written by Aya Nouiouat, Privacy Intern
With absolutely no forewarning or time to prepare, educators have had to scramble to protect students' rights to privacy amid a full-blown COVID-19 pandemic. Though the pandemic isn't over, now is the appropriate time to reflect as classrooms begin to fill up again. Teachers and students alike must tread lightly in what can only be described as a privacy quandary. Due to the shift to remote learning, many schools and educators are left wondering whether this change will impact the privacy of their students. In response to the pandemic, institutions are leaning heavily on new tools and remote methods of collecting data about students. Though the benefits of such tools are significant, there is the potential for unethical and unlawful use of the technology.
FERPA and the Pandemic
The Family Educational Rights and Privacy Act (FERPA) protects personally identifiable information contained in student records generated by an educational institution. Student records are sacrosanct and must be protected. This still stands even in uncertain times such as during a pandemic. Under FERPA, parents or eligible students who are of age have the right to access, amend, or control the disclosure of any student records maintained by a school or district. When a student becomes of age, the rights to student records transfer from parent to student.
Ordinarily, FERPA prevents an institution from disclosing a student's records without the consent of the student or parental guardian. Parents must provide consent before an educational institution may disclose any personal information from their child's education records. This consent must specify the record that may be disclosed, the purpose of the disclosure, and the identity of the party or class of parties to whom the disclosure may be made. However, there are exceptions.
One of the relevant exceptions is the emergency exception provision of FERPA. This emergency exception doesn't allow for the outright disclosure of all student records. Instead, it permits only those disclosures directly related to an imminent emergency.
Due to the serious nature and danger posed by the outbreak of COVID-19, the effect on education became an ongoing crisis. FERPA permits educational institutions to disclose, without prior written consent, personal information from student educational records to appropriate parties in connection with an emergency. This is allowed if knowledge of that information is necessary to protect the health or safety of a student or other individuals. This is especially relevant in K–12, as younger students have little idea as to the gravity of the situation and often can't effectively take and decipher the results of their own COVID-19 tests. This is not necessarily the case with students in higher education, who can manage their own health and COVID status. Some COVID-19 tests are considered to be education records that directly relate to a student and are maintained by an educational agency or institution.
During the pandemic, schools were forced to keep track of the spread of COVID-19 among the student and staff population to minimize the impact. Though FERPA doesn't permit schools to share student health information and student records, the Department of Education has eased these restrictions to allow for the sharing of vital COVID-19 information. For example, positive test results, immunization and other health records, as well as records on health services provided to students may be disclosed.
Additionally, individual educators found themselves in a situation during the pandemic where they became responsible for disseminating health information about students. Typically, public health officials, trained medical staff, and parents were the responsible parties for making such disclosures. Yet the burden shifted once COVID-19 became a health, education, and information crisis.
This state of affairs became even more precarious when institutions had to draw the line between keeping students' privacy safe and keeping the community informed. In terms of transparency, parents and students have claimed that schools weren't doing enough to disclose the status of infected students. For example, a student who had been consistently attending class may have just disappeared one day. Unknown to other students and staff, this student had been infected with COVID-19. Had there been a proper protocol in place, students sitting adjacent to the infected student would ideally also get tested. However, in this example, since no disclosures were made, those students were not informed. In response to backlash by parents or members of the public, some schools have suggested that their hands are tied by restrictive laws that prevent them from disclosing such student information.
What Are the Options for Schools?
As discussed above, according to FERPA, schools must obtain consent from a parent or an eligible student, unless an exception applies. Amid the COVID-19 pandemic, the ongoing emergency exception to FERPA may apply. According to this exception, if a school discovers an imminent, real threat to the health and safety of a student or other individuals in the institution, and that personal information is needed to protect the health and safety of these individuals, the school has the right to disclose that information to the authorities or appropriate individuals without advance consent. The school is ultimately the one to make this judgment call in determining when and whether to disclose any personal information. If it decides to do so, this is done on a case-by-case basis.
Additionally, this evaluation is done by taking account of all of the circumstances related to the threat. Prior to disclosing any student's personal information, school officials ought to ask whether disclosure is necessary and whether they can disclose the true minimum level of information required to tackle the issue. Considering the complex, evolving nature of COVID-19, this continues to be confusing and difficult to do. Perhaps this is why school administrators are so hesitant to stray from strict compliance to FERPA.
Under some special circumstances, a school can disclose the personal information of a particular student. This is done so others can choose to self-quarantine. The school can choose to obtain the student's consent or that of the student's parent in order to release that information.
Moving Forward
There is no doubt that educators and students alike have cause for concern and may not quite understand the full consequences of the pandemic. The lack of transparency and the newness of the pandemic have left educators scrambling to meet privacy concerns. Educators may not fully understand the underlying privacy rules at play when it comes to a full-blown pandemic. While this is somewhat understandable, it is unfortunate. As we are just now beginning to come out of the fog of the initial onset of COVID-19, we are better able to address some of these concerns.
One worthwhile exercise is to verify a school's policies and procedures to ensure that the school is releasing all possible pandemic-related information that doesn't personally identify students. All in all, schools need to adopt non-intrusive measures to screen students while keeping parents, students, and administrators well informed.
Not only should schools be equipped to warn parents, students, and communities of incidences and outbreaks of COVID-19 at this stage, but schools should be prepared for similar health compromising breaches in the future.