IRB Guidance: FERPA

This page provides information about the Family Educational Rights and Privacy Act and how it applies to human subjects research projects.


The Family Educational Rights and Privacy Act (FERPA) is a Federal law administered by the U.S. Department of Education; 34 CFR Part 99. FERPA applies to all educational agencies and institutions that receive federal funding. 



FERPA aims to protect the privacy of Student Education Records. Education records include any record containing personally identifiable information (PII) directly related to the student. PII is not limited to name, but may include indirect identifiers as well.


Examples include:

  • Documents with a student’s name, ID number, or other identifier
  • Class rosters or grade lists
  • Place of birth
  • Ethnicity
  • Residency status
  • Advisor’s name
  • Class schedule
  • Courses completed
  • Grades
  • Disciplinary records
  • Student info displayed on a computer screen



In many cases student education records are accessible to and used by instructors, teachers, and administrators for the purposes of conducting the duties of their job. For example, as part of a college instructor’s job, there is natural access to student’s assignments, test scores, and attendance records in order to evaluate performance and ultimately assign a grade. However, this same instructor cannot use this natural access for other intents and purposes, such as research. If a teacher/instructor wants to use student data for research purposes, FERPA applies and consent is required, unless one of the exceptions to consent as outlined in FERPA is met. 


Even when IRB approval and student permission is obtained, FERPA-covered information that is part of the student’s educational record should be requested in writing directly from Kari Bennett, Siena College Registrar and FERPA-designee ( This applies even if the PI has direct access to the information as an instructor, supervisor, and/or administrator.



Use of educational records for research purposes requires consent. Consent form must:

  1. Specify the records to be disclosed
  2. State the purpose of the disclosure 
  3. Identify the party to whom the disclosure is to be made
  4. Include a dated student signature
    • This may include a signature in an electronic form that 1) Identifies and authenticates a particular person as the source of the electronic consent; and 2) Indicates such a person's approval of the information contained in the electronic consent.



Exceptions allowing for the use of educational records for research purposes without consent include:

  • The only PII obtained constitutes “directory information” and the student has not opted out of having his/her information included in the directory. At Siena, the Registrar’s Office maintains the list of students who have opted out of the directory. 
  • The release is to an authorized representative of state/local educational authorities for an audit or evaluation of federal or state supported education programs, or for the enforcement of or compliance with federal legal requirements related to those programs. Investigators must provide IRB with evidence that they are acting as authorized representatives of a state or local educational authority and that their audit or evaluation meets the conditions described above (e.g. a Memorandum of Understanding between university and educational authority).
  • The release is to organizations conducting studies for or on behalf of educational agencies or institutions to develop, validate or administer predictive tests; administer student aid programs; or improve instruction. A written agreement which meets criteria listed in FERPA between the university and the educational agency or institution is required.


There are no exceptions to the consent rule for researchers at Siena who are not conducting systems-wide studies. For example, an exemption cannot be made for an instructor interested in using grades or assignments for a particular class or major. Student consent, with the required items (see above), is required.


Use of Course Evaluations for Research Purposes

Instructors who wish to incorporate data from course evaluations into their research, projects, the following guidelines are provided:

  • Student comments are not authorized for use for research purposes unless the student provides written permission.
  • Aggregate data (i.e., averaged by question; not examined across individual responses) may be examined for research purposes for classes in which there were a minimum of 5 respondents.
  • The PI must request the data directly from the registrar’s office. The data will be released in the form it can be used for research purposes.
  • Examining evaluations for research purposes from any course other than one’s own requires written permission from the instructor of record.

This policy on use of course evaluations was jointly developed by Siena’s FERPA designee and VPAA (September, 2019).