By: Kevin Herms, Director of the Student Privacy Policy Office
Do federal privacy laws allow schools to disclose information about cases of COVID-19? The Student Privacy Policy Office at the U.S. Department of Education provided guidance on that subject in March 2020. Today, we are reminding schools of this guidance and answering four of the most common questions that schools may face regarding privacy and the COVID-19 pandemic.
Schools across the nation are working hard to keep students, teachers, and staff safe during the COVID-19 pandemic. However, many schools are wondering whether the Family Educational Rights and Privacy Act (FERPA) allows them to disclose information about cases of COVID-19 to the community. The Student Privacy Policy Office provided answers to these questions in our March 2020 guidance. Subsequent to issuing the guidance, we have seen reports that states, cities, school districts, and schools are continuing to face questions about disclosing COVID-19 cases. Today, we are answering four of the most common questions.
May a school disclose the number of students who have COVID-19 to parents and students in the school community without prior written consent?
Yes, provided that the information the school shares with parents and students does not allow for any individual student to be identified. If a school discloses information about students in a non-identifiable form, then prior written consent from the parent or student (depending on the age of the student) is not needed under FERPA. When determining what information may be shared without consent, the school must take into account other reasonably available information that could potentially enable non-identifiable information to become identifiable.
For example, a school generally could release the fact that five students are absent due to COVID-19 without disclosing the students’ identities. This would be allowed under FERPA as long as there are a sufficient number of other students who attend the school and other students at the school are absent for other reasons. However, we caution schools to ensure that in releasing such facts, they do so in a way that does not reveal information that, alone or in combination with other information, would allow a person in the school community to identify the students who are absent due to COVID-19.
May a school identify a particular student who has COVID-19 to parents and students in the school community without prior written consent?
In most cases, it will be sufficient for a school to report the fact that an individual in the school has COVID-19, rather than identifying the specific student who is infected. However, there may be situations during a health or safety emergency in which a school may determine that it is appropriate to disclose identifiable information to parents or students about a student with COVID-19 if knowledge of such information is necessary to protect their health. For example, if a student with COVID-19 is an athlete and has been in close contact with other students on a sports team or students who have higher health risks, school officials may determine that these other students or their parents need to know the identity of the infected student in order to take protective measures.
Therefore, in these limited situations, school officials may determine that it is appropriate to disclose such information to parents or students if the disclosure is necessary to allow parents and students to take appropriate precautions. School officials should make this determination on a case-by-case basis, taking into account the totality of the circumstances, including the risks presented to the health of students or other individuals, and the need for such individuals to have the information in order to take appropriate actions. Schools officials may want to consult with public health officials when making this determination.
May a school disclose the number of students who have COVID-19 in order to provide general health data to the public (including the media) without prior written consent?
Yes, provided that the information the school shares does not allow for any individual student to be identified. Similar to sharing information with the school community, if a school discloses information about students in a non-identifiable form, then consent is not needed under FERPA. As discussed above, when a school determines what information may be shared without prior written consent, the school must take into account other reasonably available information that might allow non-identifiable information to become identifiable.
May a school identify a particular teacher or other school official as having COVID-19?
Nothing in FERPA prevents a school from telling parents, students, or the public that a specific teacher or other school official has COVID-19. This is because FERPA applies to students’ education records, not records on school officials. However, there may be state laws or other considerations that apply in these situations. Schools may also want to consult with public health officials on these matters.
Schools have a significant role to play in slowing the spread of COVID-19 in the United States. Through appropriate information sharing and coordination with public health departments, schools can help protect their communities while safeguarding student privacy.
Kevin Herms is the Chief Privacy Officer, the Senior Agency Official for Privacy, and the Director of the Student Privacy Policy Office at the U.S. Department of Education.