Student Privacy in a Time of Pandemic

• By Dian Schaffhauser
• 03/25/20

How should a school respond if it receives a voluntary request from a local, state or federal agency for student records to assist in responding to a COVID-19 outbreak in the area? Should a principal be prepared to share student health records if the local public health agency makes contact? And what can be shared with the school community if a child shows symptoms of the virus?

Those are a few of the questions addressed in a new report quickly produced by the Future of Privacy Forum (FPF) and AASA, the School Superintendents Association, to answer questions related to FERPA and HIPAA in a time of coronavirus.

(For the first question, about that voluntary request, the school could provide anonymized information, such as an aggregated percentage of symptomatic students who visited the school's nurse, as long as individuals couldn't be identified. For the second question, the answer is a trickier, because some states have mandatory reporting laws regarding communicable diseases. And for that third question, information can be shared, again, as long as the individual affected can't be identified directly or indirectly; and even then, notification might be delayed long enough for the student to be tested or for his or her doctor to "rule out the flu.")

The paper provides dos and don'ts to help readers understand how to respond. It also addresses the health or safety emergency exception under the Family Educational Rights and Privacy Act (FERPA), which allows schools to share students' personally identifiable information (PII) with the community and relevant officials during the current emergency. That provision allows for disclosure without prior consent when it's needed to protect the health or safety of the student or others.

The specific questions covered in the report are these:

• If a student has COVID-19, what information from education records can the school share with the community?

• If the school suspects that a student has COVID-19, what information can the school share with its community?

• If a school suspects that a student may have COVID-19, can school officials contact the student's primary care physician?

• If a student has COVID-19 and the school's health records are covered by HIPAA rather than FERPA, what information may the school disclose to its community?

• What if the school receives a voluntary request from a local, state or federal agency for student records to assist the agency in responding to the COVID-19 outbreak?

• What should a school do if it receives a request under a mandatory reporting law to share student health records with a public health agency?

• Do interagency agreements with other state or local agencies allow schools to disclose education records without obtaining consent?

"There's no question that schools and institutions are struggling to manage this unprecedented situation and need as much support and information as possible to do their jobs," said Amelia Vance, FPF's senior counsel and director of Youth and Education Privacy, in a statement. "The Future of Privacy Forum is tracking the situation closely in an effort to anticipate and help address the challenges that schools may encounter as they work to navigate the COVID-19 pandemic, and we expect to release additional resources in the days ahead."

The paper is available as a PDF on the FPF's FERPA Sherpa website. The content is also available in HTML on the same site.