Must the school or LEA have a written agreement with the community-based organization conducting the study?

Yes.  Written agreements are required under the studies exception, §99.31(a)(6)(iii)(C), and must

1. Specify the purpose, scope, and duration of the study and the information to be disclosed. 
2. Require the community-based organization to use personally identifiable information (PII) from education records only to meet the purpose(s) of the study as stated in the written agreement.
3. Require the community-based organization to conduct the study in a manner that does not permit the personal identification of parents and students by anyone other than representatives of the organization with legitimate interests.  This typically means that the organization should allow internal access to PII from education records only to individuals with a need to know, and that the organization should take steps to maintain the confidentiality of the PII from education records at all stages of the study.
4. Require the community-based organization to destroy all PII from education records when the information is no longer needed for the purposes for which the study was conducted, and specify the time period in which the information must be destroyed.