Last week, the U.S. Department of Education (DOE) issued guidance, by way of frequently asked questions, about what circumstances are permissible for covered schools to disclose the personally identifiable information (PII) of students, under the Family Educational Rights and Privacy Act (FERPA), in the context of COVID-19.
Generally, FERPA follows the requirement of a parent’s or student’s written consent prior to the disclosure of PII from a student’s education records in the absence of circumstances giving rise to an applicable exception. The DOE’s guidance focuses on the extent to which the COVID-19 pandemic qualifies as a “health or safety emergency” exception that would allow disclosure in the absence of consent.
The guidance starts with FERPA’s default principle that education agencies and institutions should not directly or indirectly identify a particular student during instances when a student is diagnosed, exposed, or symptomatic. However, the guidance also recognizes that the health and safety emergency exception allows such disclosure of PII to a limited set of parents and other students when it is reasonable under a narrow set of facts conditions. For example, the DOE clarified that disclosure of PII to public health authorities is permitted under the exception when the school reasonably determines there is a significant and articulable threat to the student or other individuals.
Whether or not a disclosure under the health or safety exception is reasonable, however, will largely be left to the school, according to the DOE. The guidance describes that the standard for application of the exception is a “flexible standard,” and that the DOE will not substitute its judgment for that of the covered school, so long as there is an underlying rational basis for the school’s disclosure of a student’s PII. For example, the DOE cites a hypothetical case in which the health or safety emergency exception would allow the disclosure of the identity of an athlete, who is on a school-sponsored athletic team, to teammates and their parents because the risk of transmission is higher than it would normally be to the general population.
Yet, the same situation would not justify disclosure of the athlete’s PII to other or broader groups, such as a campus newspaper or classmates in all of the athlete’s on-campus classes. This is due to FERPA’s general principle requiring that disclosure be made only to “appropriate parties” who need to know the student’s PII, to protect the health and safety of the student and other individuals, such as health and law enforcement officials or a student’s parents.
If the health or safety emergency exception provides the underlying rational basis for the school’s disclosure of a student’s PII, then the guidance reinforces FERPA’s requirement that the disclosure must be recorded in the student’s education records and include a description of the articulable and significant threat to the health or safety of a student or other individuals and the parties to whom the school made the disclosure.
If your institution feels it is reasonably necessary to disclose a student’s PII, we advise the best practice of seeking written parental or eligible student consent and documenting that consent was given. If consent is not given, or if you believe that disclosure absent consent is warranted, then you should document the safety and health concerns or threats which justify the exception in order to maximize application of the “flexible” standard. For specific concerns or questions, please feel free to reach out to any of the authors of this alert or your Michael Best Attorney.