U.S. Department of Education issues updated FAQs concerning FERPA and COVID-19

The Student Privacy Policy Office (SPPO) of the U.S. Department of Education has issued updated Frequently Asked Questions concerning the application of FERPA in light of the COVID-19 outbreak. The FAQs may be found here.  

The new FAQs are updated from a similar document that was issued during the H1N1 outbreak in 2009. Under FERPA’s health or safety emergency exception, educational agencies and institutions may “disclose, without prior written consent, PII from student education records to appropriate parties in connection with an emergency, if knowledge of that information is necessary to protect the health or safety of a student or other individuals.” The exception, however, does not permit a blanket release of personally identifiable information (PII), and the release may only be made to appropriate parties. Each release under the exception has to be tailored to the totality of the circumstances.

Some of the important points from the FAQs include:

• Often, educational agencies and institutions can address a health or safety emergency without releasing PII
• If an educational agency or institution determines that a health or safety emergency requires the release of PII, public health officials and trained medical personnel are among the types of appropriate parties to whom PII may be disclosed
• In those cases in which educational agencies or institutions receive requests for PII that go beyond the scope of the health or safety emergency exception, the directory information exception may be available. Keep in mind, however, that the release of directory information that, alone or in combination with other information known by the community, would disclose the identity of the students involved is not permitted. For instance, it is not permitted to release directory information when it is directly linked to non-directory information (“such as information regarding a student’s illness”).
• In those cases in which no exception allows the release of the PII, the educational agency or institution must obtain proper consent before releasing the information. SPPO attached a model consent form to the FAQs.
• “While the media may have a role in alerting the community of an outbreak, they are not ‘appropriate parties’ under FERPA’s health or safety emergency exception because they generally do not have a role in protecting individual students or other individuals at the educational agency or institution.”
• There may be rare situations, determined on a case-by-case basis, in which the health or safety exception may allow the release of PII to parents of other students or to eligible students, if they need to know the information to take appropriate action to protect the health or safety of their children. These determinations should be made in conjunction with health, law enforcement or other such officials. The FAQs provide the example of a wrestler with COVID-19 who was in close contact with other students.
• FERPA generally requires that educational agencies and institutions, absent proper consent, maintain a record of each request for access and each disclosure of PII of each student. “Moreover, when making a disclosure under the health or safety emergency provision in FERPA, educational agencies and institutions are specifically required to record the articulable and significant threat to the health or safety of a student or other individual that formed the basis for the disclosure and the parties to whom the agency or institution disclosed the information.” These records of requests and disclosures must be kept with each student’s education records for as long as the records are maintained.