COVID 19: How FERPA and HIPAA apply to student records

School administrators have to face multiple questions around privacy as COVID 19 continues to spread globally. Administrators must form a strategy on how to inform communities about infections that are spreading among students and their close circles, how to respond to such cases, and most importantly, how to manage keeping students’ privacy safe in such cases. The School Superintendents association has put together a detailed report drawing from the USED guidance on how FERPA applies to schools in the context of COVID 19.  

Student health is protected by the Family Educational Rights and Privacy Act (FERPA) and not the Health Insurance Portability and Accountability Act (HIPAA). If there is a need to disclose personal information, authorities will typically have to take consent to protect the health of others in an emergency. 

 

FERPA and HIPAA  ( How they usually apply )

FERPA protects personally identifiable information (PII) in students’ health records maintained by an educational agency or institution. Schools can disclose FERPA-protected information only if they have consent from a parent unless an exception to FERPA’s general consent rule applies. In the case of COVID 19, the most applicable exception to consent is FERPA’s health or safety emergency exception. 

HIPAA applies when a school’s health services are funded, administered and operated by or on behalf of public or private health, social services, or other non-educational agencies or individuals. HIPAA prohibits the disclosure of protected health information (PHI) without consent and requires entities subject to the law to establish appropriate privacy policies to protect PHI from unauthorized disclosure. HIPAA, however, has an emergency provision allowing disclosure of PHI in certain cases.  

How they apply to student records during COVID 19 pandemic 

Here’s how schools can share information about students while protecting their privacy during a public health emergency. 

If a student has COVID 19, what information from educational records can the school share with the community? 

Occasions where FERPA does not apply 

• • Schools can disclose that a student may have COVID 19 as long as the school does not directly or indirectly identify that student.  
  • Administrators must ensure messages to the community don’t identify the student directly or indirectly.  

 E.g., “A student on the soccer team or a student who recently attended a soccer game tested positive for COVID 19.  

 

When personally identifiable information needs to be released, FERPA applies 

• • If the school determines that certain students had close contact with an affected student during a potentially contagious period. 
  • When there is an articulable and significant threat to the health or safety of a student or other individuals and when someone needs PII from education records to protect the student’s or other individuals’ health or safety. 

Actions the school might take during a period of risk: 

1. Articulable and significant threat of a health or safety emergency: Articulable and significant threat means that the school should be able to explain, based on all the information available at the time, what the threat is and why it is significant.  

• In the FERPA and COVID 19 guidance, US Department of Education (USED) states that if local public health authorities determine that a public health emergency, such as COVID 19, is a significant threat to students or other individuals in the community, an educational agency/institution in the community may determine that an emergency exists too.   
• The 2009 FERPA and H1N1 guidance from USED notes that an emergency could include sharing information when necessary during the early stages of a pandemic.  

2. Disclosure is necessary to protect health and safety of students and others:  

• The school decides that the affected student’s teachers, classmates and their parents, or students with whom the student spent significant amount of time know about the affected student in order to protect their health. 

3. Only disclose the minimum amount of information required to address the issue at hand: 

• The school can choose to disclose to the classmates of an affected student that one of their classmates has COVID 19 without identifying who it is. In this case, FERPA would not apply. 
• If the school needs to directly or indirectly identify the student, they should make sure they provide the minimum information necessary. Perhaps details like the COVID 19 positive status and a window of time of the infection. 

4. School officials should be sure to document when they release PII in this exception:  

• The health or safety emergency exception requires the school to list the following information in the student’s record: the articulable and significant threat that formed the basis for the disclosure and the parties who received the information. 

If the school suspects that a student has COVID 19, what information can the school share with the community? 

• School administrators can proactively warn parents and students about COVID 19 in the school community to facilitate prevention efforts and ensure that people have information necessary to address a potential outbreak. 
• It is not necessary to identify the symptomatic individual. 

• Do not identify the student exhibiting symptoms unless the community needs to know that information, and perhaps share CDC-recommended preventative measures or other resources as part of a message that can help protect parents and students. 
• Do not make notifications about a student exhibiting symptoms to elicit fear. 
• FERPA does not cover teachers. So, if a teacher is affected, a school could share that information without violating FERPA. However, state laws regarding employee confidentiality might apply.  

If a school suspects that a student may have COVID 19, can school officials contact the student’s primary care physician? 

• If a school cannot reach a student or parents and suspects that the student might have COVID 19, they can reach out to the student’s primary care physician to ask if the physician can confirm so the school can notify the community. 
• The school could obtain the parent’s or eligible student’s consent to contact the physician; use FERPA’s health or safety emergency exception. 
• However, HIPAA may not allow the physician to disclose any information back to the school. HIPAA contains an emergency exception that allows health care providers to disclose protected health information without patient authorization “as necessary to prevent or lessen a serious and imminent threat to the health or safety of the individual, another person, or the public. 
• If a provider identifies the risk, they would be permitted to disclose the minimum information necessary to the school. 

If a student has COVID 19 and the school’s health records are covered by HIPAA rather than FERPA, what information can the school disclose to its community? 

• The HIPAA privacy rule includes an emergency exemption allowing covered entities to disclose protected health information without patient authorization. 
• HIPAA requires covered entities to disclose the minimum information necessary to prevent or control the spread of the disease or otherwise carry out public health interventions or investigations. 
• School authorities can disclose in an email to the campus community that a student has tested positive for COVID 19, and consider including which dorm that student was living in or other pertinent locations where the student might have been. 

What if a school receives a voluntary request from a local, state, or federal agency for student records to assist the agency in responding to the COVID 19 outbreak? 

• FERPA does not prohibit disclosure of aggregated or properly de-identified information, so administrators may freely share that type of information to help agencies respond to the pandemic. 
• While providing the information, the school should ensure that a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, does not identify the student with reasonable certainty, based on the information provided.  
• Schools can share information without consent about school absentee rates in aggregated or de-identified form. 
• A school could elect to share PII from student records with a public health agency if the school decides that a health or safety emergency exists and the disclosure is necessary to protect students’ health or safety. Any disclosure made to an appropriate party under this exception must be limited to the duration of the identified emergency and be documented in the student’s education record. 

What should a school do if it receives a request under a mandatory reporting law to share student health records with a public health agency? 

• Depending on the disease, the information that must be reported could be either PII or de-identified or aggregated data. As a reminder, de-identified or aggregated reporting is not covered by FERPA, and can therefore be shared at any time. 
• USED emphasizes that sharing PII is not allowed in the case of routine or non-emergency reporting that might be required by state or local policies, such as PII regarding students with cancer. 

Do interagency agreements with other state or local agencies allow schools to disclose education records without obtaining consent? 

• No. As per the previous department guidance, interagency agreements do not supersede the consent requirements under FERPA. Although an interagency agreement could be a helpful tool for planning purposes, schools must comply with FERPA’s requirements regarding the disclosure of personally identifiable information from students’ education records.