On September 29, 2020, the United States Department of Education released additional guidance, in the form of a question and answer sheet, regarding the responsibilities of school districts in maintaining student privacy when releasing information related to cases of COVID-19. Specifically, the Department responded to four of the most common questions posed by schools regarding their reporting obligations and their duties under the Family Educational Rights and Privacy Act (FERPA). Those questions and answers are summarized as follows.
- May a school disclose the number of students who have COVID-19 to parents and students in the school community without prior written consent?
The disclosure of student information in a non-identifiable form does not require prior written consent from a student or the student’s parent under FERPA. A school district may safely disclose the number of students diagnosed with positive cases of COVID-19, so long as the school does so in a way that does not allow for any individual student to be identified. For example, a school district which reports that a certain number of students tested positive must ensure that a sufficient number of students are absent for non COVID-19 related reasons so that the students testing positive cannot be easily identified due to their (presumed) absences. School districts must weigh the benefits of releasing information related to positive tests and ensure that, in doing so, they do not provide enough information to allow anyone identify the afflicted students.
- May a school identify a particular student who has COVID-19 to parents and students in the school community without prior written consent?
A school district may only do this in the event that disclosure of the student’s identity is absolutely necessary to protect the health of another student or students. The example used by the Department of Education is where a student-athlete testing positive for COVID-19 was in close contact with other students who had higher health risks and disclosing the identity of the infected student was necessary for the others to take protective measures. In these limited circumstances, it may be appropriate for the school district to disclose identifiable student information. School districts are cautioned that this step should only be taken in consultation with health officials and after discussion with legal counsel.
- May a school disclose the number of students who have COVID-19 in order to provide general health data to the public (including the media) without prior written consent?
Yes, similar to the advice offered in the response to Question Number 1 above, the school district may release this information to the public so long as doing so does not allow anyone to ascertain which students were infected. As stated in the new guidance, similar to sharing information with the school community, if a school discloses information about students in a non-identifiable form, then consent is not needed under FERPA.
- May a school identify a particular teacher or other school official as having COVID-19?
Although FERPA would not apply in this situation, as this question deals with the release of non-student information, school districts are cautioned against disclosing health-related information which could result in the personal identification of a teacher or other school employee. Privacy laws such as HIPAA would still apply in this case, and it is inadvisable to release such specific information prior to consulting with both public health officials and legal counsel.
School districts are encouraged to work closely with outside entities such as a local or state health department when determining how and when to release information. In addition, our public sector team can provide further guidance to school districts to ensure that they are disseminating information appropriately and without violating any applicable privacy laws.
