On March 12, 2020, the U.S. Department of Education (ED) released guidance for educational institutions regarding compliance with Family Educational Rights and Privacy Act (FERPA) in the context of the coronavirus outbreak (COVID-19). The ED also has established a resource page for issues relating to COVID-19 generally, including links to public health guidance and fact sheets authored by the Centers for Disease Control and Prevention. The most recent guidance from ED, available here, specifically addresses an educational institution’s obligations to protect the privacy of student education records, as well as the conditions under which an institution may disclose Personally Identifiable Information (PII) from the student’s education records to a public health department, law enforcement, medical professionals, or others in the event of a health or safety emergency.

The guidance focuses significantly on how to interpret and apply FERPA’s “health and safety” exception to the usual requirement for written consent to disclose PII from a student’s education records. While the guidance reinforces existing regulatory language stipulating that the ED generally will not second-guess an educational institution’s determination to apply that exception, such an application must be reasonable under the circumstances and based on existing evidence. FERPA regulations also require an institution to document in its records any instances where a student’s PII has been shared — and with whom it has been shared — without the typically-required prior written consent, including under the health and safety exception. If an institution is relying on the health and safety exception, it must also document the reasons justifying its determination that the exception applies.

Questions answered in the ED’s guidance relating to FERPA and COVID-19 include:

• Must parents, or eligible students, consent to the disclosure by an institution of any PII from the student’s education records?
• When and how does the health or safety emergency exception to FERPA permit disclosure of PII?
• May student health records be disclosed, without consent, to a public health department?
• To what, if any, extent may a school disclose to other students and parents the specific illness of a sick student without consent?
• May a school non-consensually disclose the contact information of absent students to a public health department to facilitate an assessment of their illness, if any?
• If a health or safety emergency exists, may PII from student education records be disclosed to the media?
• May a school identify a specific person — whether student, teacher, or official — as having COVID-19?
• If an eligible student has been determined to have COVID-19, may an institution disclose PII from that student’s education records to the student’s parents?
• If a parent of a non-eligible student refuses to provide consent, may the institution release PII from the student’s education records to a public health department?
• Must an educational agency or institution record all disclosures of PII submitted to a public health department, or to other outside parties, even in the event of a health or safety emergency?

We encourage you to review the FAQ, as well as the ED webpage with additional resources on responding to COVID-19, for its potential application to any aspect of your institution.