Dear Legal Mailbag:

So far, so good, knock on wood. But I anticipate that sooner or later some staff member or student in my school will test positive for COVID. I am wondering what I can or should tell people when that happens.

I suppose some curiosity is justified, given that a positive test may mean that others were exposed and should quarantine. But people are so nosy, and as soon as I disclose the name of employees or students who test positive for COVID, I am concerned that somebody will post their names or otherwise reveal their identifies on social media. Can I just tell people MYOB?

In the Know

Dear Know:

You are right to be concerned about the privacy rights of persons in your school who may test positive for COVID-19. People are indeed nosy, and they may draw certain inferences from a quarantine order. But you should keep information confidential as follows.

As to students, the normal FERPA rules apply. Status of a student as COVID-19 positive is, of course, personally-identifiable student information that you cannot release without an exemption under FERPA, such as consent. There is a special provision in the FERPA regulations that addresses this situation. 34 C.F.R. § 99.31(10) provides that school officials may release personally-identifiable student information in a “health or safety emergency.” 34 C.F.R. § 99.36 elaborates on this provision, stating in relevant part that:

(a) An educational agency or institution may disclose personally identifiable information from an education record to appropriate parties, including parents of an eligible student, in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.

Thus, if school officials learn that a student has tested positive for COVID-19, they may disclose that information to the appropriate public health officials, and in consultation with those officials, the school district can take appropriate remedial measures, such as quarantining of those exposed and additional cleaning measures. While parents and others may try to guess the identity of the student who tested positive, generally the order of quarantine should simply inform the person that he or she was exposed, and not disclose the identity of the student or students who tested positive. Public health officials will provide the appropriate protocol for such situations.

District obligations are similar as to employees who test positive for COVID-19. The Americans with Disabilities Act provides that medical information about employees must be kept confidential. If an employee tests positive for COVID-19 or has symptoms of COVID-19, however, employers must take remedial steps to reduce the likelihood that the virus will be spread. Reconciling these two competing concerns can be challenging.

The Equal Employment Opportunities Commission has provided guidance on this subject: “What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws,” (EEOC, Updated September 8, 2020). This guidance affirms that a COVID-19 diagnosis or information that an employee has symptoms of COVID-19 is medical information that must be maintained as confidential. However, the guidance also states that employers may interview the employee to determine which other persons may have been exposed and then reach out to those employees to inform them of the exposure. Whom to notify should be determined in consultation with public health officials.

The notification must maintain the confidentiality of the medical information to the extent possible. Notifying public health authorities is expressly authorized, and otherwise the identity of the employee with symptoms or a positive COVID-19 diagnosis must be limited to those with an actual need to know, and those persons must be informed that the information is confidential and must not be shared further. Accordingly, school districts must notify employees and other persons when they have been exposed to COVID-19, but only in general terms without revealing the identity of the person with symptoms or a positive COVID-19 diagnosis. The guidance acknowledges that the employees notified may well guess as to the identity of the person with COVID, but employers are still admonished not to confirm that information:

The ADA does not interfere with a designated representative of the employer interviewing the employee to get a list of people with whom the employee possibly had contact through the workplace, so that the employer can then take action to notify those who may have come into contact with the employee, without revealing the employee’s identity. For example, using a generic descriptor, such as telling employees that “someone at this location” or “someone on the fourth floor” has COVID-19, provides notice and does not violate the ADA’s prohibition of disclosure of confidential medical information. For small employers, coworkers might be able to figure out who the employee is, but employers in that situation are still prohibited from confirming or revealing the employee’s identity.

In short, you and your district must do your best to balance these competing concerns to prevent further spread of the virus without specifically identifying the person with COVID. Legal Mailbag is confident that you are up to the task.