Confidentiality of Pupil Information: Unique Issues Presented by the Continuing PandemicBy Attorney Malina Piontek October 20, 2021 Over the past 18 months, the Covid-19 pandemic presented a host of new issues for school principals to grapple with in real time as schools closed and reopened, masks were required and then not, and viable vaccines became widely available. This Update Article is designed to remind school leaders about pupil confidentiality in the context of the latest issues relating to Covid 19. STUDENT PRIVACY LAWS The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy and confidentiality of pupil records and information. Wisconsin has a similar law which is Wis. Stat. § 118.125. Both laws require that school districts provide parents/guardians (or eligible students aged 18+) the opportunity to inspect and review pupil records. In addition, the laws also require that pupil records be maintained confidentially. In order to release pupil records or personally identifiable information, either the parent or legal guardian or eligible student must provide a written consent or authorization for the disclosure of the records or information, with limited exceptions (such as the transfer of records when a student enrolls in a new school). Neither FERPA nor Wisconsin state law permit for the disclosure of pupil records or information with a verbal authorization or consent. Wisconsin law defines “pupil records” to include all records relating to individual pupils maintained by a school. Pupil records do not include notes and other records kept by teachers and other licensed school personnel if those notes are not made available to others. The definition also excludes records necessary for the psychological treatment of a student, if those records are available only to personnel involved in the student’s treatment. Under FERPA, “education records” is defined, with certain exceptions, as those records that are: (1) directly related to a student; and (2) maintained by an educational agency or institution, or by a party acting for the agency or institution. Accordingly, immunization and other health records which are directly related to a student and maintained by a school are “education records” under FERPA. “Personally identifiable information (PII)” refers to students’ names or identification numbers, as well as other information that can be used to distinguish or trace an individual’s identity either directly or indirectly through linkages with other information. Students’ health records maintained by a school—regardless of whether health care is provided to students on-campus or off-site—are considered part of students’ education records and therefore are subject to FERPA. Schools can disclose FERPA-protected information only after obtaining consent from either a parent or the eligible student unless an exception to FERPA’s general consent rule applies. In the case of COVID-19, the most applicable exception to consent is FERPA’s health or safety emergency exception. According to FERPA’s health or safety emergency exception, if a school determines that there is an articulable and significant threat to the health or safety of a student or other individuals and that someone needs PII from education records to protect the student’s or other individuals’ health or safety, the school may disclose that information to the people who need to know it without first obtaining the student’s or parent’s consent. The school is responsible for determining whether to disclose PII on a case-by-case basis by considering all of the circumstances related to the threat. Before disclosing PII, administrators should ask whether that disclosure is necessary and, if so, should disclose only the minimum amount of information required to address the issue at hand. Given the current state of the pandemic, it is hard to imagine a situation in which a school would need to disclose Covid-related health information about a student to protect the health or safety of another student or individual. As we have traversed the iterations of Covid issues, we have learned over the course of the last 18 months that FERPA is not implicated when schools disclose that a student may have COVID-19 as long as the school does not directly or indirectly identify that student. Most of the time, in order to receive sufficient notification of risks to their children, parents do not need to know which student was or may be infected, even if they would like to know. SCENARIOS Parents have been increasingly demanding in their requests for information from their schools when their children are subject to Covid-19 procedures, such as contact tracing or quarantining following a close contact, as exemplified by the following scenarios. 1. May a parent be provided with surveillance video showing whether their child is actually in close contact with another child? Most likely, no. In this situation, you will want to determine whether any such video exists. If it does, it may be a public record, as under the public records law, a “record” is defined as “any material on which written, drawn, printed, spoken, visual, or electromagnetic information or electronically generated or stored data is recorded or preserved, regardless of physical form or characteristics, which has been created or is being kept by an authority.” To constitute a “record,” the document must be created or kept in connection with an official purpose or function of the agency. The content of the document determines whether the document is a “record,” not the medium, format, or location. Arguably, ordinary surveillance video is not created or kept with an official purpose or function of the governmental agency. Indeed, some districts have a policy specifically excluding ordinary surveillance video which does not depict an emergency from disclosure to anyone. Under FERPA, images of students captured on surveillance recordings qualify as education records when photo or video is directly related to a student and maintained by the educational institution. Whether a recording is directly related to a student is a context-specific determination considering the following factors:
A recording will not be considered directly related to a student when a student’s image is simply incidental to the activity depicted in the recording (e.g., window dressing or background) or when a student is shown participating in school activities open to the public and the recording does not focus on any specific focus student. In this scenario, the parent is asking for surveillance video that would identify the student who tested positive for Covid. As such, the information may not be disclosed without parental consent of the student who tested positive. 2. Do I have to grant a parent’s request for a diagram drawn to scale of the room in which their student was in close contact with a Covid-positive student? No, you are not required by the public records law or FERPA (and Wisconsin’s counterpart) to create records upon the request or demand of a parent. If you use a general diagram to determine classroom spacing, that is likely a public record subject to disclosure. If the diagram includes pupil names, best practice is to redact the names of the other students prior to giving the diagram to the parent. 3. Do I have to disclose to a parent the room where the close contact occurred? Probably not. If the classroom in which the close contact occured is sufficiently large, like an auditorium or large lecture hall, revealing the room to the parent likely will not disclose PII about other students. On the other hand, if it occurred in a small AP chemistry lab, it is likely that disclosing the room will result in revealing other information that the parent can use to distinguish or trace the Covid-positive student’s identity either directly or indirectly through linkages with the other information. 4. Do I have to provide a parent with an exact timeline of when the close contact occurred? Similar to question 2 above, you are not required to create records in response to parent requests or demands for same. If you generally keep some sort of chronological timeline for those days on which a Covid-positive student is on premises and came in close contact with others, that may be both a pupil and a public record depending on the information created and maintained in the timeline. If student names are included that identify the Covid-positive student and those with whom they came in close contact, the document is very likely a pupil record that cannot be released without parental consent. 5. Last year, student had an alternative living arrangement during virtual learning due to parent work schedules. The adults providing care became very involved with the student’s learning, and are contacting staff this year to see how they’re doing. Can we respond? Probably not without written authorization from the student’s parent/guardian that is effective for this year. Best practice would be to remind staff about the requirements of pupil confidentiality and who has access to student information and records, in order to prevent staff from inadvertently, albeit well-intentioned, disclosing confidential pupil information to people who are not currently authorized to access that information. Understandably, you and your staff do not want to discourage someone who clearly cares about a student from actively engaging in their education. It is best to remind the non-parent that you cannot share information without the parent or guardian’s current authorization and help them obtain that authorization. Here is an example of a form that is being used to address these situations. 6. We are seeing an increase in the number of students dealing with trauma due to Covid. What information can the school share with outsiders who are treating or caring for our student? As set forth above, a parent may give permission for you to provide information to an outside agency that is treating or assisting the student. This may include a community partner, daycare provider, attorney, Guardian ad Litem, medical provider, clinic, counsellor or therapist. Again, written authorization from the parent is required prior to sharing information with outside agencies. On a related note, many school districts have experienced or are experiencing an increase in student absence associated with medical appointments during the school day, or therapists who want to see their student-patients virtually during the school day. Parents of students with frequent or standing medical appointments should be reminded of your attendance policy, especially that absences beyond 10 full or partial days could lead to the truancy process, regardless of the fact that there is a medical appointment. Conclusion Covid continues to throw thorny issues at principals of all levels. It is important to keep student confidentiality in mind when faced with parent questions about Covid protocols, or who just want to get more information than they are entitled to. You should work with your district administrator and/or district legal counsel any time you have questions as to whether or not you may share information with parents or other agencies. This article was prepared by Attorney Malina Piontek, AWSA’s Level I Legal Services Provider. You may direct your Level I call-in questions to Malina at 608-497-3037 or email her at [email protected]. This article was designed to provide you with general authoritative information and commentary as a service to AWSA members. The materials and information provided in this article are subject to change without notice and should not be construed as legal advice. If needed, legal advice regarding any topic, issue, situation or incident should be obtained from the school district's legal counsel.
Read more at:
|