During the COVID-19 outbreak, school districts must not forget the Federal Educational Rights and Privacy Act (“FERPA”), a federal law which protects the privacy of students’ education records. Generally, FERPA prohibits school districts from disclosing personally identifiable information from students’ education records without the prior written consent of a parent or “eligible student” (over 18), unless an exception applies.
One such exception that may apply during the outbreak is the “health or safety emergency”exception. This exception allows school districts to disclose, without consent, personally identifiable information from students’ education records to “appropriate parties” in connection with an emergency, if knowledge of that information is necessary to protect the health or safety of a student or other individuals. “Appropriate parties” include law enforcement, public health officials, and trained medical personnel. Please note that media is not an appropriate party.
School districts are responsible for determining whether the exception applies by considering the “totality of the circumstances” pertaining to a threat to the health or safety of a student or other individuals. School districts have discretion when determining if the exception applies. In sum, they must have a rational basis for making the determination. The U.S. Department of Education will not substitute its own judgment for that of the school district. Thus, for example, if a school district decides that an articulable and significant threat exists to the health or safety of a student in attendance as a result of COVID-19, the school district may disclose, without consent, personally identifiable information from that student’s education record to appropriate officials at the public health department.
As a reminder, if a school district releases information pursuant to the “health or safety emergency” exception, it must remember to maintain a record of each disclosure. School districts must also record the articulable and significant threat that formed the basis for the disclosure and the parties to whom the disclosure was made.
As a final note, school districts may disclose that student(s) are absent because of COVID-19 but must ensure they do not disclose any personally identifiable information, such as their names. When releasing such information, school districts must do so in a manner that will not, alone or in combination with other factors, allow someone in the community to identify the student(s) who are absent. For additional U.S. Department of Education guidance regarding FERPA & COVID-19, see https://www.ed.gov/coronavirus.