — as long as no individual student data is collected or accessed.

A principal, school administrator, or registrar could pull identifiable Student Education Records and strip all personally identifying information before providing the data to the researcher. This de-identification process must be completed by someone other than the researcher — the researcher may not de-identify the data themselves. The resulting de-identified dataset could then be provided to the researcher for analysis.

At MSU, researchers should contact University Data and Analytics or the Registrar's office to explore whether they can facilitate the de-identification process. The de-identification arrangement must be documented in your MSU IRB research application.

Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance.

Each educational institution designates what information it considers directory information — and some schools have opted out of releasing any directory information at all. Researchers should contact each institution from which they propose to access student records and follow that institution's FERPA policies and procedures before accessing directory information. This must be documented in your MSU IRB research application.

FERPA regulations at 34 CFR 99.31(a)(6) contain an exception to its general consent rule under which an educational agency or institution may disclose PII from education records without consent to organizations conducting studies for, or on its behalf. Studies must be only for the purpose of:

• Developing, validating, or administering predictive tests;
• Administering student aid programs; or
• Improving instruction

Additional Conditions:

• A written agreement with the institution is required, specifying the purpose of the study and the use and destruction of the information.
• The study must be conducted in a manner that does not permit personal identification of students by individuals other than representatives of the organization that have legitimate interests in the information.
• Unless written consent from the student is obtained, FERPA prohibits PII from education records from being published in a way that would allow individual students to be identified.
• The information must be destroyed when no longer needed for the purpose for which the study was conducted.

The interpretation of this regulation is meant to produce information for the improvement of services at an institution — not to produce generalizable knowledge for distribution beyond the institution.

This exception would be rarely utilized at MSU and only at the behest of MSU administration (e.g., at the request of the Vice President for Research, Provost, or Office of Planning and Analysis). Researchers should contact the IRB office before pursuing this path, as it requires institutional authorization that goes beyond standard IRB review.

It depends on what you are collecting. If you are administering a new survey, interview, or assessment that you designed specifically for the research project — and it is not part of the student's normal coursework — that is primary research data and FERPA does not apply to it. However, if you are also accessing any existing student records alongside that new data, FERPA applies to those existing records.

In short: new data you create and collect solely for research purposes is not a student education record. Existing data that was created as part of a student's educational experience is.

Primary research data is new information you collect specifically for the research project — for example, a survey or interview you designed that students would not be completing as part of their normal class activities.

Secondary research data is existing information that was already created as part of normal classroom or school activities — for example, graded assignments, test scores, homework, or course schedules that exist independently of your research project. Using this type of data for research purposes requires FERPA-compliant consent.

Active written consent — a signed consent form — is required when:

• You are using identifiable Student Education Records for research purposes.
• Your school requires a signed cosnent method regardless of the data type.

A consent statement — where proceeding with participation indicates consent, such as completing a survey — may be appropriate for primary research that does not involve Student Education Records. Contact the IRB office if you are unsure which applies to your study.

There are two regulatory pathways:

The first is if the data is recorded by the researcher in such a manner that the identity of the student cannot readily be ascertained — meaning you will view but not record any identifiers, will not contact the students, and will not attempt to re-identify them. Under this pathway, the data must be truly non-identifiable at the point of access.

The second is handled under broad consent regulations per 45 CFR 690.104(d)(7) or (8), which applies when you will be recording identifiers and tracking individual trends over time. In this case, broad consent is required to store and use personally identifiable information, and this must be explicitly requested in the parental consent form.

No. FERPA consent can only be provided by the parent of a minor student or by an eligible student (18 or older). A principal, administrator, or any other school official does not have the authority to waive this requirement. This is a federal law and applies regardless of any school-level policies or preferences.

Yes. FERPA protection follows the identifiable student record, not the funding source. If your research involves identifiable student education records, FERPA applies regardless of whether the school receives federal funding or whether your research is federally funded.

Yes. Even if you have routine access to student records as part of your job, using those same records for research purposes requires FERPA-compliant consent. Your access as an educator does not extend to research use — these are governed by different standards. See the Educator Researchers section above for more detail.