New Procedures, Same Old FERPA: How the Return to School Impacts Student Records

On July 6, 2020, a select few schools re-opened their doors for Extended School Year ("ESY") in-person instruction as Governor Murphy's restrictions began to lift.  In several weeks, all New Jersey schools will be required to have some form of in-person instruction while implementing new procedures and protocols, such as screening staff and students for Coronavirus Disease 2019 ("COVID-19") in accordance with the New Jersey Department of Education ("NJDOE") guidance.  The information and documentation generated as a result of these new protocols and procedures must remain in compliance with all federal laws, including the Family Educational Rights and Privacy Act ("FERPA").  Fortunately, The United States Department of Education ("USDOE") released guidance on frequently asked questions related to FERPA and COVID.  This alert provides a brief overview of the USDOE guidance.

Generally, FERPA requires that a parent or eligible student must provide written consent before the school discloses personally identifiable information ("PII") from "student education records" to individuals and entities who may not already have access to that information.  Due to the COVID-19 pandemic, schools will create and record health information and records (e.g., temperature records, contact tracing information, etc.) that qualify as "student education records" under FERPA.  In the event a student tests positive, the NJDOE requires school officials to "immediately notify local health officials, staff, and families of a confirmed case while maintaining confidentiality" of a confirmed COVID-19 case. However, situations may arise where a school can disclose PII as a result of a "health or safety emergency," which would not require a school to obtain a parent or student's consent.  While the USDOE and NJDOE recommend obtaining consent whenever possible, the USDOE FAQ contains various scenarios which explain when school officials need, or do not need, consent in the event of a confirmed case of COVID-19 on school grounds.

For example, a school may disclose student health records, without consent, to public health departments if the educational agency or institution believes that the virus that causes COVID-19 poses a serious risk to the health or safety of an individual student in attendance (or another individual at the agency or institution), such as an outbreak of COVID-19 occurring on school grounds.  However, if a student is absent and a school merely suspects that the student may have COVID-19, the school cannot reveal the name, address, and phone number of the absent student to the public health department without obtaining consent.

In regard to informing other students and their parents of another student's confirmed COVID-19 case, schools only can reveal "non-personally identifiable" information without consent in most instances.  When releasing this information, schools must strike a delicate balance to inform these other students and their parents that a student tested positive for COVID-19 without "disclos[ing] other information that, alone or in combination, would allow a reasonable person in the school community to identify the student who [is] absent due to COVID-19 with reasonable certainty."  A rare situation may arise where a school -- in conjunction with health, law enforcement, or other such officials -- may disclose identifiable information about a student with COVID-19 to parents of other students if parents need to know this information to take appropriate action to protect the health or safety of their children.  For example, the USDOE stated that this may be appropriate if:

a student with COVID-19 is a wrestler and has been in direct and close contact with other students who are on the team or who are in the school and have higher health risks, school officials may determine it necessary to disclose the identity of the diagnosed student to the parents of the other students.  In these limited situations, parents and eligible students may need to be aware of this information in order to take appropriate precautions or other actions to ensure the health or safety of their child or themselves, especially if their child or they may have a higher risk of susceptibility to COVID-19 or of developing severe complications from COVID-19.

It bears repeating that this is the exception to the rule, but shows the difficulties schools will face when making these case-by-case determinations regarding PII, consent, and which entities or individuals to inform.

The USDOE guidance contains other important examples and a sample FERPA consent form, which mirrors the previous FERPA consent forms many, if not all, schools used prior to the COVID-19 pandemic.  For your convenience, please find a link to the USDOE FERPA guidance below:

https://studentprivacy.ed.gov/resources/ferpa-and-coronavirus-disease-2019-covid-19

Schools will need to take care to update their student record policies, to ensure they include reference to this public health exception.  Please do not hesitate to contact us with questions you may have regarding FERPA.  Should you require any assistance to ensure your school is in compliance, we would be happy to assist.