Beware the Overshare: What Student Information Can Schools Release in the COVID-19 Era?
The FAQ is an update to guidance ED issued in 2009 in the face of the H1N1 outbreak. Consistent with our firm’s previous guidance, the FAQ generally advises schools of the following:
- Educational institutions should be cautious about disclosing a student’s personally identifiable information without parental consent or consent of an eligible student unless a clear exemption to the general consent requirement applies. Although there is an exception for health and safety emergencies, it only applies if personally identifiable information is disclosed to an appropriate party whose knowledge of the information is necessary to protect the health or safety of the student or other individuals.
- Even where a health or safety emergency exists, there are limits on the type of information that can be shared with public health officials without parental consent.
- Disclosure to a student’s parents is always possible if the student is under the age of 18; for students 18 and over, disclosure may still be warranted based on the student’s dependent status.
- “Appropriate parties” include public health officials whose knowledge of the information is necessary to protect individuals’ health or safety.
- For notices to the school community regarding a student who has tested positive for COVID-19 it is, in most instances, sufficient to provide a general notice of the fact that an individual has tested positive without specifically identifying the student who is infected.
- Rare situations may arise during a health or safety emergency justifying a school’s determination, in conjunction with health officials, that disclosure of a student’s identifiable information to certain parents of other students may be absolutely necessary, but such determinations must be made on a case-by-case basis taking into account the totality of the circumstances. ED provides as an example a student with COVID-19 who is a wrestler and has been in direct and close contact with other students who are on the team or who are in the school and have higher health risks. ED states that school officials in such a case may decide it is necessary to disclose the identity of the diagnosed student to the parents of the other students.
Illinois school districts should keep in mind that when sharing any student record information under the health and emergency exception, the Illinois School Student Records Act requires parent notification of such disclosure no later than the next school day after the date that the information is released. FERPA also generally requires records to be maintained when requests for access are made and granted. Schools should continue to work with legal counsel when addressing specific issues of student (and employee) privacy and COVID-19 related issues, along with following current health department recommendations. For more information, contact the authors of this alert or any other Franczek attorney