New Guidance on Privacy for Student Education and Health Records

The U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services recently released updated guidance regarding the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act (HIPAA) to a student’s education and health records. 

FERPA generally prohibits educational agencies receiving federal funds from disclosing a student’s education records without the prior written consent of the parent or eligible student. On the other hand, HIPAA requires covered entities (health plans, health care clearinghouses, and health care providers) to protect an individual’s health records and other personal health information these entities maintain or transmit. 

Are Public Schools Subject to HIPAA’s Privacy Requirements?

In a few very limited instances, an educational institution subject to FERPA may also be subject to the HIPAA privacy requirements. A school may be considered a “health care provider” if it provides health care to students in the normal course of business and the transactions are those for which the U.S. Department of Health and Human Services has adopted a standard form. Even though a school may employ nurses, physicians, or psychologists, schools generally do not bill health care plans for their services. Thus, most schools are not entities covered by HIPAA. Even if a school that is considered to be an entity covered by HIPAA (e.g., when a school hires a health care provider that bills Medicaid for services provided under the IDEA), it will not have to abide by the privacy requirements if the school maintains health information only in “educational records” under FERPA. This is due to HIPAA’s Privacy Rule explicitly excluding FERPA “educational records” from the scope of the act. 45 CFR § 160.103.

Frequently Asked Questions

This new guidance includes a list of new frequently asked questions along with answers to when a student’s health information can be shared without the consent of the parent or eligible student under FERPA and HIPAA. We will discuss some of these new clarifications below.

  1. When can personal health information or personally identifiable information be shared about a student who presents a danger to themselves or to others?

FERPA allows educational institutions to disclose personally identifiable information to certain appropriate parties if knowledge of this information would be necessary to protect the health or safety of a student or others. This disclosure may take place with or without the consent of the student. 20 U.S.C. § 1232 g(b)(1)(I); 34 CFR §§ 99.31(a)(10) and 99.36. In order to use this exception, the educational institution must look to the totality of the circumstances and determine that there is an articulable and significant threat to the health or safety of the student or others. 34 CFR § 99.36(c). An articulable and significant threat means that if the educational institution can reasonably explain why it believes a student poses a significant threat, such as bodily harm to himself or others, the school may disclose educational records to any person who would be able to assist in protecting a person from that threat. If the educational institution is able to show that it had a rational basis for disclosing the information, the U.S. Department of Education will not substitute its judgment for that of the educational institution making its decision. 34 CFR § 99.36(c). The ability to share this information expires once the danger is no longer present.

The Joint Guidance provided the following example: A student states that he knows where his parents keeps his guns and that he is going to come back and make sure that someone pays for what they have done. What is the district supposed to do? According to the U.S. Department of Education, FERPA permits the district to warn the appropriate parties that the student has made this statement and may be a threat to harm themselves or others. The district may inform the student’s parents, the police, or other parties that would be in a position to help protect the health and safety of the student or others.

  1. Under FERPA, can an educational institution disclose, without prior written consent, personally identifiable information from a student’s educational or health records to their law enforcement officials?

The short answer is yes, so long as certain conditions are met. If the person is an employee of the educational institution,  meets the school’s definition of a “school official” based on the school’s annual FERPA notice, and has a legitimate educational interest in the information/records then the law enforcement official may be considered a school official to whom a student’s personally identifiable information may be disclosed without prior written consent. 20 U.S.C. § 1232g(b)(1)(A); 34 CFR §§ 99.7(a)(3)(iii) and 99.31(a)(1)(i)(A). 

What about School Resource Officers and other law enforcement officials who are not employees of the educational institution? School resource officers are not employees of the educational institution but may be considered a “school official” if they:

  1. Perform an institutional service or function for which the school would otherwise use employees (e.g., ensure school safety or security);
  2. Are under “direct control” of the educational institution with respect to the maintenance of the educational records. (e.g., done through a memorandum of understanding (MOU) to establish restrictions and protections);
  3. Are subject to FERPA’s use and re-disclosure requirements in 34 CFR § 99.33, which provides that the personally identifiable information may only be used for the purpose for which the disclosure was made (e.g., school safety and security) and limits re-disclosure of the student’s educational records;
  4. The SRO meets the school’s definition of a “school official” provided in its annual notification of FERPA rights and has a “legitimate educational interest” in the records.

If the school resource officer or other law enforcement official is not a “school official” acting with a “legitimate educational interest” then the school may not disclose a student’s educational and health records without the prior written consent of the parent unless an exception applies. (i.e. health or safety emergency explained above.)

Board Meeting Minutes – Specificity Needed

The Eleventh District Court of Appeals was recently faced with the issue of whether Ohio’s Open Meetings Act requires the meeting minutes of a public body to be accurate enough to show the specific reasons a Board has entered into executive session.

In State of Ohio ex rel. Ames v. Brimfield Township Board of Trustees, Ohio App. 11th Dist., No. 2019-P-0017, 2019-Ohio-4926, Ames alleged that the board wrongfully entered into executive session for matters not contained in the exceptions listed in R.C. 121.22(G). The basis of Ames claim was that the Board’s meeting minutes failed to state the specific purpose for which they entered into executive session. The Board argued that they were only required to make a specific reference to the reason for entering into executive session in the motion and the vote held during the open meeting, but were not required to provide a description of the applicable exception in their meeting minutes.

The Open Meetings Act requires all public officials to take official action and conduct all deliberations in open meetings unless excepted by law. R.C. 121.22(A). These exceptions are listed in R.C. 121.22(G), which allows a Board to enter into executive session in order to consider any of the matters listed in R.C. 121.22(G)(1)-(8). In this instant case, the Board claimed they entered into executive session in accordance with R.C. 121.22(G)(1) in order to consider the appointment, employment, dismissal, discipline, demotion, promotion… of a public employee. Furthermore, if a board enters into executive session pursuant to R.C. 121.22(G)(1), the motion and vote to do so must state the purpose for doing so. In this case, a member of the Board testified that at each of the meetings referenced in the complaint, the Trustee making the motion to move into executive session referenced the relevant exception stated in R.C. 121.22(G)(1). Thus, the Board believed that they were in compliance with the Open Meetings Act.

However, not only does the motion and vote to enter into executive session need to state the purpose for doing so, Ohio law requires the Board’s meeting minutes to reflect the “general subject matter” of discussions in executive session. R.C. 121.22(C). Thus, the court in this case was required to determine whether the meeting minutes must reflect the specific reason a Board entered into executive session, or whether the action taken properly in the meeting was enough to prove legality. The court determined that the meeting minutes must reflect the specific reason for entering into executive session. In doing so, they concluded that when a Board enters executive session, not only must the motion and the vote to enter into executive session need to state the purpose for doing so, the Board’s minutes must specifically reference each of the purposes for which the executive session was held. Therefore, if the Board enters into executive session pursuant to one of the exceptions listed in R.C. 121.22(G), the minutes should reflect one or more of the eight purposes listed therein, but need not provide any further specificity.

This case serves as a great reminder for school boards of education, and school treasurers, to ensure that the reason(s) for entering executive session are explicitly stated upon the motion and vote to enter into executive session, and for such reasons to be included with the same specificity in the meeting minutes.  The failure to include the permissible reasons for entering into executive session within meeting minutes, even if appropriately motioned and voted on in a meeting, could result in technical violations of the Open Meetings Act, which may result in unfavorable court decisions and awards of attorneys fees.

Facebook and First Amendment Rights

Like students, teachers do not shed their constitutional right to free speech while at school. However, their rights are not without limits as the Sixth Circuit demonstrated recently when it issued a ruling upholding termination of a teacher. In Sensabaugh v. Halliburton, the District’s head football coach posted concerns on Facebook about the conditions he found when visiting an elementary school (a visit unrelated to his job). One of these posts included photos of a classroom and one included the faces of several students. District officials tried to contact Sensabaugh in an effort to explain their concern that this post could violate school policy as well as FERPA. However, they were unable to get in contact with him.

Meanwhile, Sensabaugh posted a separate entry on Facebook discussing his concerns with prisoners working at the high school. Again, school administration reached out to Sensabaugh to discuss their concerns over the posts. During their conversation, the administration informed Sensabaugh that he did not need to delete the post, but instead asked him to remove only the picture of the students accompanying the post. Sensabaugh yelled at members of the administration and informed them that he would not take the post down.

Following the conversation, administration drafted a “Letter of Guidance” which addressed Sensabaugh’s failure to remove the photos from Facebook, his conduct during the phone call, and other previous misconduct. This letter stated that the administration was not requiring Sensabaugh to remove his comments from his posts but directed him to remove the picture displaying the minor students. The letter clearly stated that failure to follow its directives could lead to discipline up to and including termination. Finally, Sensabaugh agreed to remove the photos from Facebook.      

Following the Letter of Guidance, Sensabaugh’s behavior and actions continued to cause problems in the District. This led the administration to issue a Letter of Reprimand which placed Sensabaugh on administrative leave pending investigation. It was alleged that Sensabaugh accused the Athletic Director of coming to work under the influence of prescription pills, as well as threatening a football player and athletic trainer. The administration hired an independent law firm to investigate the alleged misconduct.

The investigator’s report concluded that Sensabaugh had engaged in unprofessional, insubordinate, threatening, and retaliatory behavior towards supervisors, students, and staff. It concluded that Sensabaugh’s actions had intimidated and undermined his coworkers and supervisors. The investigators went on to conclude that Sensabaugh’s repeated, belligerent, and confrontational speech to coworkers made it inconceivable for them to maintain an ongoing employment relationship. As a result, the investigator recommended that Sensabaugh’s employment with the district be terminated.

Administration notified Sensabaugh that the independent investigator had submitted their findings and recommended his termination. Sensabaugh was offered the opportunity to provide any statement or evidence in support of a less severe punishment. However, Sensabaugh never responded. The District then terminated Sensabaugh’s employment.

Sensabaugh sued, arguing that the District retaliated against him for exercising his First Amendment right to free speech. In order for a teacher to prevail on a First Amendment retaliation claim, he must show that: 1) he engaged in protected conduct; 2) an adverse action was taken against him that would deter a person of ordinary firmness from continuing to engage in that conduct; and 3) that the adverse action was motivated at least in part by the protected conduct. Bell v. Johnson, 308 F.3d 594, 602 (6th Cir. 2002).

The Sixth Circuit Court of Appeals first determined that the Letter of Guidance was not an adverse action. The letter did not impose any discipline, but instead simply imposed directives that Sensabaugh needed to follow in order to avoid discipline. Likewise, the Court also found that the Letter of Reprimand was not an adverse action. Though the letter resulted in paid administrative leave, this still did not result in an adverse action. Ehrlich v. Kovack, 710 F.App’x 646, 650 (6th Cir. 2017).

There is no dispute that the termination was an adverse action. However, Sensabaugh must show that the Facebook posts were a substantial or motivating factor in the adverse employment action. Though the Letter of Guidance, Letter of Reprimand, and termination came within six months after the Facebook posts, temporal proximity alone is rarely, if ever, sufficient to establish the causation requirement. Here, there was no other indication to demonstrate that Sensabaugh was terminated because of his Facebook posts. The court noted that at no time leading up to the termination did the administration ask or require Sensabaugh to remove the Facebook posts. Instead, the letters acknowledged Sensabaugh’s right to comment on public concerns. He was asked to remove the content from his posts that violated FERPA. Additionally, the independent investigation substantiated other allegations of misconduct that supported termination.

Ultimately, the court determined that when deciding to end Sensabaugh’s employment, the District relied on several instances of misconduct which were unrebutted by Sensabaugh. There was no indication that the viewpoints expressed in his Facebook posts (other than the FERPA-protected images of students) played any part in the District’s decision to terminate. Therefore, the District did not violate his constitutional rights.

Sensabaugh v. Halliburton, 937 F.3d 621 (6th Cir.2019)

Records of Deceased Student and Mass Shooter Case Decided

Recently, in State ex. rel CNN, Inc. v. Bellbrook-Sugarcreek Local School Dist., 2019-Ohio-4187, the Second Appellate District ruled that the death of a student does not remove the legal protections of the confidentiality of student records.

In August 2019, an adult gunman killed nine people and injured twenty-seven others in a mass shooting in Dayton. Following the incident, several media outlets requested public records of the gunman’s educational records, including disciplinary records, from the School District from which he graduated.

The district released directory information concerning the student but declined to release any other records. The media outlets sued, filing a mandamus action seeking the release of the records. Ohio Revised Code (R.C.) Section 149.43 requires a public agency to release public records upon request, unless an exception applies. That section provides that records are not “public records” subject to release if a state or federal law prohibits the release of them.
The district argued that the Ohio Student Privacy Act limits access to records concerning students, specifically, that “[n]o person shall release, or permit access to personally identifiable information other than directory information concerning any student attending a public school … without the written consent of each such student who is eighteen years of age or older.”

The court concluded that, based on the plain language of R.C. 149.43, the district is barred from releasing the records requested, rejecting the news media’s argument that the district was compelled to release the requested records because the former student’s right to privacy expired with his death. The case has been appealed to the Ohio Supreme Court.

Attorney General Dave Yost filed a brief to the Supreme Court of Ohio. His brief is in support of the media outlets that are suing in order to have rights to view the student’s records. Yost argued that neither Family Educational Rights and Privacy Act nor Ohio Student Privacy Acts protects the records of students who die after becoming an adult. A local TV station and other news organizations filed briefs amicus curiae in support of CNN.

Yost’s brief states that the attorney general’s office has a duty to “ensure transparency in all levels of government.” One of the duties involved is to provide training and guidance on Ohio’s Sunshine Laws. This duty, the brief reads, is being directly impacted because the Public Records Act is being violated in not allowing access to the student records