FERPA Information for Researchers

The following information is designed to assist JHU researchers in preparation of research projects that involve JHU student data/education records, which may be subject to the Family Educational Rights and Privacy Act (FERPA). For general information about FERPA and JHU’s FERPA compliance protocols, please reference the content published elsewhere on this FERPA Compliance page.

Use of Education Records in Research

FERPA provides guidelines on how educational institutions are to use and release student’s education records. Under FERPA, education records are records that (1) are directly related to a student who is or has been in attendance at an educational agency or institution; and (2) are maintained by an educational agency or institution or by a party acting for the educational agency or institution. This encompasses information or data recorded in any medium, including (but not limited to) transcripts; class schedules; course work including papers, exams, grades, and evaluations; disciplinary records; internship program records; and student financial records.

Other examples of education records that are commonly used in research include, but are not limited to, the following:

• Student identifiers derived from school records
• A student’s enrollment in a particular course
• Discussion board postings or other class engagement within course LMS platforms
• A student’s status as a participant in a university program or recipient of a university service

Please note that in many cases, these types of education records are accessible to and used by JHU school officials to complete their job duties. A JHU faculty member, for example, must access student assignments, test scores, final grades, and other records to perform their duties as members of the faculty. Similarly, a JHU staff member responsible for a university program or service may need to access student participation records and evaluations. Under FERPA, this access is considered “legitimate educational interest.” Generally, JHU school officials’ use of the same types of data from education records for research purposes requires written consent from students.

Homewood Institutional Review Board – OUR Ancillary Review

Principal investigators (PIs) may submit research projects that utilize educational records for review and approval of the Homewood Institutional Review Board (HIRB). During their review, if the HIRB team determines that a project plans to use JHU student education records, the project will be routed to the OUR to complete an ancillary review for FERPA compliance purposes.

The OUR will ask the following questions during their ancillary review:

• Will this study use education records protected by FERPA? Some studies, such as studies focused on non-credit learners, may not require FERPA compliance.

• What are the personally-identifiable education records (and their data sources) that will be utilized by the study team for the purposes of the research? This includes records that may be used for study recruitment. These records are to be listed in a FERPA Compliance section (see FERPA Compliance Language for IRB Informed Consent Documents below on this page) in the study’s consent forms so that students who choose to participate in the study can affirmatively consent to the disclosure of the information to the study team for research purposes.
  • If FERPA-protected education records will be used for the study but will be de-identified by someone other than a member of the study team before the project begins, FERPA’s provisions for de-identified data may apply.
  • Researchers who plan to request data from university sources (such as the OUR, the Office of Institutional Research and Analytics, Financial Aid, or the Office of Undergraduate Student Analytics) should contact the source directly ahead of the IRB submission to discuss feasibility.

• Will this study involve any identifiable education records being sent to or maintained by a third-party or homegrown (non-university) system? Studies involving external systems require an extra layer of FERPA compliance review to ensure that the system is FERPA-compliant and secure per JHU information technology risk standards. In most cases, students will also need to provide consent for their information to be shared with the external system.

• What approach will be used to obtain student consent? For a student’s consent to be FERPA-compliant, it must be signed and dated and, if electronic, must identify and authenticate a particular person as the source of the electronic consent, and indicate such person’s approval of the information contained in the electronic consent. Electronic consents can be FERPA-compliant when they use a student’s JHED credentials (such as those used in Single Sign On) for authentication. The university offers several compliant solutions, including Qualtrics.

For questions about the Homewood Institutional Review Board, please visit the HIRB website or contact their office at [email protected]. The HIRB’s guidance for use of student education records in research can be accessed on the HIRB website via this link. For questions about FERPA compliance as it pertains to studies conducted by JHU researchers, please contact the OUR at [email protected].

FERPA Compliance Language for IRB Informed Consent Documents

During the ancillary review process, the OUR and the HIRB team will collaborate to ensure that studies using identifiable education records have a FERPA Compliance section included in the project’s informed consent documents. The FERPA Compliance section allows the project’s informed consent documents to serve a dual purpose as the student’s FERPA-compliant consent for specific education records to be disclosed to the research team for the purposes of the same study. Consent forms are maintained according to HIRB procedures.

Below is template FERPA language for PIs to include in their study’s informed consent documents. The text can be stylized as needed to match the rest of the consent document(s).

Template Language

Section Header: FERPA Compliance

This research will utilize JHU student education records. JHU student education records are protected by the Family Educational Rights and Privacy Act of 1974 (FERPA). Please review the Office of the University Registrar’s FERPA Compliance website for more information pertaining to FERPA.

In compliance with FERPA, disclosure of your education record data elements for this research requires your signed and dated consent.

By completing this form and agreeing to voluntarily participate in this research, you are also consenting to the following disclosures for the purposes of the study to the members of the research team listed on this IRB protocol:

• Release of the following education record data elements:
  • Example Data Element 1 (e.g., enrollment in EN.XX.XXX)
  • Example Data Element 2 (e.g., quiz grades and final exam grades in EN.XX.XXX)
  • Example Data Element 3 (e.g., Canvas discussion board postings for EN.XX.XXX which include student name)

The principal investigator (PI) for this research has been informed that they may use your education record information only for the purposes of this research, and that they are not permitted to disclose your education record information to any other party without your prior consent.