The COVID-19 virus is having an unprecedented effect on all aspects of our daily lives, and has hit the educational system especially hard with forced closures and cancellations.  Because educational institutions play such a vital role in our communities, the Department of Education (DOE) recently issued guidance in the form of Frequently Asked Questions (Guidance)  to assist school officials with how to address this public health concern while appropriately protecting student privacy.

The Guidance first reminds school officials that generally they need to obtain consent before releasing a student’s personally identifiable information (PII).  However, given the threat posed by COVID-19, there are circumstances when the “health or safety emergency” exception to consent may apply.  The Guidance states that the “public health emergency” provision is not applicable if the circumstances are based on “a generalized or distant threat of a possible event or emergency for which the likelihood of occurrence is unknown.”  It goes on to list several specific situations where the health or safety emergency exception may or may not apply.

First, if an institution determines, based on the totality of the circumstances, that there is an articulable and significant threat to the health or safety of a student, the institution may disclose to appropriate officials at a public health department PII without prior written consent to protect the health or safety of a student or other individual.

Second, if an institution learns that a student in attendance at the school is out sick due to COVID-19 it may disclose this information to other students and parents in the school community, but only in a manner that prevents the student from being identified. In a rare situation, an institution may determine, in conjunction with health, law enforcement or other government officials, that parents or eligible students may need to be advised of the identity of a student with COVID-19.  The Guidance uses the example of a student wrestler with COVID-19 who has been in direct and close contact with other students or students who have higher health risks.  In these circumstances, school officials should determine on a case-by-case basis whether a disclosure of the student’s name is absolutely necessary to protect the health or safety of students or other individuals or whether a general notice is sufficient.  School officials should consider the totality of the circumstances, including the needs of students or other individuals to have the information in order to take appropriate precautions and the risks presented.

Third, while directory information such as a student’s name, address and phone number can be released, it cannot be released in conjunction with nondirectory information such as a list of students absent from school.  The health or safety emergency exception may apply to give public health officials a list of students absent from school, but only if the school, with the concurrence or at the direction of local health authorities can determine that there is, in fact, a public emergency in the community.  The Guidance suggests that institutions prepare consent forms for parents or eligible students to sign to allow this information to be shared if the government institutes a tracking or monitoring system to identify an outbreak before an emergency is recognized.  If a parent refuses to sign the consent form, then the institution may not make the disclosure unless the health or safety emergency exception applies.

Fourth, even if an institution determines that a health or safety emergency exists, it cannot disclose PII from a student’s education records to the media without consent.  Under the health or safety emergency exception, the disclosure can only be made to “appropriate parties” whose knowledge is necessary to protect the health and safety of students and other individuals, which are generally parties who provide specific medical or safety attention, such as health and law enforcement officials.  The media is not an “appropriate party” even though it may alert the community of an outbreak.

Fifth, an institution may disclose to an eligible student’s parents that the eligible student has COVID-19 if the parents claim the eligible student as a dependent under section 152 of the Internal Revenue Code of 1986 or if the disclosure is in connection with the health or safety emergency exception.

If an institution discloses PII from a student’s educational records to the public health department or other agency pursuant to the health or safety emergency exception, the institution is required to record the request and disclosure for each student as well as an explanation of the articulable and significant threat to the health or safety of a student or other individual that caused the institution to disclose the information.  Any disclosure made with the written consent of a parent or eligible student need not be recorded.