Policy & Public Health
Student Privacy in a Time of Pandemic
- By Dian Schaffhauser
should a school respond if it receives a voluntary request from a
local, state or federal agency for student records to assist in
responding to a COVID-19 outbreak in the area? Should a principal be
prepared to share student health records if the local public health
agency makes contact? And what can be shared with the school
community if a child shows symptoms of the virus?
are a few of the questions addressed in a new report quickly produced
by the Future
of Privacy Forum
(FPF) and AASA,
the School Superintendents Association,
to answer questions related to FERPA and HIPAA in a time of
the first question, about that voluntary request, the school could
provide anonymized information, such as an aggregated percentage of
symptomatic students who visited the school's nurse, as long as
individuals couldn't be identified. For the second question, the
answer is a trickier, because some states have mandatory reporting
laws regarding communicable diseases. And for that third question,
information can be shared, again, as long as the individual affected
can't be identified directly or indirectly; and even then,
notification might be delayed long enough for the student to be
tested or for his or her doctor to "rule out the flu.")
paper provides dos and don'ts to help readers understand how to
respond. It also addresses the health
or safety emergency exception
under the Family Educational Rights and Privacy Act (FERPA), which
allows schools to share students' personally identifiable information
(PII) with the community and relevant officials during the current
emergency. That provision allows for disclosure without prior consent
when it's needed to protect the health or safety of the student or
specific questions covered in the report are these:
a student has COVID-19, what information from education records can
the school share with the community?
the school suspects that a student has COVID-19, what information
can the school share with its community?
a school suspects that a student may have COVID-19, can school
officials contact the student's primary care physician?
a student has COVID-19 and the school's health records are covered
by HIPAA rather than FERPA, what information may the school disclose
to its community?
if the school receives a voluntary request from a local, state or
federal agency for student records to assist the agency in
responding to the COVID-19 outbreak?
should a school do if it receives a request under a mandatory
reporting law to share student health records with a public health
interagency agreements with other state or local agencies allow
schools to disclose education records without obtaining consent?
no question that schools and institutions are struggling to manage
this unprecedented situation and need as much support and information
as possible to do their jobs," said Amelia Vance, FPF's senior
counsel and director of Youth and Education Privacy, in a statement.
"The Future of Privacy Forum is tracking the situation closely
in an effort to anticipate and help address the challenges that
schools may encounter as they work to navigate the COVID-19 pandemic,
and we expect to release additional resources in the days ahead."
paper is available as a PDF on
the FPF's FERPA Sherpa website.
The content is also available in HTML on
the same site.
Dian Schaffhauser is a former senior contributing editor for 1105 Media's education publications THE Journal, Campus Technology and Spaces4Learning.