Protecting the Privacy of Students and Educators During the Pandemic

During the COVID-19 outbreak, school officials may be asked to cooperate with public health agencies in their efforts to stem the spread of the disease. Because safeguarding the personal data of students and educators is of paramount concern, the Student Privacy Policy Office (SPPO) published guidance for school officials to observe when communicating with students, parents, agencies and other parties.

Parents and eligible students must provide consent before an educational agency (i.e. district) or institution (i.e. school) discloses PII (personal identifying information) from education records. The consent must specify the record that may be disclosed, state the purpose of the disclosure, and identify the party or class of parties to whom disclosure may be made. SPPO provides a model consent form that can be used in situations where prior written consent is needed.

The Family Educational Rights and Privacy Act (FERPA) permits educational agencies and institutions to disclose, without prior written consent, PII from student educational records to appropriate parties in connection with an emergency, if knowledge of that information is necessary to protect the health or safety of a student or other individuals. Typically, individual educators should not be placed in a situation where they are responsible for disseminating such information. Law enforcement officials, public health officials, trained medical staff, and parents are appropriate parties for making such disclosures. If you are asked to share information that you believe is not properly shareable, be sure to contact your school or district administrators.

FERPA does not permit nonconsensual disclosure, even in the event of a health or safety emergency, to the media. Educators who are apprised of a student’s illness due to COVID-19 should not disclose or alert any such information to the media, as they are not “appropriate parties” under FERPA’s health or safety emergency exception.

SPPO advises that educational agencies should not identify a particular student, educator, or school official as having COVID-19 to parents or family members of other students in the school. Nothing in FERPA prevents schools from telling parents and students that a specific teacher or other school official has COVID-19 because FERPA applies to students’ education records, not records on school officials. However, there may be State laws that apply in these situations. Educators should be deliberate in not sending out or sharing information pertaining to the identity of an individual who is infected and determined to have COVID-19.

In rare situations where general notice is insufficient, school officials may determine it is appropriate to disclose identifiable information of a student with COVID-19 in order to alert the education community of the need to take precautions and appropriate protective actions due to exposure to the virus. It is generally not within the province of individual educators to make such determinations. Please defer to the case-by-case determinations of school officials and do not independently disclose the identity of sick individuals.

School officials with questions about FERPA can contact the Department of Education’s Student Privacy Policy Office at [email protected] or (202) 260-3887.