COVID 19: How FERPA and HIPAA apply to student records
School administrators have to face multiple questions around privacy as COVID 19 continues to spread globally. Administrators must form a strategy on how to inform communities about infections that are spreading among students and their close circles, how to respond to such cases, and most importantly, how to manage keeping students’ privacy safe in such cases. The School Superintendents association has put together a detailed report drawing from the USED guidance on how FERPA applies to schools in the context of COVID 19. Student health is protected by the Family Educational Rights and Privacy Act (FERPA) and not the Health Insurance Portability and Accountability Act (HIPAA). If there is a need to disclose personal information, authorities will typically have to take consent to protect the health of others in an emergency. FERPA and HIPAA ( How they usually apply ) FERPA protects personally identifiable information (PII) in students’ health records maintained by an educational agency or institution. Schools can disclose FERPA-protected information only if they have consent from a parent unless an exception to FERPA’s general consent rule applies. In the case of COVID 19, the most applicable exception to consent is FERPA’s health or safety emergency exception. HIPAA applies when a school’s health services are funded, administered and operated by or on behalf of public or private health, social services, or other non-educational agencies or individuals. HIPAA prohibits the disclosure of protected health information (PHI) without consent and requires entities subject to the law to establish appropriate privacy policies to protect PHI from unauthorized disclosure. HIPAA, however, has an emergency provision allowing disclosure of PHI in certain cases. How they apply to student records during COVID 19 pandemic Here’s how schools can share information about students while protecting their privacy during a public health emergency. If a student has COVID 19, what information from educational records can the school share with the community? Occasions where FERPA does not apply Schools can disclose that a student may have COVID 19 as long as the school does not directly or indirectly identify that student. Administrators must ensure messages to the community don’t identify the student directly or indirectly. E.g., “A student on the soccer team or a student who recently attended a soccer game tested positive for COVID 19. When personally identifiable information needs to be released, FERPA applies If the school determines that certain students had close contact with an affected student during a potentially contagious period. When there is an articulable and significant threat to the health or safety of a student or other individuals and when someone needs PII from education records to protect the student’s or other individuals’ health or safety. Actions the school might take during a period of risk: 1. Articulable and significant threat of a health or safety emergency: Articulable and significant threat means that the school should be able to explain, based on all the information available at the time, what the threat is and why it is significant. In the FERPA and COVID 19 guidance, US Department of Education (USED) states that if local public health authorities determine that a public health emergency, such as COVID 19, is a significant threat to students or other individuals in the community, an educational agency/institution in the community may determine that an emergency exists too. The 2009 FERPA and H1N1 guidance from USED notes that an emergency could include sharing information when necessary during the early stages of a pandemic. 2. Disclosure is necessary to protect health and safety of students and others: The school decides that the affected student’s teachers, classmates and their parents, or students with whom the student spent significant amount of time know about the affected student in order to protect their health. 3. Only disclose the minimum amount of information required to address the issue at hand: The school can choose to disclose to the classmates of an affected student that one of their classmates has COVID 19 without identifying who it is. In this case, FERPA would not apply. If the school needs to directly or indirectly identify the student, they should make sure they provide the minimum information necessary. Perhaps details like the COVID 19 positive status and a window of time of the infection. 4. School officials should be sure to document when they release PII in this exception: The health or safety emergency exception requires the school to list the following information in the student’s record: the articulable and significant threat that formed the basis for the disclosure and the parties who received the information. If the school suspects that a student has COVID 19, what information can the school share with the community? School administrators can proactively warn parents and students about COVID 19 in the school community to facilitate prevention efforts and ensure that people have information necessary to address a potential outbreak. It is not necessary to identify the symptomatic individual. Do not identify the student exhibiting symptoms unless the community needs to know that information, and perhaps share CDC-recommended preventative measures or other resources as part of a message that can help protect parents and students. Do not make notifications about a student exhibiting symptoms to elicit fear. FERPA does not cover teachers. So, if a teacher is affected, a school could share that information without violating FERPA. However, state laws regarding employee confidentiality might apply. If a school suspects that a student may have COVID 19, can school officials contact the student’s primary care physician? If a school cannot reach a student or parents and suspects that the student might have COVID 19, they can reach out to the student’s primary care physician to ask if the physician can confirm so the school can notify the community. The school could obtain the parent’s or eligible student’s consent to contact the physician; use FERPA’s health or safety emergency exception. However, HIPAA may not allow the physician to disclose any information back to the school. HIPAA contains an emergency exception that allows health care providers to disclose protected health information without patient authorization “as necessary to prevent or lessen a serious and imminent threat to the health or safety of the individual, another person, or the public. If a provider identifies the risk, they would be permitted to disclose the minimum information necessary to the school. If a student has COVID 19 and the school’s health records…
