The U.S. Department of Education (DOE) has issued guidance in the form of Frequently Asked Questions to assist school officials with how to protect student privacy under the Family Educational Rights and Privacy Act (FERPA), as they consider when and how to disclose personally identifiable information (PII) in the context of COVID-19.
FERPA prohibits educational agencies and institutions from disclosing PII from a student’s education records without the prior written consent of a parent or eligible student, unless an exception to the general consent rule applies. 20 U.S.C. §§ 1232g(b)(1) and (b)(2). The new guidance focuses on the extent to which the “health or safety emergency” exception permits disclosure of PII in connection with COVID-19 emergencies.
The guidance reaffirms the basic rule that education agencies and institutions should address instances of a student being diagnosed/exposed/symptomatic in a manner that does not directly or indirectly identify a particular student; but notes that there may be “rare instances” in which disclosure of PII to a limited set of parents and other students is reasonable. DOE cites the example of an athlete in a contact sport where the risk of transmission was higher than normal than it would be to the general population and therefore disclosure of PII would be allowed to teammates and their parents.
The guidance reaffirms that such disclosure should only be made to “appropriate parties” whose knowledge is necessary to protect the health and safety of the student and other individuals. This typically will include parties who provide specific medical or safety attention, such as health and law enforcement officials or a student’s parents.
DOE also clarified that disclosure to public health authorities is permitted when the institution determines that there is a significant and articulable threat to the student or other individuals.
The DOE further states that the health or safety emergency exception is a “flexible standard under which the Department will not substitute its judgment for that of the educational agency or institution,” so long as there is a rational basis for the educational entity’s action. As a reminder, if PII is disclosed, the educational entity must record the disclosure in the student’s education records with:
(i) The articulable and significant threat to the health or safety of a student or other individuals that formed the basis for the disclosure; and
(ii) The parties to whom the agency or institution disclosed the information.
34 C.F.R. § 99.32(a)(5).
If institutions are going to disclose PII, the safest practice is to seek parent or eligible student consent and document the granting of the consent. If consent is not given or if the institution believes that disclosure absent consent is warranted, then it should document the safety and health concerns which justify one of the above exceptions in order to maximize application of the “flexible” standard.
Additional COVID-19 information and resources provided by the DOE can be found here.
