U.S. Department of Education Releases Guidance on Student Privacy Related to Coronavirus

The Student Privacy Policy Office of the United States Department of Education, which is the agency of the federal government that administers compliance with the Family Educational Rights and Privacy Act (“FERPA”), released guidance today (“Guidance”) whose stated purpose is to “assist school officials working with public health officials in managing public health issues related to [coronavirus], while protecting the privacy of students’ educational records.”  

The Guidance contains a number of questions and answers related to how privacy rights under FERPA interact with the exigencies of the coronavirus situation.

Given the insatiable appetite of the 24×7 news media and the need for schools to disseminate credible and thoughtful information to the public about their operations during this difficult time, the Guidance provides timely perspective on how to safeguard student privacy while also informing the public.

A Review of FERPA's "Health or Safety Emergency Exception"

The Guidance unpacks the contours of the “health or safety emergency” provisions of FERPA’s implementing regulations, 34 C.F.R §§ 99.31(a)(10) and 99.36, which state, in pertinent part:

An educational agency or institution may disclose personally identifiable information from an education record to appropriate parties, including parents of an eligible student, in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.

The Guidance observes that, as a general rule, consent of the parent or guardian of a student or an eligible student, is required prior to disclosure of protected information from education records. Similarly, the Guidance states, the “public health emergency” provision is not applicable if the situation is based on “a generalized or distant threat of a possible event or emergency for which the likelihood of occurrence is unknown.”  Thus, the invocation of the public health emergency provision would need to be made in conjunction with local health authorities who determine that there is, in fact, a public emergency in the community.

The guiding principle, which is examined in detail in the remainder of the Guidance, is that if protected information is being released to health authorities in reliance on the “health or safety emergency” exemption, the health emergency must be evaluated on a case-by-case basis, taking the totality of the circumstances into account.

Specific Scenarios

The Guidance goes on to list several specific scenarios. The first two questions serve as a review of FERPA. The next two relevant scenarios (numbered 3 and 4 in the Guidance) mirror each other.

Question 3 asks whether student education records, such as health records, may be disclosed without consent to a public health department if the school believes that coronavirus poses a serious risk to the health or safety of an individual student in attendance at the school. This scenario would cover, for example, a student who has coronavirus or has transmitted the coronavirus in the school environment, even if that student has subsequently self-quarantined.

The Guidance states that, if the school believes, under the totality of the circumstances, that there is a significant risk to a student (or to another individual), it may disclose sufficient protected information to a health department so that the health department may protect the health and safety of the student or others. The Guidance goes on to say that “typically, public health officials and trained medical personnel are among the types of appropriate parties to whom [protected information] may be non-consensually disclosed” under the health or safety emergency exception to FERPA.

Although not explicit on this point, it would appear from the Guidance that such information may be disclosed to medical personnel such as ISD nurses and the like as the school takes measures based upon the threat. This should be discussed with school counsel. 

Question 4, which mirrors question 3, is whether a school that learns a student is out sick due to coronavirus may disclose information about that student’s illness to other students and their parents without prior consent.

The Guidance states that the nonconsensual disclosure would be appropriate ONLY if the student or students who are out sick are not identified or cannot be reasonably identified by a member of the community based on the facts released, alone or in combination with other facts or information.

Question 5 asks whether the school may disclose the names, addresses and phone numbers of absent students to a public health department so that the health department may contact parents to inquire about the illness.

The Guidance observes that, while directory information is generally able to be released, it may not be released in combination with non-directory information, such as a tabulation of absences. Thus, the school would only be able to release such information under an exception to the consent requirements of FERPA. One such consent requirement exception could be the health or safety emergency exception to FERPA, but only if the school, with the concurrence or at the direction of the health department, were able to articulate the grounds for such an exception, as described above. Again, counsel should be consulted in this situation.

The next two questions are related.

Question 6 asks whether schools may disclose protected information about a student to the media. Obviously, the answer is that schools may not. There is no exception that covers disclosure to the media, and media are not considered “appropriate parties” under FERPA in the same way that medical personnel may be.

Finally, question 7 asks if schools may identify a particular student, teacher, or staff member as having coronavirus to parents or guardians of other students in the schools. The Guidance takes a dim view of this, stating that “in most cases, it is sufficient to report the fact that an individual in the school has been determined to have” coronavirus. The Guidance discusses that it cannot opine as to the appropriateness of discussing the health of staff and teachers, as they are not covered by FERPA. The Guidance then goes on to identify a very limited scenario as an example of when it may be appropriate to notify other parents or guardians about a student: it may be appropriate, the Guidance says, to notify parents or guardians of a specific wrestler who has been in direct and close contact with other team members.

While the Guidance does not speak to the privacy of staff members, it is critical that schools refer to their personnel contracts, collective bargaining agreements, applicable law, and their counsel to determine how to proceed.

The Guidance contains two more questions and responses related to written consent from students over the age of majority who do not generally intersect with the K-12 school environment, but are worth summarizing here.

Questions 8 deals with the release to the parent or guardian of an eligible student of protected information if the student has coronavirus. An eligible student, under FERPA, is a student who has reached 18 or is attending an institution of higher education. Under FERPA, if the parent claims the student on his/her tax returns, then disclosure may be made to that parent of protected information without the eligible student’s consent.

Question 9 deals with refusal of a parent of a student, who is not an eligible student, refusing to provide written consent to permit the release of protected information to the public health department.

This question is somewhat misleading. The scenario that the Guidance is attempting to address, it appears from the context, is a general release of a class list directory of names of every student in that class or grade. The recommendation of the Guidance is to either obtain a specific release from each parent or guardian of every student on the list or to identify the specific FERPA exemption that could be used. 

Conclusion

As schools accustom themselves to the impact of widespread illness on their populations in the digital age, when social media chat groups engage in speculation about school happenings and a seemingly insatiable media needs to be provided with responsible information in order to preserve credibility and integrity of the school environment, the Guidance gives schools some good, concrete answers about information sharing.