The pandemic has created an era of uncertainty, especially surrounding the issue of student privacy. Schools now face a constant barrage of questions from administrators, teachers, parents, students and community members requesting information pertaining to COVID-19. Before answering these inquiries, schools must decide what information can be shared, how it can be shared, and with whom any information can be shared in a way that protects the students’ privacy.

The pandemic also has resulted in more and more schools using virtual learning models. This shift requires schools to consider how best to protect students’ privacy during virtual learning.

Addressing these privacy issues often falls to the individual teachers, school administrators, superintendents and local school boards. The U.S. Department of Education has numerous resources designed to assist these decision-makers, even if one isn’t familiar with student privacy law or the Family Educational Rights and Privacy Act. These resources provide guidance to the frequently asked questions that have arisen in the area of COVID-19 and virtual learning.

What exactly is FERPA?

The guiding student privacy law is FERPA, a federal law that protects the privacy of student education records. The law applies to all educational institutions that receive federal funding, including school districts, elementary and secondary public schools, and most post-secondary institutions. Private schools that don’t receive any federal funding are not subject to FERPA. Any school that is covered by FERPA must notify the parents of a student or the student if they are 18 or older of their rights under FERPA.

FERPA gives parents certain rights when it comes to their children’s educational records. This includes health records that are “(1) directly related to a student; and (2) maintained by an educational agency or institution, or by a party acting for the agency or institution.” Accordingly, health and immunization records maintained by a school or other educational institution are covered by FERPA.

Prior to a school sharing personally identifiable information or educational records with a third party, the school must obtain the written consent of a student’s parent or the student’s consent if the student is 18 or older. However, there are general exceptions that can apply, including a health and safety exception that potentially allows schools and educational institutions to be able to share PII and education records, including health records. The records must be shared with “appropriate parties,” which can include local health officials.

Department of Education COVID-19 resources

The DoE has released resources for both educators and parents detailing how to be compliant with FERPA with regards to information sharing and virtual learning.

The DoE maintains an ongoing webpage where it posts guidance and resources to ensure that “states, communities, educators, and families are equipped with resources and flexibilities that empower students to continue pursuing their education goals.” This page provides links to the “ongoing development of guidance and policies related to elementary and secondary education, special education, higher education, and other essential components of lifelong learning.”

Releasing information under FERPA

In March, the DoE created a document detailing and responding to frequently asked questions pertaining to FERPA. As part of this document, the DoE discussed how a school can use the health and safety exceptions to FERPA to release PII and educational records without parental consent. The DoE explained,

“If an educational agency or institution, taking into account the totality of the circumstances, determines that an articulable and significant threat exists to the health or safety of a student in attendance at the agency or institution as a result of the virus that causes COVID-19, it may disclose, without prior written consent, [personally identifiable information] from student education records to appropriate officials at a public health department who need the information to protect the health or safety of the student (or another individual).” 

In April, the DoE updated a model “FERPA Notification of Rights for Elementary and Secondary Schools” that shows exactly how a school can comply with the FERPA notification requirement by providing a “template notice for school districts notifying parents and eligible students (students over 18 years of age or attending a school beyond the high school level) about their rights under [FERPA].”

In September, the DoE wrote a blog post about if and when schools can release information surrounding COVID-19 cases to the public and parents. The blog discussed how a school may disclose without prior written consent the number of students who have been exposed to COVID-19 so long as they do so in a way that does not identify the individuals. The blog post goes on to list other times when it might be appropriate to disclose more identifiable information, generally after the school reaches a determination that the health and safety of the community is impacted. 

Privacy and virtual learning

In March, the DoE created a page populated with links on best practices and other key resources for parents and educators regarding FERPA and virtual learning. This document includes two resources that are part of the DoE’s “Security Best Practices” which discuss how to protect education records. The page also has information on related topics, including “classroom observations, use of emails, videos, and other virtual learning tools.” The DoE advises, “the determination of who can observe a virtual classroom, similar to an in-person classroom, is a local school decision.”

The DoE also recorded a webinar in March discussing the 10 common scenarios regarding FERPA and virtual learning. The webinar was “intended to provide information on privacy best practices and insight into helpful resources available to the education community during this critical time of national emergency.” 

Additionally, the Office of Educational Technology at the DoE released a “Parent and Family Digital Learning Guide” that details good practices for online and remote learning. The guide discusses the benefits of digital learning and gives a brief overview of student privacy. It also discusses how to enable digital learning, including topics, such as ensuring access on personal learning devices and over the internet, ensuring your child’s privacy safety and responsibly technology use, and questions to ask yourself, your child, their teachers and school leaders.

Conclusion

The world of student privacy is an ongoing conversation, especially in the midst of a pandemic. Following the latest student privacy updates from the DoE is one way schools, teachers and parents can ensure the privacy of their student’s education.  

Photo by Jeffrey Hamilton on Unsplash