Beware the Overshare: What Student Information Can Schools Release in the COVID-19 Era?

The number of schools, colleges, and universities with students who test positive for coronavirus 2019 (COVID-19) is on the rise. Do you know what information you can—and cannot—share with members of your community and public health officials if a COVID-19 case appears on your campus? A March 2020 Frequently Asked Questions (FAQ) document from the U.S. Department of Education (ED)’s Student Privacy Policy Office (SPPO) addresses these issues and reminds schools, colleges, and universities of the limited circumstances in which they can share student information with a third party without parental consent. Specifically, an educational institution can share student-identifying information without parental consent in connection with an emergency, including a COVID-19 public health emergency, if knowledge of the information is necessary to protect the health or safety of a student or other individuals. The types of individuals to whom such disclosures can be made are limited, however, and will not typically include other parents and students in the school community or the media.

The FAQ is an update to guidance ED issued in 2009 in the face of the H1N1 outbreak. Consistent with our firm’s previous guidance, the FAQ generally advises schools of the following:

• Educational institutions should be cautious about disclosing a student’s personally identifiable information without parental consent or consent of an eligible student unless a clear exemption to the general consent requirement applies. Although there is an exception for health and safety emergencies, it only applies if personally identifiable information is disclosed to an appropriate party whose knowledge of the information is necessary to protect the health or safety of the student or other individuals.
• Even where a health or safety emergency exists, there are limits on the type of information that can be shared with public health officials without parental consent.
• Disclosure to a student’s parents is always possible if the student is under the age of 18; for students 18 and over, disclosure may still be warranted based on the student’s dependent status.
• “Appropriate parties” include public health officials whose knowledge of the information is necessary to protect individuals’ health or safety.
• For notices to the school community regarding a student who has tested positive for COVID-19 it is, in most instances, sufficient to provide a general notice of the fact that an individual has tested positive without specifically identifying the student who is infected.
• Rare situations may arise during a health or safety emergency justifying a school’s determination, in conjunction with health officials, that disclosure of a student’s identifiable information to certain parents of other students may be absolutely necessary, but such determinations must be made on a case-by-case basis taking into account the totality of the circumstances. ED provides as an example a student with COVID-19 who is a wrestler and has been in direct and close contact with other students who are on the team or who are in the school and have higher health risks. ED states that school officials in such a case may decide it is necessary to disclose the identity of the diagnosed student to the parents of the other students.

Illinois school districts should keep in mind that when sharing any student record information under the health and emergency exception, the Illinois School Student Records Act requires parent notification of such disclosure no later than the next school day after the date that the information is released. FERPA also generally requires records to be maintained when requests for access are made and granted. Schools should continue to work with legal counsel when addressing specific issues of student (and employee) privacy and COVID-19 related issues, along with following current health department recommendations. For more information, contact the authors of this alert or any other Franczek attorney