Skip to content Skip to main navigation Report an accessibility issue

FERPA

FERPA and Human Subjects Research at the University of Tennessee, Knoxville

Useful Links

The Family Educational Rights and Privacy Act (FERPA) is a Federal law designed to protect the privacy of student education records. It regulates the disclosure of personally identifiable information from student education records and applies to all educational institutions that receive funds under programs administered by the U.S. Department of Education. Such institutions can be public or private elementary, intermediate, high school, or college institutions. This guidance document focuses on FERPA as it applies to conducting research with student data at the University of Tennessee, Knoxville. See our other guidance document “FERPA and Human Subjects Research in Elementary, Intermediate, and High School Institutions” for information on FERPA in those settings.

FERPA gives university students certain rights with respect to their education records, including the right to review those education records and the right to request an amendment in the education records. Generally, schools must have written consent from the student in order to disclose personally identifiable information from education records, unless an exception applies.

Student Directory Information can be shared without student written consent, UNLESS the student has invoked the FERPA right to limit disclosure. At the University of Tennessee, Knoxville, this means that they have a submitted a Request for Directory Exclusion Form to the Registrar. If you have questions about whether a student has invoked the FERPA right to limit disclosure of Directory Information, please contact the Registrar’s Office to ask.

The information below is considered by the University of Tennessee, Knoxville to be Directory Information. This information can be used for research purposes without obtaining written consent from students:

  • Name
  • Graduate or Undergraduate Level
  • Semester (local) Address
  • Full-time or Part-time Status
  • Permanent Address
  • College
  • Classification
  • Most Recent Previous Educational Institution Attended
  • NetID
  • Major
  • Email Address
  • Dates of Attendance
  • Telephone Number (if published in directory)
  • Degrees, Honors, and Awards
  • Participation in School Activities and Sports (and photographs of such)
  • Weight and Height of Students Participating in Intercollegiate Athletics

The information below is FERPA-protected and cannot be used for research purposes without obtaining student consent. This list is not exhaustive, and any education records that are not considered Directory Information are FERPA-protected.

  • Social Security Number
  • Student ID Number
  • Grades
  • GPA (term or cumulative)
  • Notes From a Conversation with a Student
  • Emails Containing Information About a Student
  • Online Discussion Forums (e.g., Canvas)
  • Student Schedule
  • Academic History
  • Academic Standing
  • Graded Papers
  • Exams
  • Transcripts
  • Class Rosters
  • Recordings of Class Discussions (audio and video)

Frequently Asked Questions

FERPA allows the disclosure of personally identifiable information without student consent in a limited number of circumstances, including the following:

  1. When the data is being used by a University official with legitimate educational interests; and
  2. When the data is being used by an organization conducting institutional services or functions on behalf of the University.

“Legitimate educational interest” is defined as the need to review an education record in order for a University official to carry out their responsibilities on behalf of the University, such as performing an administrative task outlined in the official’s duties, performing a supervisory or instructional task directly related to the student’s education, or providing a service or benefit relating to the student.

No. “Written consent” can be collected electronically under some circumstances. Students can sign a paper consent form and then scan it and return it via email or fax. Consent can also be considered “written” at the University of Tennessee, Knoxville if students enter their University NetID and Password online to indicate consent.

Information is considered personally identifiable if direct identifiers are included. Information may also be considered identifiable if a combination of indirect identifiers could possibly be used to re-identify participants or if the researcher has access to a code key that would allow them to re-identify participants.

Yes. A school official (who is not the researcher) with legitimate access to the FERPA-protected data may strip the records of any identifying information and provide the data to the researcher. The official who de-identifies the data cannot be involved in the research.

If a recording includes only the instructor/faculty member, it is not a student record and FERPA protection laws would not limit the content’s use. If the recording includes students speaking, asking questions, making presentations or otherwise participating in the course in any manner which makes it possible to identify the student, the segments containing recordings of the student do constitute protected educational records and are FERPA protected. Recordings that include identifiable information about students cannot be shared with individuals outside the class for research purposes without either obtaining student permission or de-identifying the recordings.

Recordings can be edited to either omit any student who has not consented to the use of their voice or image or be edited to de-identify the student in the recording (which can include avoiding or removing any mention of the student’s name, blurring the student’s image, altering voice recordings, etc.). Recordings can also be planned so that students (such as those asking questions during a class) are not shown in the video or referred to by name.

It depends on the purpose of the research. You may use your own students’ data for research without obtaining written consent if you are conducting research into the effectiveness of the educational programs you provide and if only university faculty and staff who have professional responsibility to conduct the research will have access to the records. If your research has another purpose, you must obtain student written consent or use de-identified data.  Your own students’ data can be de-identified by a school official with access to the data and then be provided back to you in the de-identified format for research purposes.

The written release must: (1) specify the records that may be disclosed, (2) state the purpose of the disclosure, and (3) identify the party or class of parties to whom the disclosure may be made. This information can be included in the informed consent presented to participants for participation in the research study. 

Examples of working with FERPA-protected data at the University of Tennessee, Knoxville:

A professor wants to conduct research on how first-year college students are adjusting to the transition to college. She asks instructors of First-Year Studies courses to give her the email addresses of their students so that she can send them a recruitment flyer about the study.

This recruitment method would require the course instructors to violate FERPA because course rosters are FERPA-protected and cannot be released for research purposes without student consent. An alternative option would be for the professor to ask instructors of First-Year Studies courses to share a recruitment flyer with their students on her behalf.

A graduate student wants to conduct research on how student grades differ for classes that are taught online versus in-person. A faculty member in her department (who is not affiliated with the research) is teaching two sections of an English Course – one is online, and one is in person. The graduate student asks the faculty member to share de-identified exam scores for each course so that she can compare them to each other. No direct or indirect identifiers will be included in the data that is shared and there is no code key that would allow for re-identification of students.

This study does not violate FERPA regulations. Although student grades are being shared for research purposes, they are not being shared in an identifiable manner.

If student demographic data was being shared along with the grades, there is the possibility that the data may become identifiable. For example, if student gender and race were shared and there was only one black female student in the online course, that individual student’s grades would be able to be identified even though her name wasn’t shared. In this case, written consent from the students would be required for this research.

A faculty member wants to conduct research on whether student anxiety about math is related to their exam scores in his Economics course. Students who participate in the study will be asked to complete a survey that assesses their anxiety about math, and this will be correlated to their exam scores throughout the semester.

Although the faculty member has access to student exam scores for teaching purposes, he must obtain written consent from the students to use them for research purposes. This research does not violate FERPA as long as students give written consent for their exam scores to be used for the research.

The flagship campus of the University of Tennessee System and partner in the Tennessee Transfer Pathway.