Must the school or LEA have a written agreement with the community-based organization conducting the study?

Yes.  Written agreements are required under the studies exception, §99.31(a)(6)(iii)(C), and must—

  1. Specify the purpose, scope, and duration of the study and theinformation to be disclosed. 
  2. Require the community-based organization to use PII fromeducation records only to meet the purpose(s) of the study as stated in the written agreement.
  3. Require the community-based organization to conduct the study in a manner that does not permit the personal identification of parentsand students by anyone other than representatives of the organization with legitimate interests.  This typically means that the organization should allow internal access to PII from education records only toindividuals with a need to know, and that the organization should takesteps to maintain the confidentiality of the PII from education recordsat all stages of the study.
  4. Require the community-based organization to destroy all PII fromeducation records when the information is no longer needed for thepurposes for which the study was conducted, and specify the timeperiod in which the information must be destroyed.

(For more information on drafting written agreements, see Guidance for Reasonable Methods and Written Agreements by FPCO and PTAC’s Data Sharing Agreement checklist.)