Alert

Protecting Student Privacy: DOE Issues Guidance for Educators on Permissible COVID-19 Disclosures Under FERPA

On March 12, 2020, the U.S. Department of Education (“DOE”) issued a critical Frequently Asked Questions guidance document (and also established a resource page) for the education sector regarding compliance with the Family Educational Rights and Privacy Act (“FERPA”) when addressing requests and inquiries concerning student health information relating to the coronavirus (“COVID-19”) public health crisis. All education officials who are required to comply with FERPA should review and study this guidance to develop a thorough understanding of the types of disclosures that are allowed under FERPA as it pertains to coronavirus-related student health information. In doing so, educators can ensure they possess the ability to provide critical information needed to protect the health and safety of their communities, while at the same time maintaining compliance with the law.

Overview of the Recently Issued DOE FERPA Guidance

The DOE’s recently issued FERPA guidance provides key information for education officials on their obligations to ensure student privacy and the conditions under which they may disclose the personally identifiable information (“PII”) of students to health officials, law enforcement, other students, parents, and the media in response to the current COVID-19 crisis. In particular, the DOE offers vital guidance regarding the applicability of FERPA’s health and safety emergency exception—which allows student PII to be disclosed in the absence of prior consent—in the context of COVID-19. In addition, the guidance also offers an analysis of several scenarios where the health/safety emergency exception and other privacy concerns are implicated in connection with requests or inquiries relating to COVID-19, and considerations for education officials under these circumstances.

Compliance Steps

To protect both the privacy of students and the health and well-being of others, while at the same time keeping compliant with FERPA, education officials should consider the following:

• Know the General FERPA Prior Consent Rule and Exceptions to Its Applicability: Generally speaking, FERPA prohibits educational agencies and institutions from disclosing the PII of students without the prior written consent of a parent or eligible student, unless an exception to FERPA’s consent rule applies. Of particular relevance in the context of the current COVID-19 public health crisis is FERPA’s “health or safety emergency” exception, which allows the disclosure of student PII without prior consent in the event of an emergency, where disclosure of the information is necessary to protect the health or safety of students or others.
• Understand When the Health/Safety Emergency Exception is Triggered: For the health/safety emergency exception to apply, a qualifying “emergency” must exist. Here, the guidance notes that an emergency exists if a local public health authority determines that a public health emergency, such as COVID-19, poses a significant threat to the community. If an emergency exists, education officials must then determine if there is an “articulable” and “significant” threat to the health/safety of others that makes it necessary to disclose such information. If both conditions are met, the health/safety emergency exception is triggered, allowing for student PII to be disclosed without consent under certain circumstances.
• De-Identified and Aggregate PII Disclosures Permissible: Even if the health/safety exception is not applicable, under FERPA education officials are still nonetheless permitted to disclose de-identified or aggregate student PII/health information, so long as the information cannot be used to identify an individual student.
• Disclosures to Public Health Officials: Under the health/safety emergency exception, education officials may disclose the PII/health information of students without prior consent to public health agencies if the agency’s knowledge of the information is necessary to protect the health and safety of other members of the community.
• Disclosures Identifying a Student as Having COVID-19: Education officials must proceed with caution before disclosing the identity of a student that has tested positive for COVID-19 to other students or parents. The DOE recommends that general notices to parents or community members, which do not share the identity of infected students, should be made whenever doing so will achieve the objective of providing notification of potential COVID-19 exposure. Conversely, the identity of an infected student can only be disclosed if the education official is able to conclude that an articulable and significant threat to others exists, and disclosing the identity of the student is necessary to protect those individuals. Here, education officials should use their best discretion to determine when to notify select sets of students or others in the event these individuals have had close contact with another student who has been diagnosed with COVID-19. It is important to note that education officials are given a broad degree of flexibility in making this call, as the guidance notes that this is a “flexible” standard, and that the DOE will not second-guess the educator’s judgment so long as a “rational basis” existed for making the determination.
• Disclosures Relating to a Student’s Absence Due to COVID-19 Illness: Education officials are permitted to disclose information relating to a student’s absence stemming from COVID-19 only if the disclosure can be made in a manner that does not provide other information that—alone or in combination—would allow a reasonable person to identify the infected student with “reasonable certainty.” Here, a good rule of thumb to abide by is to limit disclosures of absence-related information to only those situations where other students were also absent during the same period for unrelated reasons.
• Disclosures Relating to Teachers or Other School Officials: Education officials are fully permitted under FERPA to disclose that a teacher or other staff member has tested positive for COVID-19, as FERPA’s privacy protections do not extend to cover these classes of individuals. Note, however, that other state laws may also apply that could limit disclosures of this nature under certain circumstances.
• Disclosures to the Media Are Strictly Prohibited: In today’s viral environment, and with the public clamoring for minute-by-minute updates on the status of the community spread of COVID-19 around the country, it is likely that many education officials will be inundated with inquiries from members of the media regarding the health status of their students and staff. However, under no circumstances should any student PII/health information be disclosed to the media, as FERPA strictly prohibits the dissemination of student PII to members of the media under all circumstances, even during the present public health crisis.
• Documentation: Lastly, education officials must ensure that they document all access requests, as well as each disclosure of student PII/health information. Importantly, if any disclosures are provided under the health/safety emergency exception, education officials must also make sure to document the health/safety threat to students or other members of the community that formed the basis for the disclosure, as well as all parties to whom the disclosure was made. 

Conclusion

With the community spread of COVID-19 greatly feared but widely unknown, education officials will likely continue to field a litany of requests and inquiries over the course of the coming weeks and months from concerned students, parents, and other members of the community seeking information as to any suspected or confirmed cases of COVID-19. Consequently, educators need to be able to effectively respond with information that is necessary to ensure the health and safety of the community, while at the same time ensuring the privacy of students and strict compliance with the law.

As such, educators should devote the necessary time to study the DOE’s recent COVID-19 DOE guidance so they can have a full understanding of what FERPA does and does not allow in terms of disclosures in the context of COVID-19. In addition, education officials should also consider developing written policies and procedures that provide detailed guidelines for the disclosure of student PII/health information to various stakeholders, such as parents, law enforcement, medical and health professionals, and other members of the community.

As part of its COVID-19 Task Force, Blank Rome’s cybersecurity and privacy professionals can assist with providing key counseling and guidance with respect to any issues or concerns relating to the permissible scope of disclosures that can be made by education officials under FERPA and other applicable laws, as well the necessary policies, procedures, and protocols that educational agencies and institutions should have in place to comply with FERPA when fielding and responding to inquiries relating to the ongoing public health crisis.

 © 2020 Blank Rome LLP. All rights reserved. Please contact Blank Rome for permission to reprint. Notice: The purpose of this update is to identify select developments that may be of interest to readers. The information contained herein is abridged and summarized from various sources, the accuracy and completeness of which cannot be assured. This update should not be construed as legal advice or opinion, and is not a substitute for the advice of counsel.