U.S. Department of Education discusses best practices for maintaining FERPA and virtual learning during COVID-19

On March 30, 2020, the U.S. Department of Education’s Student Privacy Policy Office (SPPO) hosted a webinar to review frequently asked questions on the Family Educational Rights and Privacy Act (FERPA), implications for distance learning due to school closures, and privacy and security best practices. SPPO analyzed ten scenarios that school districts, colleges, universities and their employees are likely to encounter while continuing to operate virtually. Some of the key takeaways from the scenarios discussed are highlighted below.

• Educational institutions may contract with providers of online platforms (service providers) to provide distance learning as long as certain requirements are met. The service providers must meet the requirements of the “school official” exception that (1) they are performing services that would otherwise be performed by the institution; (2) they meet the requirements under the institution’s annual notice to be a “public official” with a legitimate educational interest in education record; (3) the service provider is under the institution’s direct control in the use and maintenance of the education records/personally identifiable information (PII); and (4) the service provider only uses the education records/PII for authorized uses and does not redisclose the records/information without proper consent.
   
• Even if educational institutions are closed, they are required to comply with the 45-day timeline for responding to a parent/eligible student’s request for access to education records. SPPO indicated that if circumstances effectively prevent parents/eligible students from exercising their right to inspect and review education records, the educational institution would be required to either provide a copy of the records requested or make other arrangements that would allow for the parent/eligible student to inspect and view the requested records. SPPO suggests that institutions consider how they are handling other administrative functions and provide electronic access or make a copy of the requested education record and email or mail it to the parent/eligible student.
   
• SPPO also indicated that FERPA does not prohibit non-students from observing virtual lessons, provided that students’ PII from existing education records is not shared during the lesson. To avoid accidental disclosures of such information, however, institutions should discourage non-students from such observations. SPPO also indicated that virtual lessons may be recorded and shared with students who are unable to attend the live virtual class, assuming the video recording does not contain any PII from an educational record or the proper consents are obtained. SPPO suggested that educational institutions should consider whether video recordings of virtual classrooms would be considered an “education record” protected under FERPA. SPPO recommends that education institutions review their vendor agreements for the virtual classroom to see if the video recordings will be maintained as education records. Additionally, school districts should consider reviewing their board policies to determine if video or audio recordings are required to be maintained.

SPPO emphasized that school districts are still required to comply with FERPA as they close or move to virtual instruction. The SPPO’s webinar recording and slides are available for review here.