By Attorney Thomas B. Mooney, Neag School of Education, University of Connecticut

The “Legal Mailbag Question of the Week” is a regular feature of the CAS Weekly NewsBlast. We invite readers to submit short, law-related questions of practical concern to school administrators. Each week, we will select a question and publish an answer. While these answers cannot be considered formal legal advice, they may be of help to you and your colleagues. We may edit your questions, and we will not identify the authors.

Please submit your questions to: legalmailbagcasciacorg.
 
 

 
Dear Legal Mailbag:

Thank you for all of the valuable information you provide each week. I have worked as a school secretary for the past 18 years, and your weekly emails have inspired me to educate myself further on many of these topics.

One topic I have been wanting to find more accurate information about is in regards to HIPAA and FERPA and how these laws specifically apply during this COVID pandemic. Such as: do teachers/staff have a right to know when a student in their class has COVID? Or has been exposed? Also, in general how does HIPAA apply to school heath records?

Signed,
Intellectually Curious
 

Dear Curious:

Thank you for your kind words. Legal Mailbag appreciates all questions from readers, and your question is certainly of interest to many.

In answering your question, let’s start with a brief description of FERPA and HIPAA. FERPA, the Family Educational Rights and Privacy Act, provides that, with limited exceptions, schools that receive federal funds must maintain as confidential any personally-identifiable information in student records. Indeed, under FERPA school employees and other school officials should not access such confidential student information unless there is an educational need for that person to know the information. By contrast, HIPAA, the Health Insurance Portability and Accessibility Act, is a federal statute of more general application. HIPAA requires that covered entities, including health care providers, maintain the confidentiality of individually-identifiable health information and that they provide access to such information to patients upon request.

School districts are not subject to HIPAA requirements unless they are a “health care provider,” which is the case when a school district provides health care to students in the normal course of business. Moreover, such school districts are a “covered entity” under HIPAA only if they conduct any covered transactions electronically in connection with that health care. Status as a “covered entity” imposes certain administrative requirements on school districts, but these obligations do not extend to student records. HIPAA exempts from its requirements records that are covered by FERPA, which includes any personally-identifiable student information about health or treatment, because FERPA already requires that these records be maintained as confidential. As school employees deal with such records, therefore, compliance with FERPA requirements is generally sufficient. A good description of this interplay between FERPA and HIPAA may be found here: Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to Student Health Records (United States Department of Education, November 2008).

As to your second question, school officials must be cautious about sharing information about students and COVID with teachers and other staff members. Status of a student as COVID-19 positive is, of course, personally-identifiable student information that one cannot release without an exemption under FERPA.

There is a special provision in the FERPA regulations that addresses this situation. 34 C.F.R. § 99.31(10) provides that school officials may release personally-identifiable student information in a “health or safety emergency.” 34 C.F.R. § 99.36 elaborates on this provision, stating in relevant part that:

(a) An educational agency or institution may disclose personally identifiable information from an education record to appropriate parties, including parents of an eligible student, in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals. (Emphasis added).

Thus, if school officials learn that a student has tested positive for COVID-19, they may disclose that information to the appropriate public health officials, and in consultation with those officials, the school district must take appropriate remedial measures, such as quarantining of those exposed and additional cleaning. However, that information may be shared with teachers and others only when necessary. Often it is adequate simply to adopt remedial measures without identifying the infected student by name. While teachers, students, parents and others may try to guess the identity of the student who tested positive, generally a related order of quarantine should simply inform the person that he or she was exposed, and not disclose the identity of the student or students who tested positive. Public health officials will provide the appropriate protocol for such situations.