Dear FERPA Professor:
If we have classes on campus this fall, how can we notify people if a student or faculty or staff member gets COVID, without violating FERPA?
Is it allowable to provide the name of individuals to faculty and staff and students so they can more immediately know if they have been in contact and start quarantine? Or are we limited to generic information like, “Someone in Section 2 of
English comp I has tested positive. Please quarantine or self-monitor if you have been in that class”?
Do you have some guidelines we could adapt?
Thanks in advance,
FERPA generally requires that a student provide written consent prior to any disclosure from the student's education record. (See §99.30 of the FERPA regulations.)
However, there are a number of exceptions to signed consent found at §99.31 of the regulations. Institutions may disclose information from education records under any of these exceptions, so long as the specific conditions attached
to these exceptions are met. One of these exceptions concerns health and safety emergencies, and is found at §99.31(a)(10). The specific conditions that must be met can be found at §99.36. Thus, if the University
determines that a health or safety emergency (such as the current COVID 19) exists, then it could disclose relevant student education records in notifying "appropriate parties" concerning the emergency. Note that institutions are required
to record any such disclosure, and the articulable and significant threat posed, in the record of the student(s) whose pii is disclosed as a result of the emergency. If the disclosure is done in a generic fashion, then no disclosure
has taken place and no redecoration is necessary.
The "school official" exception found at §99.31(a)(1)(i)(A) is the other exception that relates to your inquiry. This exception permits disclosures from student education records to school officials at the institution who are determined
to have a legitimate educational interest in having access to a student's records. This exception would permit the University to notify any school official(s) who may have had contact with the affected student(s).