> Skip to content
FEATURED:
  • The Evolution of Race in Admissions
Sign In
  • News
  • Advice
  • The Review
  • Data
  • Current Issue
  • Virtual Events
  • Store
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
  • Jobs
    • Find a Job
    • Post a Job
    • Career Resources
    • Find a Job
    • Post a Job
    • Career Resources
Sign In
  • News
  • Advice
  • The Review
  • Data
  • Current Issue
  • Virtual Events
  • Store
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
  • Jobs
    • Find a Job
    • Post a Job
    • Career Resources
    • Find a Job
    • Post a Job
    • Career Resources
  • News
  • Advice
  • The Review
  • Data
  • Current Issue
  • Virtual Events
  • Store
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
  • Jobs
    • Find a Job
    • Post a Job
    • Career Resources
    • Find a Job
    • Post a Job
    • Career Resources
Sign In
ADVERTISEMENT
Student Privacy
  • Twitter
  • LinkedIn
  • Show more sharing options
Share
  • Twitter
  • LinkedIn
  • Facebook
  • Email
  • Copy Link URLCopied!
  • Print

What Kinds of Information on Covid-19 Cases Can Colleges Legally Share? Experts Weigh In

By  Elin Johnson
August 21, 2020
Hand with glove on, holding printed blood sample test result that is positive for Coronavirus.
iStock

Earlier this month, officials at the University of North Carolina at Chapel Hill told the student newspaper that the institution would not share the number of cases in Covid-19 clusters. The reason, they said, was the Family Educational Rights and Privacy Act.

Colleges have cited Ferpa, the federal student-privacy law, and, in some cases, even the Health Insurance Portability and Accountability Act (Hipaa) as a rationale for not publishing coronavirus-case numbers or sharing details about infections on campus. The privacy measures have been invoked in the

We’re sorry. Something went wrong.

We are unable to fully display the content of this page.

The most likely cause of this is a content blocker on your computer or network. Please make sure your computer, VPN, or network allows javascript and allows content to be delivered from c950.chronicle.com and chronicle.blueconic.net.

Once javascript and access to those URLs are allowed, please refresh this page. You may then be asked to log in, create an account if you don't already have one, or subscribe.

If you continue to experience issues, contact us at 202-466-1032 or help@chronicle.com

Earlier this month, officials at the University of North Carolina at Chapel Hill told the student newspaper that the institution would not share the number of cases in Covid-19 clusters. The reason, they said, was the Family Educational Rights and Privacy Act.

Colleges have cited Ferpa, the federal student-privacy law, and, in some cases, even the Health Insurance Portability and Accountability Act (Hipaa) as a rationale for not publishing coronavirus-case numbers or sharing details about infections on campus. The privacy measures have been invoked in the past as a reason colleges would not disclose information about athletes’ injuries and students’ sexual-misconduct cases.

Colleges are withholding information, critics say, that could help members of the community protect themselves.

In the midst of the pandemic, that stance has caused tension in college towns and with faculty members who are demanding transparency. Colleges are withholding information, critics say, that could help members of the community protect themselves.

The Chronicle spoke with two experts on Ferpa who clarified which kinds of information on Covid-19 cases are protected under the law: LeRoy Rooker, a senior fellow at the American Association of Collegiate Registrars and Admissions Officers, who is a former director of the U.S. Department of Education’s Family Policy Compliance Office, and Steven J. McDonald, general counsel at the Rhode Island School of Design. They explained when colleges’ restraint of case data is warranted under the law — and when Ferpa doesn’t apply.

ADVERTISEMENT

Does Ferpa allow colleges to share with the public the number of Covid-19 cases on campus?

Any kind of education record — broadly defined as anything related to a student and maintained by a college or a party acting for a college — is subject to Ferpa. Institutions can’t disclose student records unless the student consents.

However, there are exceptions to this rule.

“If you’re disclosing generic information — for example, how many Covid cases … then generally you can disclose this kind of information,” Rooker said. That is because general case numbers do not identify individual students.

If the release of case numbers could lead a “reasonable person” to figure out the identities of students who had tested positive, then colleges shouldn’t share that information, Rooker said. But this situation tends to apply only to institutions with small, specific case numbers.

ADVERTISEMENT

“For Ferpa, people often think it is more restrictive than it really is,” said McDonald, who noted that the regulations for compliance with the law are fairly flexible on health and safety exceptions. “There’s not a huge restraint on giving information to a faculty member or roommate.”

What about Hipaa?

Well, that federal law doesn’t really apply here.

Hipaa, McDonald said, is “not an all-purpose medical-confidentiality statute.” Colleges are generally not health-care providers, and even student-health services fall under the umbrella of Ferpa, not Hipaa. In most college health settings, Ferpa applies to care provided to students, and Hipaa applies to care provided to nonstudents.

Colleges should verse themselves on their state’s confidentiality laws before publishing details of Covid-19 cases.
ADVERTISEMENT

But there are other restrictions on the disclosure of information. Every state has its own medical-confidentiality laws that apply to colleges. Most states base such laws on Hipaa: Any individually identifying information about a patient not authorized for release without consent requires such consent to be disclosed. Colleges should verse themselves on their state’s confidentiality laws before publishing details of Covid-19 cases.

States’ confidentiality laws are more restrictive, McDonald said, whereas Ferpa allows information to be shared more on a “need-to-know [basis] from a health perspective.”

How can a college share infection numbers without identifying students?

McDonald said it would be fine to release statistical information if all personally identifiable language had been stripped out of it. To do so, institutions would omit anything a reasonable person could use to figure out whom the information concerned.

“When things are being de-identified, sometimes you have to be pretty broad,” McDonald said. With statistical identifiers, avoid information that contains demographics, which can be legally risky, especially on a smaller campus.

ADVERTISEMENT

If you have a big enough pool of students, revealing how many have been tested and how many were positive won’t violate Ferpa.

McDonald suggested looking at each batch of information, before publication, to make sure it wouldn’t identify anyone.

When it comes to identifying which residence halls have outbreaks, McDonald said, colleges should consider how many people live in each hall, and how easy it would be to pinpoint anyone.

Under what circumstances can a college legally share the identities of students who tested positive?

Both McDonald and Rooker agreed it’s best not to use names when publishing case numbers.

ADVERTISEMENT

In some cases, roommates or residence-hall neighbors may need to be notified that a student among them had tested positive. Notifying a roommate would, through the process of elimination, identify the infected student. But because roommates or neighbors are appropriate parties with whom to share identifying information under Ferpa, Rooker said, “then disclosing that information could be a possibility.”

Can colleges tell instructors if a student in their class tested positive for Covid-19?

Earlier this month, the president of Boston University told faculty members that they would not be informed if a student in one of their classes had tested positive for Covid-19. The university later clarified that it had not finalized this decision.

Ferpa does not prevent an institution from telling instructors which students in their classes have tested positive, Rooker said, because the “school official” exception to the law applies. That exception permits disclosures to officials at a college who have a legitimate educational interest in access to a student’s records.

Rooker said it’s legitimate for an instructor to know what’s going on for his or her safety and for that of the other students in class. Ferpa would permit the disclosure of the student’s name to a faculty member who taught the student, Rooker explained, but state privacy laws could prohibit it. “State law, if not in conflict with Ferpa, would prevail,” Rooker said.

We welcome your thoughts and questions about this article. Please email the editors or submit a letter for publication.
Health & Wellness
Elin Johnson
Elin Johnson is an editorial intern at The Chronicle. She covers faculty and student affairs.
ADVERTISEMENT
ADVERTISEMENT
  • Explore
    • Get Newsletters
    • Letters
    • Free Reports and Guides
    • Blogs
    • Virtual Events
    • Chronicle Store
    • Find a Job
    Explore
    • Get Newsletters
    • Letters
    • Free Reports and Guides
    • Blogs
    • Virtual Events
    • Chronicle Store
    • Find a Job
  • The Chronicle
    • About Us
    • DEI Commitment Statement
    • Write for Us
    • Talk to Us
    • Work at The Chronicle
    • User Agreement
    • Privacy Policy
    • California Privacy Policy
    • Site Map
    • Accessibility Statement
    The Chronicle
    • About Us
    • DEI Commitment Statement
    • Write for Us
    • Talk to Us
    • Work at The Chronicle
    • User Agreement
    • Privacy Policy
    • California Privacy Policy
    • Site Map
    • Accessibility Statement
  • Customer Assistance
    • Contact Us
    • Advertise With Us
    • Post a Job
    • Advertising Terms and Conditions
    • Reprints & Permissions
    • Do Not Sell My Personal Information
    Customer Assistance
    • Contact Us
    • Advertise With Us
    • Post a Job
    • Advertising Terms and Conditions
    • Reprints & Permissions
    • Do Not Sell My Personal Information
  • Subscribe
    • Individual Subscriptions
    • Institutional Subscriptions
    • Subscription & Account FAQ
    • Manage Newsletters
    • Manage Your Account
    Subscribe
    • Individual Subscriptions
    • Institutional Subscriptions
    • Subscription & Account FAQ
    • Manage Newsletters
    • Manage Your Account
1255 23rd Street, N.W. Washington, D.C. 20037
© 2023 The Chronicle of Higher Education
  • twitter
  • instagram
  • youtube
  • facebook
  • linkedin