As background, FERPA protects the confidentiality of personally identifiable information (“PII”) in education records and its rules and regulations apply to all educational institutions in receipt of federal funding, which includes local school districts, colleges, universities and some private schools. In general, FERPA prohibits a covered entity from sharing personally identifiable information in education records with a third party without the written consent of a parent or eligible student. Education records are defined broadly to include any information that is (1) directly related to the student and (2) maintained by the covered entity. Further, PII is defined to include, among other things, a student’s name; address; parents’ names; “[o]ther information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty;” and “[i]nformation requested by a person who the [school] reasonably believes knows the identity of the student to whom the education record relates.”
Importantly, FERPA includes a variety of exceptions to the consent requirement, and the DOE’s FAQ highlights the health and safety emergency exception, which may be critical to sharing necessary information in emergency situations, including the current health crisis. As the DOE explains, FERPA’s health and safety emergency exception allows schools to disclose PII, without prior consent, to third parties who need to know the information in order to address a health or safety emergency; these individuals typically include emergency personnel, public health officials, and possibly parents. To qualify for this exception, the school must determine that there is an “articulable and significant threat” requiring the release of PII. The DOE will generally defer to the school’s determination as to the nature of the emergency and will not substitute its own judgment for that of the school, as long as there is a rational basis for the school’s determination. The information that can be disclosed under this exception is limited to information necessary to address the emergency; the exception applies only during the period of the emergency; and the school must document in the student’s record the nature of the health and safety emergency and the parties to whom the information was provided.
According to the DOE, “[i]f local public health authorities determine that a public health emergency, such as COVID-19, is a significant threat to students or other individuals in the community, an educational agency or institution in that community may determine that an emergency exists as well.” As such, the health and safety emergency exception under FERPA may be an important tool for schools in addressing this significant health crisis. Schools must be aware, however, that the release of PII is not always necessary in order to prepare for and address this emergency and that, even when information may be released pursuant to this or any other exception under FERPA, the release of information must be restricted to individuals permitted to receive the PII.
We urge schools to review this recent guidance from the DOE to ensure that all personnel continue to comply with the requirements of FERPA and understand the permissions allotted to address this unprecedented health emergency.
If you have questions about this FAQ or other student confidentiality issues, please contact Gwen J. Zittoun at firstname.lastname@example.org. Schools may also reference our previous posts titled “Preparing for School Closures: Key Takeaways from New State Guidance and Special Education Considerations,” and “Prevention and Response: Preparing for Coronavirus in Connecticut Schools.” We will continue to post important legal information about COVID-19 and schools as it becomes available.