Ask the FERPA Professor

July 13, 2020

Dear FERPA Professor:

If we have classes on campus this fall, how can we notify people if a student or faculty or staff member gets COVID, without violating FERPA? 

Is it allowable to provide the name of individuals to faculty and staff and students so they can more immediately know if they have been in contact and start quarantine? Or are we limited to generic information like, “Someone in Section 2 of English comp I has tested positive. Please quarantine or self-monitor if you have been in that class”?

Do you have some guidelines we could adapt?

Thanks in advance,

Justin Case

__________________________________________________________________________________________________

Dear Justin:

FERPA generally requires that a student provide written consent prior to any disclosure from the student's education record.  (See §99.30 of the FERPA regulations.) 

However, there are a number of exceptions to signed consent found at §99.31 of the regulations.  Institutions may disclose information from education records under any of these exceptions, so long as the specific conditions attached to these exceptions are met.  One of these exceptions concerns health and safety emergencies, and is found at §99.31(a)(10).  The specific conditions that must be met can be found at §99.36.  Thus, if the University determines that a health or safety emergency (such as the current COVID 19) exists, then it could disclose relevant student education records in notifying "appropriate parties" concerning the emergency.  Note that institutions are required to record any such disclosure, and the articulable and significant threat posed, in the record of the student(s) whose pii is disclosed as a result of the emergency.  If the disclosure is done in a generic fashion, then no disclosure has taken place and no redecoration is necessary. 

The "school official" exception found at §99.31(a)(1)(i)(A) is the other exception that relates to your inquiry.  This exception permits disclosures from student education records to school officials at the institution who are determined to have a legitimate educational interest in having access to a student's records.  This exception would permit the University to notify any school official(s) who may have had contact with the affected student(s).

You can find the above cited regulations on pages 159,161, and 166 of the 2012 AACRAO FERPA Guide.
 

I hope this is helpful in answering your questions.

The FERPA Professor