As school districts prepare for students to return to brick-and-mortar classrooms in the summer and fall, many state educational agencies and public health officials have recommended that school officials conduct daily health screenings before students enter campuses to receive in-person instruction. In most cases, the purpose of these screenings is to check students for symptoms of COVID-19 and chart their history of potential exposure to the virus.
In training school nurses, school support personnel, and other school employees to conduct these health screenings, districts should remind staffers of their duty to protect the privacy of sensitive student information. On June 30, the Centers for Disease Control and Prevention released interim guidance for K-12 school administrators. That guidance emphasized that while symptom screening and contact tracing in schools may help slow and stop the transmission of the coronavirus, school officials must implement these measures in a way that complies with the Family Educational Rights and Privacy Act.
To that end, the CDC advised districts to follow the guidelines issued by the Student Privacy Policy Office in Questions and Answers on the Applicability of FERPA to Disclosures Related to COVID-19, 120 LRP 9700 (SPPO 03/12/20).
Under FERPA, a district must generally obtain prior written parental consent before it may disclose any personally identifiable information derived from a student’s education records to third parties. 34 CFR 99.30(a). According to SPPO, FERPA’s protections extend to health-related information if that information is included in education records maintained by a district or an agent for the district. See Questions and Answers on the Applicability of FERPA to Disclosures Related to COVID-19, 120 LRP 9700 (SPPO 03/12/20).
Disclosures during health or safety emergencies
FERPA permits districts to nonconsensually disclose education records, including health-related records, to appropriate parties if there is an articulable and significant threat to the health or safety of the school community. 34 CFR 99.31(a)(10); and 34 CFR 99.36. Under this “health or safety emergency” exception to FERPA’s consent rule, a district may, for example, disclose a student’s COVID-19 diagnosis to public health officials, medical professionals, and other individuals who need the information to stop the spread of the virus.
However, the health or safety emergency exception to FERPA is limited in time to the period of the emergency and generally does not allow for a blanket release of sensitive information. This means that school officials need to obtain parental consent before releasing information about a student’s health, including any coronavirus symptoms he may present, to the public. Questions and Answers on the Applicability of FERPA to Disclosures Related to COVID-19, 120 LRP 9700 (SPPO 03/12/20).
Follow these tips to ensure your school employees comply with FERPA’s privacy requirements:
- Clarify FERPA provisions in training. To ensure that school personnel don’t misinterpret the health or safety emergency exception to FERPA’s parental consent rule, districts should consider providing in-depth training on FERPA to all staffers who may be responsible for conducting health screenings when students return to school. This training should clarify the circumstances in which staffers may nonconsensually release students’ health-related information and records and to whom those disclosures may be made.
- Develop procedures for reporting coronavirus symptoms. Another way to prevent unauthorized disclosures of PII is to develop procedures addressing situations where a student arrives to school with a fever or other symptoms of COVID-19. For example, a district may direct school personnel conducting health screenings to immediately notify the school nurse if they suspect a student is ill. This may prevent staffers from inadvertently disclosing the student’s health information to the wrong person.
- Instruct staff not to gossip. Any unnecessary communications, such as verbal conversations and text messages, about a student’s illness or potential illness may violate FERPA’s nondisclosure provisions. Accordingly, if a student presents symptoms of COVID-19 during a health screening, the district should remind staffers not to gossip to other students, parents, colleagues, friends, or family members about the student’s condition.
- Consider conducting health screenings in partitioned spaces. If public health experts or state officials recommend that a district screen students for symptoms of COVID-19 before they enter the school building, the district should consider setting up partitioned spaces for those screenings. This may make it easier for staffers to protect the privacy of students.
For example, if a paraprofessional takes the temperature of a student and determines the student has a fever, the paraprofessional may show the results to the student and provide him instructions on what to do next without drawing the attention of his peers in the area. Similarly, if a school nurse must interview a student regarding his potential history of exposure to the coronavirus, conducting the interview in a separate, partitioned space or in an office may prevent others from overhearing the student’s personal information.
Editor’s note: While these tips do not necessarily bar parents from filing a FERPA complaint to the Student Privacy Policy Office for alleged privacy breaches, they may help districts reduce incidents of inadvertent disclosures. Districts should consult legal counsel to determine what steps may be necessary to protect student privacy in specific situations.
Amy K. Onaga, Esq., covers special education legal issues for Special Ed Connection, a DA sister publication. Documents mentioned above are available to subscribers.
