77. DoEd: Exceptions to FERPA Requirements

Updated May 26, 2026

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. Under specific conditions, FERPA regulations (34 CFR 99) allow an educational institution to disclose information from student education records without prior written consent. The University IRB has the authority to grant such exceptions as they relate to human research.

In order to approve a FERPA exception related to a waiver of consent for research, the IRB considers both DHHS Common Rule requirements and DoEd FERPA requirements. An investigator should provide sufficient information for the IRB to determine that one of the following FERPA exceptions applies to the proposed research, and that the research meets the following criteria:

  1. The research involves no more than minimal risk to participants;
  2. The research could not practicably be carried out without the requested waiver;
  3. The research could not practicably be carried out without using education records in an identifiable format (additional information regarding FERPA requirements for de-identification can be found below); and
  4. The waiver will not adversely affect the rights and welfare of participants.

Note that if none of the FERPA exceptions apply, FERPA requires written consent to be signed, dated, and include certain elements as described in policy 76. Additional DoEd Regulations - Family Educational Rights and Privacy Act (FERPA). The IRB cannot approve an alteration of FERPA-required elements of consent or a waiver of the requirement for documentation of consent.

FERPA Exception 1: Disclosure of Education Records Consisting Solely of Directory Information

Directory information is considered publicly available and may be released without a student's prior written consent. At the University of Nevada, Reno, the following student education records are defined as directory information:

  • name;
  • address;
  • telephone number;
  • email address;
  • major field of study;
  • participation in officially recognized activities and athletics (including Greek organizations);
  • weight and height measurements for members of athletic teams;
  • dates of attendance;
  • enrollment status (e.g., full-, half-, part-time; undergraduate or graduate);
  • degrees and awards received; and
  • listings of the most recent educational agency or institution the student has attended.

Investigators seeking to use directory information for students at non-University sites are advised to contact the school district, external institution, or other oversight body for information and permission.

External investigators wishing to use directory information for research involving University faculty, students, or staff should obtain permission from the official responsible for protecting the privacy of the information being requested. Such external research does not require review or approval by the University IRB but may require approval from the IRB at the investigators’ home institutions.

FERPA Exception 2: Disclosure of Education Records for Research Conducted for Educational Agencies

An exception to FERPA requirements may be granted if the disclosure of personally identifiable information from student education records is part of an agreement between organizations or researchers conducting studies for, or on behalf of, educational agencies or institutions to:

  • develop, validate, or administer predictive tests;
  • administer student aid programs; or
  • improve instruction;

Investigators requesting exception 2 must provide the IRB with documentation of an agreement between the researcher and the applicable educational institution. The agreement must include the following:

  • A statement that the exception will be granted;
  • A statement about the purpose, scope, and duration of the study;
  • A description or list of the information to be disclosed;
  • A statement that information from education records will only be used to meet the purposes of the study as described in the agreement;
  • Assurance of compliance with the current requirements in 34 CFR 99.31(a)(6) on re-disclosure and destruction of information;
  • A statement that the study will be conducted in a manner that does not permit personal identification of parents and students by anyone other than members of the research team;
  • A statement the researchers will destroy or return all personally identifiable information when no longer needed for the purposes of the study;
  • Specification of the time period during which the researchers must either destroy or return the information.

FERPA Exception 3: Disclosure of Education Records Containing No Personally Identifiable Information

An educational institution may release education records without a student’s prior written consent after the removal of all personally identifiable information. To do so, the institution must make a reasonable determination that the student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information.

Investigators requesting exception 3 must provide the IRB with a confirmatory statement that the following personally identifiable information will be excluded from the data set:

  • Student’s name and other direct personal identifiers such as the student’s social security and student ID numbers;
  • Indirect identifiers, such as
    • the name of the student’s parent or other family members;
    • the student’s or family’s address;
    • personal characteristics or other information that would make the student’s identity easily traceable;
    • date and place of birth and mother’s maiden name;
  • Biometric records (i.e., measurable biological or behavioral characteristics that can be used for automated recognition of an individual) including
    • fingerprints;
    • retina and iris patterns;
    • voiceprints;
    • DNA sequence;
    • facial characteristics;
    • handwriting;
  • Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify an individual student with reasonable certainty.

Investigators cannot claim exception 3 by proposing to de-identify education records obtained from or about their own students, or if they are otherwise already in possession of the identifiable information. A school official (who is not the researcher) with legitimate access to the FERPA-protected information may strip the records of any identifying information and then provide the data to the research team. The official who de-identifies the data cannot be involved in the research.

An educational institution or official with legitimate access may release de-identified student level data from education records by attaching a code to each record that may allow the recipient to match information received from the same source or track performance of individual students, without the student’s identity being revealed. The institution may not disclose any information about how it generates and assigns a record code, or that would allow a recipient to identify a student based on a record code. The record code must be used for no other purpose than marking a de-identified record for purposes of education research, cannot be used to ascertain personally identifiable information about a student, and cannot be based on a student's social security number or other personal information.

FERPA Exception 4: Disclosure of Education Records to School Officials with Legitimate Educational Interest

An exception to FERPA requirements may be granted if the disclosure of personally identifiable information from student education records is to school officials, including educators, whom the agency or institution has determined to have legitimate educational interest.

A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill their professional responsibilities for the educational institution or agency. To the extent that the proposed research is educational in nature and intended to improve teaching practices, such as the study and improvement of instructional strategies and techniques, or curricula or classroom management methods, the research may be considered necessary for the school official to fulfill their professional responsibility. As such, these officials may be considered to have legitimate educational interest in the disclosure of student records without prior written consent for research purposes. Investigators conducting research involving education records obtained from or about their own students may be eligible for this FERPA exception, pending IRB approval.

Investigators requesting exception 4 must provide the IRB with a confirmatory statement that the proposed research meets the following criteria:

  • The proposed research is educational in nature and intended to improve teaching or instructional practice, curricula, or classroom management methods, or evaluate the effectiveness of an educational program that they provide;
  • The investigators are school officials of the educational institution or agency from which the education records will be disclosed; and
  • Only individuals with legitimate educational interest on the research team will obtain, access, or analyze personally identifiable information from the education records.