The U.S. Department of Education released some FAQs related to the Family Educational Rights and Privacy Act (FERPA) and corona virus. The Department’s Student Privacy Policy Office prepared the FAQs to assist officials in educational agencies and institutions such as school districts, schools, colleges and universities in managing public health issues related to COVID-19 while protecting the privacy of students. Below is a summary:

  • A parent or eligible student must provide written consent before an educational agency or institution discloses personally identifiable information (PII) from a student’s education records, unless one of the exceptions to FERPA’s general consent rule applies.
  • FERPA permits educational agencies and institutions to disclose, without prior consent, PII from student education records to appropriate parties in connection with an emergency, if knowledge of that information is necessary to protect the health and safety of a student (or other individuals.)
  • If an educational agency or institution, taking into account the totality of the circumstances, determines that a significant threat exists to the health or safety of a student in attendance at the agency or institution (or another individual at the agency or institution) as a result of the virus that causes COVID-19, it may disclose, without prior written consent, PII from student education records to appropriate officials at a public health department who need the information to protect the health or safety of the student (or another individual.)
  • If an educational agency or institution learns that student(s) in attendance at the school are out sick due to COVID-19, it may disclose information about the student’s illness under FERPA to other students and their parents in the school community without prior written parental or eligible student consent; but, it must make a reasonable determination that a student’s identity is not personally identifiable, whether through single or multiple releases, and while taking into account other reasonably available information.
  • FERPA permits educational agencies and institutions to non-consensually disclose PII from education records in the form of contact information of absent students to the public health department in specific circumstances, such as in connection with a health or safety emergency.
  • If an educational agency or institution determines that a health or safety emergency exists, it may NOT disclose, without consent, PII from student education records to the media.
  • In most cases, it is sufficient to report the fact that an individual in the school has been determined to have COVID-19, rather than specifically identifying the student who is infected.
  • Nothing in FERPA prevents schools from telling parents and students that a specific teacher or other school official has COVID-19 because FERPA applies to students’ education records, not records on school officials. However, there may be State laws that apply in these situations.
  • An educational agency or institution may disclose PII from an eligible student’s education records to the student’s parents if the eligible student has been determined to have COVID-19, generally without obtaining written consent.
  • FERPA permits educational agencies and institutions to release information from education records without consent after the removal of all PII, provided that the agency or institution has made a reasonable determination that a student’s identity is not personally identifiable, whether through single or multiple releases, and while taking into account other reasonably available information.
  • FERPA generally requires educational agencies and institutions to maintain a record of each request for access to, and each disclosure of PII from, the education records of each student.

For specific questions on how FERPA applies to your institution in relation to the COVID-19 pandemic, please reach out to one of our Global Privacy & Security Blog authors.