Earlier this month, officials at the University of North Carolina at Chapel Hill told the student newspaper that the institution would not share the number of cases in Covid-19 clusters. The reason, they said, was the Family Educational Rights and Privacy Act.
Colleges have cited Ferpa, the federal student-privacy law, and, in some cases, even the Health Insurance Portability and Accountability Act (Hipaa) as a rationale for not publishing coronavirus-case numbers or sharing details about infections on campus. The privacy measures have been invoked in the past as a reason colleges would not disclose information about athletes’ injuries and students’ sexual-misconduct cases.
Colleges are withholding information, critics say, that could help members of the community protect themselves.
In the midst of the pandemic, that stance has caused tension in college towns and with faculty members who are demanding transparency. Colleges are withholding information, critics say, that could help members of the community protect themselves.
The Chronicle spoke with two experts on Ferpa who clarified which kinds of information on Covid-19 cases are protected under the law: LeRoy Rooker, a senior fellow at the American Association of Collegiate Registrars and Admissions Officers, who is a former director of the U.S. Department of Education’s Family Policy Compliance Office, and Steven J. McDonald, general counsel at the Rhode Island School of Design. They explained when colleges’ restraint of case data is warranted under the law — and when Ferpa doesn’t apply.
Does Ferpa allow colleges to share with the public the number of Covid-19 cases on campus?
Any kind of education record — broadly defined as anything related to a student and maintained by a college or a party acting for a college — is subject to Ferpa. Institutions can’t disclose student records unless the student consents.
However, there are exceptions to this rule.
“If you’re disclosing generic information — for example, how many Covid cases … then generally you can disclose this kind of information,” Rooker said. That is because general case numbers do not identify individual students.
If the release of case numbers could lead a “reasonable person” to figure out the identities of students who had tested positive, then colleges shouldn’t share that information, Rooker said. But this situation tends to apply only to institutions with small, specific case numbers.
“For Ferpa, people often think it is more restrictive than it really is,” said McDonald, who noted that the regulations for compliance with the law are fairly flexible on health and safety exceptions. “There’s not a huge restraint on giving information to a faculty member or roommate.”
What about Hipaa?
Well, that federal law doesn’t really apply here.
Hipaa, McDonald said, is “not an all-purpose medical-confidentiality statute.” Colleges are generally not health-care providers, and even student-health services fall under the umbrella of Ferpa, not Hipaa. In most college health settings, Ferpa applies to care provided to students, and Hipaa applies to care provided to nonstudents.
Colleges should verse themselves on their state’s confidentiality laws before publishing details of Covid-19 cases.
But there are other restrictions on the disclosure of information. Every state has its own medical-confidentiality laws that apply to colleges. Most states base such laws on Hipaa: Any individually identifying information about a patient not authorized for release without consent requires such consent to be disclosed. Colleges should verse themselves on their state’s confidentiality laws before publishing details of Covid-19 cases.
States’ confidentiality laws are more restrictive, McDonald said, whereas Ferpa allows information to be shared more on a “need-to-know [basis] from a health perspective.”
How can a college share infection numbers without identifying students?
McDonald said it would be fine to release statistical information if all personally identifiable language had been stripped out of it. To do so, institutions would omit anything a reasonable person could use to figure out whom the information concerned.
“When things are being de-identified, sometimes you have to be pretty broad,” McDonald said. With statistical identifiers, avoid information that contains demographics, which can be legally risky, especially on a smaller campus.
If you have a big enough pool of students, revealing how many have been tested and how many were positive won’t violate Ferpa.
McDonald suggested looking at each batch of information, before publication, to make sure it wouldn’t identify anyone.
When it comes to identifying which residence halls have outbreaks, McDonald said, colleges should consider how many people live in each hall, and how easy it would be to pinpoint anyone.
Under what circumstances can a college legally share the identities of students who tested positive?
Both McDonald and Rooker agreed it’s best not to use names when publishing case numbers.
In some cases, roommates or residence-hall neighbors may need to be notified that a student among them had tested positive. Notifying a roommate would, through the process of elimination, identify the infected student. But because roommates or neighbors are appropriate parties with whom to share identifying information under Ferpa, Rooker said, “then disclosing that information could be a possibility.”
Can colleges tell instructors if a student in their class tested positive for Covid-19?
Earlier this month, the president of Boston University told faculty members that they would not be informed if a student in one of their classes had tested positive for Covid-19. The university later clarified that it had not finalized this decision.
Ferpa does not prevent an institution from telling instructors which students in their classes have tested positive, Rooker said, because the “school official” exception to the law applies. That exception permits disclosures to officials at a college who have a legitimate educational interest in access to a student’s records.
Rooker said it’s legitimate for an instructor to know what’s going on for his or her safety and for that of the other students in class. Ferpa would permit the disclosure of the student’s name to a faculty member who taught the student, Rooker explained, but state privacy laws could prohibit it. “State law, if not in conflict with Ferpa, would prevail,” Rooker said.
