Minding FERPA during COVID-19

Here at REGucation, we deeply appreciate that this is not an easy time for the higher education administrators of the world. The phone calls, emails and meeting invites are unending. As are the webinars, electronic announcements and other forms of guidance emanating from the U.S. Department Education (and other agencies). In an effort to respond to COVID-19, and to keep pace with the constantly changing regulatory environment, institutions of higher education are undertaking unprecedented operational changes, and doing so at lightning speed.

Of course, with such changes come new challenges, including some that may not be recognized right away. With this in mind, we are focusing here on compliance with the Family Educational Rights and Privacy Act (FERPA). If you have not already done so, it is important to take a moment to consider whether the changes that have occurred on your campus have given rise to new student privacy matters that need to be addressed.

Online education

One of the most significant operational changes for many institutions has been transitioning on-ground classes online. This shift can be especially difficult when led by faculty members who have little experience teaching remotely or with the related technology.

Class recordings

Depending on the content and use, recorded classroom activity may or may not be subject to FERPA’s limitations and requirements.

If a class recording only includes the instructor, it would not be subject to FERPA as the recording would not contain any student education records. On the other hand, if the recording involves student discussions, questions, presentations or other student activities, such student participation may be protected and its disclosure limited by FERPA. If students will appear or be heard in the recordings, institutions can remain FERPA compliant by using the recordings:

1. With the written consent of the student(s) identified on the recording (such consent must be informed and voluntarily);
2. If the recording is edited to omit the voice, likeness or other personally identifying information of any student who has not provided written consent; or
3. Without limitation if access to the recording is limited to the other students in the class.

Prior to recording any class, instructors should consider providing students with notice, both orally and in the syllabus, that a recording of the class is being made. They should also describe the purpose of the recording and who may be viewing it. This notice could also inform students about any applicable intellectual property rights to the recordings, the lectures or the course materials, and any prohibition on sharing or copying the recording. Additionally, institutions need to consider whether there are any state or local laws that address recordings of others.

To assist institutions in the transition online, in March 2020, the Department of Education’s Student Privacy Policy Office issued FERPA and Virtual Learning Resources and a FERPA and Virtual Learning Webinar. We recommend taking advantage of these resources.

Use of technology

Many institutions may have contracted with a third-party platform provider to assist them with offering the school’s classes online. Student personally identifiable information may be disclosed during online classes, and thus accessible to the vendor. The school also may need to provide certain education records to the vendor in order to facilitate students’ access to and use of the platform.

FERPA generally permits disclosure of education records to technology vendors without consent under the “school official exception.” According to 34 CFR §99.31(a)(i)(B), a technology vendor may be considered a school official for the purposes of FERPA if the vendor:

1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records; and 
3. Is subject to the requirements of § 99.33(a) governing the use and redisclosure of personally identifiable information from education records.

While FERPA does not require an institution to enter into an agreement with the vendor to take advantage of the “school official exception,” a written agreement or contract is a best practice so all parties understand and appreciate their respective rights and obligations. The Privacy Technical Assistance Center has also created Model Terms of Service to help institutions draft and evaluate terms with technology vendors.

Health or safety emergency exception

During this period of disruption and change, institutions also may determine that they need to disclose personally identifying information from a student’s education record in order to effectively manage an emergency situation. FERPA does permit such disclosure without written consent if it is indeed in connection with a health or safety emergency. 34 CFR § 99.31(a)(10).

Pursuant to this exception, the disclosure must be made to appropriate parties “in connection with an emergency if knowledge of that information is necessary to protect the health or safety of the student or other individuals.” 34 CFR § 99.36(a). In making its determination, the institution “may take into account the totality of the circumstances pertaining to a threat to the health or safety of a student or other individuals.” 34 CFR § 99.36(c).

The Student Privacy Policy Office’s March 2020 FERPA and Coronavirus Disease 2019 Frequently Asked Questions explains how the Department of Education will interpret the health or safety emergency exception in the context of COVID-19. Of note, the FAQs explain that institutions can often address threats to health and safety in a manner that does not identify a particular student, but that COVID-19 could present a situation in which disclosure under the health or safety exception is appropriate. The exception is limited in time to the period of the emergency and does not allow for a blanket release of personally identifiable information. Appropriate parties for the disclosure typically include law enforcement officials, public health officials, trained medical personnel and parents, but an appropriate party does not include the media.

Institutions should consider, to the extent possible, presenting information about COVID-19 in a way that does not personally identify the student. However, if personally identifying information must be disclosed without consent to protect the health or safety of the student or others, institutions may do so, keeping in mind that they should create a contemporaneous record explaining the basis for the determination that an articulable and significant threat exists that necessitated the release of such information.

Finally, to the extent that “treatment records” under HIPAA may be involved, see the following Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) To Student Health Records from the Department of Education and the Department of Health and Human Services.

Scott Goldschmidt is the former Deputy General Counsel for a prominent institution of higher education, and a member of the firm’s Higher Education practice.

Click here to subscribe to News & Insights from Thompson Coburn related to our practices as well as the latest on COVID-19 issues.