IRB Guidance: Use of Student Records in Research

This page provides an overview of using student records in research projects

This guidance is in reference to academic records obtained from UW-Madison.  The process at other educational institutions - including K-12 sites, etc. - is the same or similar as procedures outlined below.

Prior to starting the IRB process, some preliminary determinations must be made:

Research vs. Evaluation/Quality Improvement
Is the proposed project research or evaluation/quality improvement?
The IRB does not have to review/approve projects that are being done solely for evaluation/course improvement purposes. 

Completing the IRB process at UW-Madison for research projects that include student academic records:

Specify Records
The researcher must specify the exact fields that will be requested/obtained from academic records. This includes indicating the number of data pulls that are being requested (one time, each semester, for the participant’s entire time at UW-Madison) and detailing how data will be obtained (from Registrar's Office, from departmental administrator, etc.).

Consent is required for access to identifiable student records for research purposes.  It is the researchers responsibility to obtain consent that is IRB approved and FERPA compliant.  If the consent language and consent process do not meet the requirements of FERPA, FERPA-protected data from the student record generally cannot be released to researchers.  Researchers are strongly encouraged to consult with the Office of the Registrar staff early in the planning of studies that will include a request for information from the FERPA-protected student record.

Identifiable vs. De-Identified Records
De-identified student records may not require consent, but de-identification requires more than just removing names or ID numbers. De-identification to FERPA standards requires that all direct and indirect identifiers that could be used in combination to identify an individual be removed; for example, demographic information that creates small cells of individuals must be removed from a data set (see IRB Guidance: Identifiability for more detail).
Signed Consent 
Signatures from each participant will be obtained and presented to the Registrar's Office in order to obtain data from academic records.  The consent form must specify the exact fields that will be requested/obtained and indicate the number of data pulls that are being requested. If academic records are being linked to other study data, that also needs to be outlined on consent documents.

Waiver of Signed Consent (Online/Electronic Consent Process)
In order to address FERPA, electronic consent must not only include a statement of the records to be disclosed, for what purpose, and to whom, but must also include a process to 1) identify and authenticate the person providing consent; and 2) indicate this person's approval of the information contained in the electronic consent.  Current guidance from the Registrar's Office suggests the following if an electronic consent process is employed:

1) Collect consent in a manner that authenticates and is traceable back to the individual student.
  • Send recruitment material and/or the link to the electronic consent form to only e-mail addresses;
  • Use survey platforms, such as Qualtrics, to send each participant a unique, traceable URL to direct them to the online survey.
2) Collect consent in a manner that indicates the student's consent.
  • Require a typed student name and date;
  • Require a typed student ID number.
Just as with written consent, the copies of electronic consent forms must become a part of the investigators research file and be retained for auditing purposes.

Contact Jeff Kirschling at for more information.

Data Use Agreement (DUA)
Under limited circumstances, a DUA may be obtained in lieu of consent. A determination must be made by the Registrar’s Office that the research is being conducted on behalf of the institution in order to improve instruction. If this determination is made, the Registrar’s Office will enter into a DUA with the researcher. A fully executed DUA will be required prior to final approval. Details in a DUA must include: 
  • The specific data that is to be disclosed; 
  • The purpose, scope and duration of the study; 
  • A plan to return/destroy data when no longer needed for said purposes/scope; 
  • Data security plans. 
ARROW Protocol Application Information
Addressing areas of the ARROW protocol application:

Review of Records
If the study requests use of student record data, select the "Secondary use of information (record/data/images)" option in the Special Considerations and Procedures section.  Then, on the "Review of records/data/images" and "Secondary Use" pages, the researcher must specify:
  • The exact fields that will be requested/obtained from academic records; 
  • Indicate the number of data pulls that are being requested (one time, each semester, for the participant’s entire time at UW-Madison); 
  • Detail how data will be obtained (from Registrar's Office, from departmental administrator, etc.).
For studies that use a signed consent process the researcher should select “Consent process with signed consent documentation.”  On the "Informed Consent: Overview" page, the researcher must detail the process for obtaining consent and upload the consent documents to be used.

If a DUA has been agreed to by the Registrar’s Office, the researcher must request a waiver of informed consent in the ARROW application. On the "Waiver of Informed Consent" page, the researcher must detail that a fully executed DUA will be obtained from the Registrar’s Office in lieu of consent.  The finalized DUA must be provided on the "Review of records/data/images" page.

Additional Information
When a study team member has access to academic records as part of their position at UW-Madison and plans to obtain written consent from participants to use student-level data (class assignments, evaluations, course grades) for research purposes the IRB suggests checking with the Registrar's Office to ensure compliance with campus policy. 

UW employees who have access to student academic records as part of their position at the university may NOT provide data to faculty or staff for research purposes. Only the Registrar’s Office has the authority to make those determinations.

If an investigator is able to get approval from the IRB for a study that involves the use of data obtained from academic records—that does not mean that the Registrar's Office has the obligation or the resources to provide the data.

Keywords:student records, academic records, FERPA, DUA, data sharing agreement, registrar   Doc ID:43325
Owner:Casey P.Group:Education and Social/Behavioral Science IRB
Created:2014-09-02 08:00 CSTUpdated:2019-12-05 08:15 CST
Sites:Education and Social/Behavioral Science IRB, VCRGE and Graduate School
Feedback:  0   0