spread globally. Administrators must form a strategy on how to inform communities about
infections that are spreading among students and their close circles, how to respond to such
cases, and most importantly, how to manage keeping students’ privacy safe in such cases.
The School Superintendents association has put together a detailed report drawing from the USED
guidance on how FERPA applies to schools in the context of COVID 19.
Student health is protected by the Family Educational Rights and Privacy Act (FERPA) and not
the Health Insurance Portability and Accountability Act (HIPAA). If there is a need to disclose
personal information, authorities will typically have to take consent to protect the health of others
in an emergency.
FERPA and HIPAA ( How they usually apply )
FERPA protects personally identifiable information (PII) in students’ health records maintained
by an educational agency or institution. Schools can disclose FERPA-protected information only
if they have consent from a parent unless an exception to FERPA’s general consent rule
applies. In the case of COVID 19, the most applicable exception to consent is FERPA’s health or
safety emergency exception.
HIPAA applies when a school’s health services are funded, administered and operated by or on
behalf of public or private health, social services, or other non-educational agencies or
individuals. HIPAA prohibits the disclosure of protected health information (PHI) without consent
and requires entities subject to the law to establish appropriate privacy policies to protect PHI
from unauthorized disclosure. HIPAA, however, has an emergency provision allowing disclosure
of PHI in certain cases.
How they apply to student records during COVID 19 pandemic
Here’s how schools can share information about students while protecting their privacy during a
public health emergency.
If a student has COVID 19, what information from educational records can the school share with
Occasions where FERPA does not apply
Schools can disclose that a student may have COVID 19 as long as the school does not directly
or indirectly identify that student.
Administrators must ensure messages to the community don’t identify the student directly or indirectly.
E.g., “A student on the soccer team or a student who recently attended a soccer game tested
positive for COVID 19.
When personally identifiable information needs to be released, FERPA applies
If the school determines that certain students had close contact with an affected student during
a potentially contagious period.
When there is an articulable and significant threat to the health or safety of a student or other
individuals and when someone needs PII from education records to protect the student’s or
other individuals’ health or safety.
Actions the school might take during a period of risk :
1. Articulable and significant threat of a health or safety emergency: Articulable and significant
threat means that the school should be able to explain, based on all the information available at
the time, what the threat is and why it is significant.
In the FERPA and COVID 19 guidance, US Department of Education (USED) states that if local
public health authorities determine that a public health emergency, such as COVID 19, is a
significant threat to students or other individuals in the community, an educational
agency/institution in the community may determine that an emergency exists too.
The 2009 FERPA and H1N1 guidance from USED notes that an emergency could include
sharing information when necessary during the early stages of a pandemic.
2. Disclosure is necessary to protect health and safety of students and others:
The school decides that the affected student’s teachers, classmates and their parents, or
students with whom the student spent significant amount of time know about the affected
student in order to protect their health.
3. Only disclose the minimum amount of information required to address the issue at hand:
The school can choose to disclose to the classmates of an affected student that one of their
classmates has COVID 19 without identifying who it is. In this case, FERPA would not apply.
If the school needs to directly or indirectly identify the student, they should make sure they
provide the minimum information necessary. Perhaps details like the COVID 19 positive status
and a window of time of the infection.
4. School officials should be sure to document when they release PII in this exception:
The health or safety emergency exception requires the school to list the following information in
the student’s record: the articulable and significant threat that formed the basis for the disclosure and the parties who received the information.
If the school suspects that a student has COVID 19, what information can the school share with
School administrators can proactively warn parents and students about COVID 19 in the school
community to facilitate prevention efforts and ensure that people have information necessary to
address a potential outbreak.
It is not necessary to identify the symptomatic individual.
Do not identify the student exhibiting symptoms unless the community needs to know that
information, and perhaps share CDC-recommended preventative measures or other resources
as part of a message that can help protect parents and students.
Do not make notifications about a student exhibiting symptoms to elicit fear.
FERPA does not cover teachers. So, if a teacher is affected, a school could share that
information without violating FERPA.
However, state laws regarding employee confidentiality
If a school suspects that a student may have COVID 19, can school officials contact the
student’s primary care physician?
If a school cannot reach a student or parents and suspects that the student might have COVID
19, they can reach out to the student’s primary care physician to ask if the physician can confirm
so the school can notify the community.
The school could obtain the parent’s or eligible student’s consent to contact the physician; use
FERPA’s health or safety emergency exception.
However, HIPAA may not allow the physician to disclose any information back to the school.
HIPAA contains an emergency exception that allows health care providers to disclose protected
health information without patient authorization “as necessary to prevent or lessen a serious and
imminent threat to the health or safety of the individual, another person, or the public.
If a provider identifies the risk, they would be permitted to disclose the minimum information
necessary to the school.
If a student has COVID 19 and the school’s health records are covered by HIPAA rather than
FERPA, what information can the school disclose to its community?
The HIPAA privacy rule includes an emergency exemption allowing covered entities to disclose
protected health information without patient authorization.
HIPAA requires covered entities to disclose the minimum information necessary to prevent or
control the spread of the disease or otherwise carry out public health interventions or investigations.
School authorities can disclose in an email to the campus community that a student has tested
positive for COVID 19, and consider including which dorm that student was living in or other
pertinent locations where the student might have been.
What if a school receives a voluntary request from a local, state, or federal agency for student
records to assist the agency in responding to the COVID 19 outbreak?
FERPA does not prohibit disclosure of aggregated or properly de-identified information, so
administrators may freely share that type of information to help agencies respond to the
While providing the information, the school should ensure that a reasonable person in the
school community, who does not have personal knowledge of the relevant circumstances, does
not identify the student with reasonable certainty, based on the information provided.
Schools can share information without consent about school absentee rates in aggregated or
A school could elect to share PII from student records with a public health agency if the school
decides that a health or safety emergency exists and the disclosure is necessary to protect
students’ health or safety. Any disclosure made to an appropriate party under this exception
must be limited to the duration of the identified emergency and be documented in the student’s
What should a school do if it receives a request under a mandatory reporting law to share
student health records software with a public health agency?
Depending on the disease, the information that must be reported could be either PII or
de-identified or aggregated data. As a reminder, de-identified or aggregated reporting is not
covered by FERPA, and can therefore be shared at any time.
USED emphasizes that sharing PII is not allowed in the case of routine or non-emergency
reporting that might be required by state or local policies, such as PII regarding students with
Do interagency agreements with other state or local agencies allow schools to disclose
education records without obtaining consent?
No. As per the previous department guidance, interagency agreements do not supersede the
consent requirements under FERPA. Although an interagency agreement could be a helpful tool
for planning purposes, schools must comply with FERPA’s requirements regarding the
disclosure of personally identifiable information from students’ education records.
Author Bio - Arushi is a technical writer at Eduhealth. It's a company in the US.She enjoys telling
about tech innovations and digital ways to bring health and safety measures.