Photo by moren hsu on Unsplash
Alisher Kassym, Associate Member, University of Cincinnati Law Review
According to the National Center for Education Statistics, there are 98,277 public schools and almost 50.8 million students in the United States.[1] Amidst the coronavirus outbreak, 37 states have decided to close public schools, which amounts to 72,000 schools being closed, affecting at least 37 million students.[2] However, closing schools is not the only way to mitigate the spread of the virus. Some educational institutions may disclose students’ personal information to public health authorities to facilitate the ongoing fight against the coronavirus. These disclosures may be problematic, as the federal law dictates that the educational institutions and agencies—barring few exceptions—cannot disclose and release students’ personal information.[3] Will educational institutions be punished for sharing students’ data, even if the purpose of the disclosure is to prevent the effects of coronavirus?
Family Educational Rights and Privacy Act
20 U.S.C.S. § 1232g, also known as the Family Educational Rights and Privacy Act (“FERPA”), is a federal law that applies to all educational institutions and agencies that receive federal funding under programs administered by the Department of Education.[4] Per FERPA, the educational institutions and agencies generally cannot disclose personally identifiable information from students’ educational records.[5] Noncompliance with FERPA’s rules may result in funding cuts for the violating parties.[6]
There are notable exceptions to the non-disclosure provision of FERPA. First, an eligible student can submit written consent to disclose personally identifiable information.[7] Multiple exceptions allow—but do not require—the release of information without consent from the students.[8] Out of the available non-consensual exceptions, perhaps the most applicable exception for the current coronavirus outbreak is health or safety emergency.[9] The exception permits disclosure of students’ educational records “in connection with an emergency [to] appropriate persons if the knowledge of such information is necessary to protect the health or safety of the student or other person.”[10] The language of the statute does not clarify what constitutes a health or safety emergency.[11]
It is safe to presume that, due to absence of federal guidelines, the educational institutions have discretion over qualifying events as an emergency. Before 1988, the Code of Federal Regulations (“CFR”) listed four non-statutory criteria for determining the application of the emergency exception under FERPA.[12] The CFR listed the following considerations: (1) seriousness of the threat to the health or safety of the student population; (2) the necessity of the information at issue to meet the emergency; (3) whether the parties receiving the information are in a position to address the emergency; and (4) time considerations.[13] In 1988, the Secretary of Education deleted those criteria, reasoning that educational institutions and agencies were capable of making the necessary determinations without the Federal regulation.[14] The discussion also hinted that the removed criteria would remain relevant.[15] Still, it became clear that institutions covered by FERPA were free to determine whether the emergency exception applied.
Discussion
The educational institutions and agencies will likely face no issues with invoking the FERPA’s emergency exception to share students’ personal information with public health authorities. Institutions have the discretion to protect students’ health by any measures deemed necessary because the institutions have no required criteria governing the application of the emergency exception. Moreover, information disclosures in connection with a global pandemic[16] are likely to be viewed as reasonable due to the nature of the situation and health risks imposed on individuals. The COVID-19 outbreak also satisfies the pre-1988 CFR emergency exception standards—the threat from the virus is serious, time is of the essence, and the release of students’ personal information (such as health conditions) can ease the pandemic’s effect. Lastly, because the virus is a recognized threat to public welfare, the measures taken against it will inevitably be connected to health and safety of the population. Thus, the schools and other entities governed by FERPA will be able to use the FERPA’s emergency exception to disclose information from students’ educational records.
This prediction is further fortified by the Department of Education’s recent report. The report stated that an educational institution or agency may release personally identifiable information if it considers the “totality of circumstances” surrounding the spread of COVID-19.[17] The report also noted that public health officials and medical personnel are typically “appropriate parties” to whom students’ information is disclosed under the emergency exception.[18] Taken together, the report’s wording implies that the educational institutions would be under minimal risk of violating FERPA for disclosing students’ personal information in connection with the pandemic emergency. Nevertheless, the report cautioned that educational institutions’ judgment must be based on a specific emergency, not a general and distant threat.[19] On top of that, the disclosures are limited in time to the period of emergency, meaning that blanket releases of information should not be practiced.[20] Since a violation of FERPA can result in loss of federal funding, the educational institutions can still choose to obtain students’ consent to minimize the risks of potential litigation.
Conclusion
Educational institutions will likely be able to disclose students’ personally identifiable information to public health authorities to mitigate the effects of coronavirus. The spread of coronavirus can be classified as a public health and safety emergency under the FERPA exception due to the threat posed by the virus. Thus, the institutions can invoke the emergency exception to share information from students’ educational records.
[1] Map: Coronavirus and School Closures, Education Week (March 6 2020), https://www.edweek.org/ew/section/multimedia/map-coronavirus-and-school-closures.html (last visited March 16, 2020).
[2] Information as of March 16, 2020. Id.
[3] See 20 U.S.C.S. § 1232g(b) (LexisNexis, Lexis Advance through Public Law 116-108).
[4] U.S. Department of Education, FERPA General Guidance for Students, https://www2.ed.gov/policy/gen/guid/fpco/ferpa/students.html [https://web.archive.org/web/20200319112947/https://www2.ed.gov/policy/gen/guid/fpco/ferpa/students.html].
[5] See 20 U.S.C.S. § 1232g(b) (LexisNexis, Lexis Advance through Public Law 116-108).
[6] Id. at § 1232g(b)(1).
[7] Id.
[8] U.S. Department of Education, supra note 4.
[9] 20 U.S.C.S. § 1232g(b)(1)(I).
[10] Id.
[11] Id. at § 1232g.
[12] Brown v. City of Oneonta, 106 F.3d 1125, 1132 (2d Cir. 1997)
[13] Id.
[14] Final Regulations, Family Educational Rights and Privacy, 53 F.R. 11942 (1988).
[15] Id. “Nothing in the statute or legislative history prohibits an agency or institution from considering the four specific criteria that have been removed.”
[16] “We have therefore made the assessment that COVID-19 can be characterized as a pandemic.” World Health Organization, WHO Director-General’s opening remarks at the media briefing on COVID-19 (11 March 2020), https://www.who.int/dg/speeches/detail/who-director-general-s-opening-remarks-at-the-media-briefing-on-covid-19—11-march-2020.
[17] FERPA & Coronavirus Disease 2019 (COVID-19), U.S. Department of Education, 3 (March 2020), https://studentprivacy.ed.gov/resources/ferpa-and-coronavirus-disease-2019-covid-19.
[18] Id. at 4.
[19] Id. at 3.
[20] Id. at 4.
