The instructions for supervisors of an NIH NRSA Fellowship say:
B. Sponsor's/Co-Sponsor’s Previous Fellows/Trainees Give the total number of predoctoral and postdoctoral individuals previously sponsored. Select up to five that are representative and, for those five, provide information on time spent in the lab their present employing organizations and position titles or occupations. Include this information for any co-sponsor as well.
While the instructions do not say the supervisor needs to provide names, even in the absence of a name, providing the information seem like it is treading close to a FERPA violation. It would be surprising if a reviewer would not be able to identify who the former students from the required information even in the absence of the name.
Do I need my former students to fill out some sort of FERPA statement? If so, can I make it them agreeing to some sort of blanket FERPA release a requirement for me to agree to supervise them?
Intuitively I would think that if signed consents were needed, NIH would instruct you to include them in your application or, at least, to obtain them and keep them on file.
I checked a few universities and found that they publish an email address for addressing FERPA questions. Also, there is a contact page for the compliance section of the Department of Education: http://familypolicy.ed.gov/content/family-policy-compliance-office-contact-information
I'm not sure if it's relevant, but on that same page, I read:
Collection of Personal Demographic Data
NIH collects personal data through the eRA Commons Personal Profile. The data is confidential, and is maintained under the Privacy Act record system. http://grants.nih.gov/grants/collection-of-personal-demographic-data.htm
The part of FERPA that looks like it might be relevant is here.
The basic idea that I got about this is that NIH commits to holding the personal information you share with it as close to its chest as your university does. In other words, it commits to using the personal information you give it for internal purposes only. My big-picture view of FERPA is that it provides protections to students from having their personal information publicly disseminated (subject to a ton of fine print).