COVID-19 Update: Public and Student Records Requests During a Pandemic
Your school district may be getting public records requests, and/or requests for health information concerning students, and you may have questions about how your school district may share information with parents, with public health authorities, and the media.
The Student Privacy Policy Office of U.S. Department of Education has recently (March 2020) issued guidance in the form of a Frequently Asked Questions (FAQ) that provides some answers about student records disclosures during the pandemic.
Let’s break it down in understandable bytes. The federal law on the confidentiality of student records is the Family Educational Rights and Privacy Act (FERPA) and Ohio’s student confidentiality law is found at Ohio Revised Code 3319.321. The issues that may come up during this pandemic are what records may be shared, with whom, when you may have students, staff, and their family members who may be affected by the COVID-19 virus.
FERPA generally protects the confidentiality of personally identifiable student information. That means schools must not release personally identifiable information about students without the consent of the parents of students under 18 years of age, and of students themselves who are over 18 and a legal adult. Directory information may be released if the student/parent has not opted out of such disclosures.
There are exceptions to FERPA. One of these is the “health and safety emergency” exception, which allows certain disclosures of personally identifiable information under certain circumstances to certain individuals or entities that are relevant during this pandemic.
If a school district determines there is a health and safety emergency; that is, an emergency in which it is necessary to protect the health or safety of students or other individuals, that requires the release of personally identifiable student information without consent, it may make disclosures of the personally-identifiable information of those students to address the emergency on a case-specific basis. The district must evaluate the need for such disclosures and to whom such disclosures should be made.
There are some important considerations in the guidance. The first thing to remember is that the health and safety exception to FERPA is a limited exception and when using it, schools need to decide whether a release of normally-confidential information is warranted on a case-by-case basis.
Another way of saying this is that if there is a health and safety emergency (which the school district may determine in its reasonable discretion), FERPA allows disclosures to persons or entities that need that information for the purpose of protecting health and safety of a student or another individual. It is not, however, a blanket release of information to all entities or persons equally. The guidance also states that these disclosures are “…limited in time to the period of the emergency and generally does not allow for a blanket release of PII from student education records.”
To whom may we disclose information during a health and safety emergency?
There are some different ways this may come up. The first and probably easiest issue is the public health authority asking the school district for disclosures of personally identifiable information of students to track exposure and possibly for the purpose of notifying people who need to self-quarantine or who may have been exposed.
May the District disclose personally-identifiable information if the health department asks for it?
The guidance says generally, yes. The guidance states “Public health officials may be considered ‘appropriate parties’ by an educational agency or institution under FERPA’s health or safety emergency exception, even in the absence of a formally declared health emergency. Typically, public health officials and trained medical personnel are among the types of appropriate parties to whom PII from education records, may be non-consensually disclosed under FERPA’s health or safety emergency exception.”
May the District release contact information for students and their parents to the public health department if asked by the health department to do so?
Yes, if that information is needed and the district has made a determination that there is a health and safety emergency that requires such disclosure.
What about the media requesting lists of how many students are affected by the illness or the numbers of absences the district may have been seeing prior to schools being closed?
The guidance generally says no. Disclosures to the media of personally-identifiable information of students affected by COVID-19 are not appropriate under this limited exception. It describes the media as not generally an “appropriate party” under FERPA’s health and safety exception. “Appropriate parties” are those who provide “…specific medical or safety attention, such as public health or law enforcement officials.” If all identifying information has been removed (and disclosure would not allow a person to determine individual students affected) and the district has such a record, it may be able to comply with some requests for information. Consult counsel if you receive such requests.
If students are affected by COVID-19 and are out sick, may the District disclose information to parents of other students?
The Department answered that some information could be disclosed only if the information was not personally identifiable. Consent would not be needed to disclose information that is not personally identifiable (although the district should make a case-by-case determination that disclosing the information will not allow people to identify the student who is absent due to COVID-19.)
The Department does state in the FAQ that in “rare situations during a health and safety emergency” that disclosure of the identifiable information about a specific student may be warranted. The FAQ uses an example of a wrestler who had close contact with other students, school officials might determine it was necessary to disclose the student’s identity to the parents of other students. This determination of whether the disclosure is “absolutely necessary” is made on a case-by-case basis dependent upon the situation.
The Department suggests making consent forms available to parents that specifically allow such disclosures to obtain consent to release personally-identifiable information in these circumstances. In a health and safety emergency as determined by the District, the exception would allow non-consensual disclosures of personally identifiable information. During these times, obtaining such consent may not be a priority crisis response. These consent forms could be implemented as part of emergency planning in the future, however. A sample form is available with the guidance should districts choose to attempt to obtain consent from parents.
If a school employee has the illness, could the district notify parents and students or the media?
The Department notes that FERPA applies only to student records. Other state privacy laws may impact this issue, however, so a release of a school official or employee’s name to the public or the media should be made only in consultation with board counsel. Please note that the health department is not releasing personal information about people affected in its reports, only their general geographic area and sometimes their age.
However, disclosures of the identity of school employees affected to the health department would generally be authorized so that the health department may track contacts and notify those who may need to self-quarantine or be tested. The district itself also may communicate with parents and students about possible exposure to an individual affected by COVID-19, but should protect the privacy of the individual’s identity to the extent possible.
Does the District need to document when these disclosures are made and to whom?
Yes. School districts that make such disclosures of personally identifiable information are required to make and maintain records of the disclosures that are made and the reasons for such disclosures. Schools must record the reason for the basis of the disclosure (i.e., “the articulable and significant threat to the health or safety of a student or other individual that formed the basis for the disclosure and the parties to whom the agency or institution disclosed the information”) and to whom the disclosures were made in the student’s record, for each student for whom information was disclosed.
These disclosures must be retained in the education record as long as the records are maintained. Parents and eligible students (over 18) may view the educational records so they would see if such disclosures were documented.
Public records requests will need to be handled generally in the same way as would be ordinary for your office. You will still need to respond to records requests within a reasonable time, but what is reasonable under these circumstances may vary based on the ability of the district to have adequate staff available during this crisis to respond. Please call to discuss these issues with our office. All of our attorneys are well-versed in public records law.