FERPA Guidance on Using Educational Records for Research

PURPOSE

In accordance with the provisions of the Family Educational Rights and Privacy Act (FERPA) (20 USC 1232g; 34 CFR Part 99), Farmingdale State College (FSC) has established the following guidelines for requesting and using educational records from FSC for research purposes. This is designed to ensure that research conducted by internal or external investigators using FSC educational records is FERPA compliant. These guidelines are for research purposes only. To obtain educational records for non-research purposes contact the applicable office (see chart below). 

GUIDELINES

For purposes of FERPA compliance, researchers interested in using FSC educational records containing personally identifiable information (PII) of students must obtain permission from the student to use those records prior to data collection. 

Most research projects involving the collection of data from human subjects require prior review/approval from FSC’s Institutional Review Board (IRB). Institutional permission to access FSC educational records for research purposes (if applicable) should be requested in conjunction with the IRB review process.

PROCEDURES

Researchers may request select educational records by submitting a Research Data Release Form to the corresponding department (see chart below) for approval. Once the request has been approved, the Research Data Release Form is returned to the researcher. Requests for educational records derived from courses not taught by members of the research team also require written permission from the corresponding faculty member(s). If educational records with PII are requested through the Office of the Registrar, a copy of the executed Release Authorization (either hard copy or digital version) must be submitted with the Research Data Release Form. Researchers must maintain the approved Research Data Release Form and executed Release Authorization on file for at least 3 years after the project is complete. The destruction of documents relating to FERPA (as described in this document) must follow FSC’s Records Retention Policy as posted on the college’s website.

Department	Educational Records	Dataset Options
Office of the Registrar (in conjunction with the Office of Information Technology)	Directory Information, Final Course Grades, Grade Point Averages, Student Transcripts	Identifiable De-Identified*
Office of the Provost	Course Evaluations/Student Feedback Surveys (Administered via Axiom Mentor)	De-Identified*
Office of Institutional Research	Student Survey Responses initiated by SUNY and/or FSC	De-Identified*
* All records will be randomized or aggregated.

Researchers with access to educational records including, but not limited to, grades, attendance records, and coursework samples (i.e. tests/quizzes, essays, term papers, class projects, etc.) in their capacity as FSC faculty or staff members may only access this information for research purposes if an executed Release Authorization has been collected from the student(s). Researchers must maintain all executed Release Authorizations on file for at least 3 years after the project is complete. 

If a Release Authorization is not provided, the following data collection proposals may also be considered:

• In some circumstances, researchers may collect de-identified aggregate grade data from their courses themselves using certain functions in the College's Learning Management Systems. Please contact the Office of the IRB for more details.
• Researchers may request de-identified educational records from their own course(s) to be provided from other faculty or staff who also normally have access to these records and are not members of the research team by submitting a Research Data Release Form to that individual. Once the request has been approved, the Research Data Release Form is returned to the researcher. Researchers must maintain the approved Research Data Release Form on file for at least 3 years after the project is complete.
• Researchers may request that other Faculty (not members of the research team) voluntarily provide de-identified educational records from their own course(s) by submitting a Research Data Release Form to the faculty member(s). Once the request has been approved, the Research Data Release Form is returned to the researcher. Researchers must maintain the approved Research Data Release Form on file for at least 3 years after the project is complete. [If an executed Release Authorization has been collected from the student(s), identifiable information may be included. Researchers must maintain the executed Release Authorization on file for at least 3 years after the project is complete.]

During the IRB review process, researchers must provide the IRB with a detailed description of the process(es) that will be utilized by the non-affiliated faculty/staff member to de-identify the dataset prior to providing it to the researcher. 

Additional procedures are outlined below:

• Researchers collecting educational records with PII must have the student complete a Release Authorization (either hard copy or digital version) prior to data collection. When collecting the hard copy version, the researcher must confirm the participants identity by their FSC ID card and witness their “wet” signature (digitally created signatures are not acceptable); otherwise the form must be notarized. This process is not required for the digital version as an authorized single sign-on is required. 
• Once a student submits a digital Release Authorization, the resulting record will be sent directly to the researcher’s FSC e-mail account.
• If the researcher plans to retain the identifiable data for future research, the Release Authorization must specifically state each intended project.
• At times, de-identified records can still contain identifiable markers. If the de-identified information from educational records includes a code that allows information to be matched to a recognizable participant, an executed Release Authorization (either hard copy or digital version) must be obtained from each participant prior to data collection.
• Data that has been fully de-identified (with no links to PII) may be retained by the researcher. During the IRB review process, researchers must provide the IRB with a detailed description of the process(es) that will be utilized to de-identify the dataset.
• Researchers must either destroy all PII as soon as practicable after the completion of the study, or return all PII to FSC for proper destruction and disposal. 
• If PII is collected without consent for any reason (e.g. exemptions, unauthorized access, etc.), a disclosure log must be submitted to Office of Administration and Finance.

Directory Information

FERPA does not require consent/parental permission for the release of Directory Information. FSC designates the following items as Directory Information: Student’s Name, Address, Telephone Listing, Electronic Mail Address, Photograph, Degrees, Honors and Awards Received, Date and Place of Birth, Major Field of Study, Dates of Enrollment, Most Recent Educational Agency or Institution Attended, Participation in Officially Recognized Activities and Sports, Weight and Height of Member of Athletic Teams. Students may opt out of the release of this information by completing the Restriction on Disclosure of Directory Information Form. At FSC, the Office of the Registrar maintains the list of students who have opted out of the directory.

Course Evaluations/Student Feedback Surveys (Administered via Axiom Mentor)

Researchers who wish to collect information from course evaluations (Axiom Student Feedback Survey forms) from course(s) in which they were the instructor may do so by contacting the Academic Project Coordinator in the Office of the Provost and submitting a Research Data Release Form. Once the request has been approved, the Research Data Release Form is returned to the researcher. Researchers must maintain the approved Research Data Release Form on file for at least 3 years after the project is complete. Direct access to course evaluations is not permitted for research data collection. Only de-identified survey information will be provided; any identifiable information from freeform comments will be redacted. Researchers seeking to collect information from course evaluations from course(s) in which they were not the instructor must also submit written permission from the instructor(s) of the requested course(s).

Exceptions

An educational agency or institution may disclose personally identifiable information from an education record of a student without the consent required by 34 CFR 99.30 if the disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions to: (A) Develop, validate, or administer predictive tests; (B) Administer student aid programs; or (C) Improve instruction (34 CFR 99.31(A)(6)). 

In these cases, FSC administration must confirm (in writing) that the Principal Investigator has been tasked with conducting the research on behalf of the institution for one of the three purposes listed above, and the following federal regulations are satisfied:

• The study is conducted in a manner that does not permit personal identification of parents and students by individuals other than representatives of the organization that have legitimate interests in the information;
• The information is destroyed when no longer needed for the purposes for which the study was conducted; and 
• A written agreement between FSC and the researcher, educational agency, or external institution has been secured and which meets FERPA criteria (contact the Office of the IRB for guidance).

Exception requests must be included in the research protocol submitted to the IRB and will be reviewed on a case-by-case basis.

DEFINITIONS

Biometric Record: As used in the definition of personally identifiable information, means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting.

Educational Records: Any record that can be linked to a student including grades, class assignments, advising notes, transcripts, video of students in class, online course discussions (FSC sanctioned platform), etc.

FERPA: The Family Educational Rights and Privacy Act is a federal law that gives parents certain rights with respect to their children’s education records. These rights transfer to the student when they reach the age of 18 or attends an educational institution beyond the high school level.

Personally Identifiable Information (PII): The term includes, but is not limited to the student's name, the name of the student's parent or other family members; the address of the student or student's family; a personal identifier, such as the student's social security number, student number, or biometric record; other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name; other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.

Research: A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.

Research Participant (Human Subject): A living individual about whom an investigator (whether professional or student) is conducting research (i.e. obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens).

Research Protocol: Documents describing the background, rationale, objectives, design, methodology, statistical considerations, and organization of a research project.

Wet Signature: A person’s name written in their own hand with ink.