Q: The Texas Department of Health has contacted the District requesting information on students exhibiting possible symptoms of the Coronavirus (COVID-19). May the District release the requested information, and are we required to record what information was shared?
A: Yes and yes. The Family Educational Rights and Privacy Act (“FERPA”) contains an exception that allows Districts to release student information to protect the health and safety of students and others. The District must also record what information was shared in the student’s education record.
The Family Educational Rights and Privacy Act (“FERPA”) prohibits the release of personally identifiable information held in a student’s education records unless authorized by the student’s parent or guardian. 20 U.S.C. § 1232(g); 34 C.F.R. Part 99. Multiple exceptions to parental consent exist, including release of information required to protect the health and safety of the student and of other individuals (referred to often as the “health and safety exception”). 34 C.F.R. 99.31(a)(10).
For the health and safety exception to apply, a school district must, based on the totality of the circumstances, determine that there is an articulable and significant threat to the health and safety of a student or other individuals. If such conditions exist, the District may disclose information from a student’s education records to any person whose knowledge of the information is necessary to protect the health and safety of the student or other individuals. 34 C.F.R. 99.36(a). Within a reasonable time after releasing the requested information, the District must record the articulable and significant threat that formed the basis of disclosure and the parties to whom the information was disclosed. A school district is also required to retain this information in the student’s education records. 34 C.F.R. 99.32(a)(5).
While FERPA requires that a school district notify parents when their child’s education records are released pursuant to a subpoena, the Act is silent on whether a student’s parent or guardian must be notified when the District makes a disclosure using the health and safety exception. 20 U.S.C. 1232(g); C.F.R. Part 99. As such, school districts have discretion on whether to notify parents of student information disclosed in this manner.
In response to the spread of an infectious disease like COVID-19, Districts may be asked to provide health authorities with staff and student scheduling information to determine who an infected individual might have come into contact with while on campus. Districts should consider reviewing, updating, and making this information readily accessible should it be requested. For specific questions concerning FERPA and the release of student health information, contact your school attorney.