2. Research Involving Student Records or Surveys April 2016 Maya R. Kobersy Associate General Counsel University of Michigan

3. FERPA Overview Applies to all schools, colleges, and universities that receive funding from U.S. Department of Education (ED) Grants K-12 parents/college and university students key rights: Right of annual notification of university’s FERPA policies Right of access to own education records Right to seek amendment of education records Right, generally, to control release of personally identifiable information from education records Right to file complaint with Family Policy Compliance Office for alleged violations

4. Selected Definitions Education record Record that 1) contains personally identifiable information (PII) about a student and 2) is maintained by the educational institution Does not include the following: Personal knowledge or observations Sole possession notes Law enforcement records Treatment records Employment records – unless the employment is because of the student’s status as a student Post-graduation records not related to past attendance as student Grades on peer-graded coursework before collected and recorded

5. Selected Definitions Personally identifiable information (PII) Name and address of student or family members Personal identifiers Social Security Numbers Student ID numbers Biometric records Indirect identifiers Date of birth Place of birth Mother's maiden name Information that, alone or in combination, could allow someone without personal knowledge to identify the student with reasonable certainty Information requested by someone whom the institution reasonably believes knows the identity of the student to whom the education record relates

6. Consent Requirements Unless exception applies, parent/eligible student must provide consent to disclosure of PII Consent must: Be written (electronic can count) Be signed and dated Describe records to be disclosed Describe to whom records can be disclosed Describe purpose of disclosure 6

7. Directory Information Exception Can disclose PII without consent as long as both of the following are true: Institution has notified its students of the information it has designated as “directory information” in annual FERPA notice Institution has given students the opportunity to opt out of disclosure Completely Re: particular purposes Re: particular parties

8. Directory Information Exception Can designate as “directory information” information such as the following: Student’s name, address, telephone number, and email address Student’s photograph Student’s date and place of birth Student’s grade level, enrollment status, field of study, degrees, and dates of attendance Student’s participation in officially recognized activities and sports Student’s weight and height, if a member of an athletic teams Student’s honors and awards Student’s most recently attended educational agency or institution Other information not likely to be viewed as harmful or an invasion of privacy if disclosed Cannot include the following: Student’s Social Security Number Student’s student identification number, unless is not sufficient, on its own, to grant access to student’s education records

9. Study Exception Can disclose PII without consent as long as all of the following conditions are met: Organization is conducting study for or on behalf of the disclosing institution Study has appropriate purpose Developing, validating, or administering predictive tests Administering student aid programs Improving instruction Study is conducted in manner that does not permit personal identification by others not involved with study PII is destroyed when no longer needed for study’s purposes Organization and institution have entered into appropriate written agreement (see next slide ) Disclosing institution not required to initiate the study or agree with or endorse its conclusions or results

10. Study Exception Written agreement between disclosing institution and organization conducting study must include the following terms: Specification of purpose, scope, and duration of the study and the information to be disclosed Requirement that organization use PII only to meet the authorized purpose of the study Requirement that organization conduct the study in a manner that does not permit personal identification by anyone other than organization’s representatives Requirement for destruction of all PII when no longer needed for the study and specification of the time period for destruction If organization violates these requirements, cannot receive PII from disclosing institution for at least 5 years

11. School Official Exception Can disclose PII without consent to “school official” with “legitimate educational interest” (as defined in institution’s annual FERPA notice) Institution must use reasonable methods to ensure that school officials can access only if have such a legitimate interest: Physical access controls Technological safeguards Effective administrative policies 11

12. School Official Exception “School official” can include contractors or other outside parties IF: Performing an institutional service or function Under direct control of institution re: use/maintenance of education records Uses only for for permitted purpose Generally, school official has “legitimate educational interest” if needs PII to fulfill professional responsibility 12

13. De-Identified Records Exception Can disclose without student consent after removal of all PII Disclosing institution must first make reasonable determination that a student’s identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information Can release de-identified student-level data for education research by attaching a code to each record that permits matching information received from the same source Cannot disclose how code generated or assigned Code must be used only for this purpose and must not enable ascertaining of PII Code cannot be based on SSN or any other PII

14. Scenario #1 Research protocol states 3rd grade students will be surveyed about the number of hours per day they watch TV and their favorite shows. PI will then review participating students’ education records to see whether/how outcomes vary depending on courses taken, grades, and number of absences from school Consent informs parents about survey, but does not expressly reference use of education records Is this OK under FERPA? Would IRB approve? 14

15. PPRA Overview Applies to elementary and secondary schools that receive ED funding Requires schools to provide notice to parents of planned surveys and invasive physical examinations Requires schools to permit parental inspection of survey instrument (upon request) Imposes parental consent requirements for surveys involving “ protected information” If ED-funded, must be opt in (no waiver!) If not ED-funded, can be opt out Imposes consent requirements for certain non-emergency invasive physical examinations Rights transfer to students who are 18 or emancipated minors

16. “Protected Information” Political affiliations or beliefs of student or parent Mental and psychological problems of student or family Sex behavior or attitudes Illegal, anti-social, self-incriminating, or demeaning behavior Critical appraisals of family members Legally recognized privileged or analogous relationships, such as those with lawyers, physicians, and ministers Religious practices, affiliations, or beliefs of student or parent Income (other than as needed to determine eligibility for program or for financial assistance)

17. Invasive Physical Examination Includes the following: Any medical examination that involves the exposure of private body parts Any act during a medical examination that includes incision, insertion, or injection into the body Does not include the following: Hearing test Vision test Scoliosis screening Any examination or screening required or permitted by state law, including those that do not require parental notification

18. Scenario #2 ED-funded study will be administered to 10 th grade public school students during school day Study will ask about students’ religious beliefs and their experiences with sex, drugs, and alcohol Does PPRA apply? If so, what are the relevant requirements? What might IRB require? 18

19. Final Note: Implications for IRBs Recognize that these are just two of many laws that can intersect to affect consent issues in human subjects research Where research involves data from other schools, request site approval letters that show consideration of how these laws apply Help researchers understand how these laws apply and why they are important – and that institutions are not required to supply information (even if IRB approves study)!

20. Questions? 20