Aim analytics panel (2017 Fall): FERPA

2. FERPA Overview
Applies to all schools, colleges, and universities that receive funding from
U.S. Department of Education (ED)
Grants K-12 parents/college and university students key rights:
Right of annual notification of university’s FERPA policies
Right of access to own education records
Right to seek amendment of education records
Right, generally, to control release of personally identifiable information from
education records
Right to file complaint with Family Policy Compliance Office for alleged violations

3. Selected Definitions
Education record
Record that 1) contains personally identifiable information (PII) about a student and 2) is
maintained by the educational institution
Does not include the following:
Personal knowledge or observations
Sole possession notes
Law enforcement records
Treatment records
Employment records – unless the employment is because of the student’s status as a student
Post-graduation records not related to past attendance as student
Grades on peer-graded coursework before collected and recorded

4. Selected Definitions
Personally identifiable information (PII)
Name and address of student or family members
Personal identifiers
Social Security Numbers
Student ID numbers
Biometric records
Indirect identifiers
Date of birth
Place of birth
Mother's maiden name
Information that, alone or in combination, could allow someone without personal
knowledge to identify the student with reasonable certainty
Information requested by someone whom the institution reasonably believes knows the
identity of the student to whom the education record relates

5. Directory Information
Exception
Institutions must provide annual notice of information designated as
“directory information” under FERPA
Can disclose without student consent as long as both of the following are
true:
Institution has notified its students of the information it has designated as
“directory information”
Institution has given students the opportunity to opt out of disclosure
Completely
Re: particular purposes
Re: particular parties

6. Directory Information
Exception
Can designate as “directory information” information such as the following:
Student’s name, address, telephone number, and email address
Student’s photograph
Student’s date and place of birth
Student’s grade level, enrollment status, field of study, degrees, and dates of attendance
Student’s participation in officially recognized activities and sports
Student’s weight and height, if a member of an athletic teams
Student’s honors and awards
Student’s most recently attended educational agency or institution
Other information not likely to be viewed as harmful or an invasion of privacy if disclosed
Cannot include the following:
Student’s Social Security Number
Student’s student identification number, unless is not sufficient, on its own, to grant access student’s
education records

7. Study Exception
Can disclose PII without student consent as long as all of the following
conditions are met:
Organization is conducting study for or on behalf of the disclosing institution
Study has appropriate purpose
Developing, validating, or administering predictive tests
Administering student aid programs
Improving instruction
Study is conducted in manner that does not permit personal identification by others not
involved with study
PII is destroyed when no longer needed for study’s purposes
Organization and institution have entered into appropriate written agreement (see next
slide)
Disclosing institution not required to initiate the study or agree with or endorse
its conclusions or results

8. Study Exception
Written agreement between disclosing institution and organization
conducting study must include the following terms:
Specification of purpose, scope, and duration of the study and the information to
be disclosed
Requirement that organization use PII only to meet the authorized purpose of the
study
Requirement that organization conduct the study in a manner that does not permit
personal identification by anyone other than organization’s representatives
Requirement for destruction of all PII when no longer needed for the study and
specification of the time period for destruction
If organization violates these requirements, cannot receive PII from
disclosing institution for at least 5 years

9. De-Identified Records
Exception
Can disclose without student consent after removal of all PII
Disclosing institution must first make reasonable determination that a student’s
identity is not personally identifiable, whether through single or multiple releases,
and taking into account other reasonably available information
Can release de-identified student-level data for education research by
attaching a code to each record that permits matching information received
from the same source
Cannot disclose how code generated or assigned
Code must be used only for this purpose and must not enable ascertaining of PII
Code cannot be based on SSN or any other PII

10. FERPA – Implications for
Researchers
Work with schools to obtain necessary permissions to access data or
to survey students
If seeking access to UM data, work with appropriate data stewards
before/in conjunction with IRB process
See, for example, SPG 601.12
Where only data access is needed, consider alternative approaches
that could help with consent issues – but remember that school is not
required to release data!
School could de-identify data before release
School could authorize researcher to undertake study on its behalf (if meets required
purpose, etc.)