If you tuned into our informational webinar or received advice from your school attorney, you know that one of our favorite answers to coronavirus questions is “talk to your local public health officials.” You also likely heard about how important it is keep your school community informed with the status of your plans and preparations to respond to the novel coronavirus. Communications with these stakeholders are central to an effective response supported by the community, but at the same time schools must be mindful of their obligation to maintain the confidentiality of student records and information under state and federal law.
FERPA (Not HIPAA) Applies to School Records
It is important to remember that The Family Educational Rights and Privacy Act (FERPA) and state student record laws govern the confidentiality and disclosure of education records and treatment records maintained by a school or other educational institution. HIPAA, which applies to medical institutions and their maintenance of medical records, does not apply to the records of a school as long as the use of the records is for educational decisions. This was explained at length in joint guidance issued by the U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services, which can be found here.
Maintaining Student Confidentiality
FERPA is administered and enforced by the U.S. Department of Education’s Student Privacy Policy Office (SPPO, formerly the FPCO). The FERPA regulations, found at 34 C.F.R. Part 99, require the protection of the privacy of students’ education records and afford parents and eligible students certain rights to inspect and review education records, to amend these records, and to consent to the disclosure of personally-identifiable information (PII) from education records. FERPA prohibits the disclosure of PII from education records without written consent, unless an exception to consent applies.
An education record is any record that directly relates to a student and is maintained by an educational agency or institution. 34 C.F.R. § 99.03. An education record can either be in “print or computer media.”
This means FERPA would determine whether or not your school nurse could share information she collected about a student with county health officials. This also means that, unless an exception applies, written parental consent is required prior to disclosing such information. Earlier this week, the SPPO released guidance to schools responding to the novel coronavirus in the form a FERPA & Coronavirus Disease 2019 (COVID-19) Frequently Asked Questions (“FAQs”), which can be found here. The FAQs were intended to assist school officials in working with public health officials while complying with the requirements of FERPA.
Sharing Information with Health Officials
While consent is generally required prior to disclosing PII from a student’s education records, an exception applies if a school determines, based upon the totality of the circumstances, that there is an articulable and significant threat to the health or safety of the student or another individual necessitating disclosure. This is often referred to as the “emergency” exception to consent.
The FAQs document empowers schools to use this exception as appropriate to share information with health officials. It provides:
If an educational agency or institution, taking into account the totality of the circumstances, determines that an articulable and significant threat exists to the health or safety of a student in attendance at the agency or institution (or another individual at the agency or institution) as a result of the virus that causes COVID-19, it may disclose, without prior written consent, PII from student education records to appropriate officials at a public health department who need the information to protect the health or safety of the student (or another individual). Public health department officials may be considered “appropriate parties” by an educational agency or institution under FERPA’s health or safety emergency exception, even in the absence of a formally declared health emergency. Typically, public health officials and trained medical personnel are among the types of appropriate parties to whom PII from education records, may be non-consensually disclosed under FERPA’s health or safety emergency exception.
The document further empowers schools to rely on the opinions of local public health authorities in determining whether there is a significant, articulable threat to students. It states, “If local public health authorities determine that a public health emergency, such as COVID-19, is a significant threat to students or other individuals in the community, an educational agency or institution in that community may determine that an emergency exists as well.”
Additionally, the U.S. Department of Education has emphasized that a school’s decision to release information pursuant to the emergency exception will not be second guessed. In fact, 34 C.F.R. § 99.36(c) reads as follows:
If, based on the information available at the time of the determination, there is a rational basis for the determination, the Department will not substitute its judgment for that of the educational agency or institution in evaluating the circumstances and making its determination.
Sharing Information with the Public
While the health or safety emergency exception would permit disclosure of PII to health officials, it would not permit disclosure of PII to the general public. According to the FAQs, schools may generally release information about a student to the school community “only if that information is in a non-personally identifiable form.” In releasing information, the school must ensure that the student’s identity is not personally identifiable, either directly or indirectly considering all reasonably available information.
Conclusion
Fortunately, FERPA provides schools the discretion to disclose student information to appropriate officials as necessary to combat significant risks posed by the novel coronavirus. In communicating with the public, though, schools must be mindful of a student’s right to confidentiality and only disclose de-identified information. If you have any questions about complying with FERPA, or any other legal issue, we recommend you contact your school’s attorney, or call Karen, Steve, Bobby, Coady, or Jordan.