Skip to content
ADVERTISEMENT
Sign In
  • Sections
    • News
    • Advice
    • The Review
  • Topics
    • Data
    • Diversity, Equity, & Inclusion
    • Finance & Operations
    • International
    • Leadership & Governance
    • Teaching & Learning
    • Scholarship & Research
    • Student Success
    • Technology
    • Transitions
    • The Workplace
  • Magazine
    • Current Issue
    • Special Issues
    • Podcast: College Matters from The Chronicle
  • Newsletters
  • Virtual Events
  • Ask Chron
  • Store
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
  • Jobs
    • Find a Job
    • Post a Job
    • Professional Development
    • Career Resources
    • Virtual Career Fair
  • More
  • Sections
    • News
    • Advice
    • The Review
  • Topics
    • Data
    • Diversity, Equity, & Inclusion
    • Finance & Operations
    • International
    • Leadership & Governance
    • Teaching & Learning
    • Scholarship & Research
    • Student Success
    • Technology
    • Transitions
    • The Workplace
  • Magazine
    • Current Issue
    • Special Issues
    • Podcast: College Matters from The Chronicle
  • Newsletters
  • Virtual Events
  • Ask Chron
  • Store
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
  • Jobs
    • Find a Job
    • Post a Job
    • Professional Development
    • Career Resources
    • Virtual Career Fair
    Upcoming Events:
    A Culture of Cybersecurity
    Opportunities in the Hard Sciences
    Career Preparation
Sign In
Student Privacy

What Kinds of Information on Covid-19 Cases Can Colleges Legally Share? Experts Weigh In

By Elin Johnson August 21, 2020
Hand with glove on, holding printed blood sample test result that is positive for Coronavirus.
iStock

Earlier this month, officials at the University of North Carolina at Chapel Hill told the student newspaper that the institution would not share the number of cases in Covid-19 clusters. The reason, they said, was the Family Educational Rights and Privacy Act.

To continue reading for FREE, please sign in.

Sign In

Or subscribe now to read with unlimited access for as low as $10/month.

Don’t have an account? Sign up now.

A free account provides you access to a limited number of free articles each month, plus newsletters, job postings, salary data, and exclusive store discounts.

Sign Up

Earlier this month, officials at the University of North Carolina at Chapel Hill told the student newspaper that the institution would not share the number of cases in Covid-19 clusters. The reason, they said, was the Family Educational Rights and Privacy Act.

Colleges have cited Ferpa, the federal student-privacy law, and, in some cases, even the Health Insurance Portability and Accountability Act (Hipaa) as a rationale for not publishing coronavirus-case numbers or sharing details about infections on campus. The privacy measures have been invoked in the past as a reason colleges would not disclose information about athletes’ injuries and students’ sexual-misconduct cases.

Colleges are withholding information, critics say, that could help members of the community protect themselves.

In the midst of the pandemic, that stance has caused tension in college towns and with faculty members who are demanding transparency. Colleges are withholding information, critics say, that could help members of the community protect themselves.

The Chronicle spoke with two experts on Ferpa who clarified which kinds of information on Covid-19 cases are protected under the law: LeRoy Rooker, a senior fellow at the American Association of Collegiate Registrars and Admissions Officers, who is a former director of the U.S. Department of Education’s Family Policy Compliance Office, and Steven J. McDonald, general counsel at the Rhode Island School of Design. They explained when colleges’ restraint of case data is warranted under the law — and when Ferpa doesn’t apply.

Does Ferpa allow colleges to share with the public the number of Covid-19 cases on campus?

Any kind of education record — broadly defined as anything related to a student and maintained by a college or a party acting for a college — is subject to Ferpa. Institutions can’t disclose student records unless the student consents.

However, there are exceptions to this rule.

“If you’re disclosing generic information — for example, how many Covid cases … then generally you can disclose this kind of information,” Rooker said. That is because general case numbers do not identify individual students.

If the release of case numbers could lead a “reasonable person” to figure out the identities of students who had tested positive, then colleges shouldn’t share that information, Rooker said. But this situation tends to apply only to institutions with small, specific case numbers.

“For Ferpa, people often think it is more restrictive than it really is,” said McDonald, who noted that the regulations for compliance with the law are fairly flexible on health and safety exceptions. “There’s not a huge restraint on giving information to a faculty member or roommate.”

What about Hipaa?

Well, that federal law doesn’t really apply here.

Hipaa, McDonald said, is “not an all-purpose medical-confidentiality statute.” Colleges are generally not health-care providers, and even student-health services fall under the umbrella of Ferpa, not Hipaa. In most college health settings, Ferpa applies to care provided to students, and Hipaa applies to care provided to nonstudents.

Colleges should verse themselves on their state’s confidentiality laws before publishing details of Covid-19 cases.

But there are other restrictions on the disclosure of information. Every state has its own medical-confidentiality laws that apply to colleges. Most states base such laws on Hipaa: Any individually identifying information about a patient not authorized for release without consent requires such consent to be disclosed. Colleges should verse themselves on their state’s confidentiality laws before publishing details of Covid-19 cases.

States’ confidentiality laws are more restrictive, McDonald said, whereas Ferpa allows information to be shared more on a “need-to-know [basis] from a health perspective.”

ADVERTISEMENT

How can a college share infection numbers without identifying students?

McDonald said it would be fine to release statistical information if all personally identifiable language had been stripped out of it. To do so, institutions would omit anything a reasonable person could use to figure out whom the information concerned.

“When things are being de-identified, sometimes you have to be pretty broad,” McDonald said. With statistical identifiers, avoid information that contains demographics, which can be legally risky, especially on a smaller campus.

If you have a big enough pool of students, revealing how many have been tested and how many were positive won’t violate Ferpa.

ADVERTISEMENT

McDonald suggested looking at each batch of information, before publication, to make sure it wouldn’t identify anyone.

When it comes to identifying which residence halls have outbreaks, McDonald said, colleges should consider how many people live in each hall, and how easy it would be to pinpoint anyone.

Under what circumstances can a college legally share the identities of students who tested positive?

Both McDonald and Rooker agreed it’s best not to use names when publishing case numbers.

ADVERTISEMENT

In some cases, roommates or residence-hall neighbors may need to be notified that a student among them had tested positive. Notifying a roommate would, through the process of elimination, identify the infected student. But because roommates or neighbors are appropriate parties with whom to share identifying information under Ferpa, Rooker said, “then disclosing that information could be a possibility.”

Can colleges tell instructors if a student in their class tested positive for Covid-19?

Earlier this month, the president of Boston University told faculty members that they would not be informed if a student in one of their classes had tested positive for Covid-19. The university later clarified that it had not finalized this decision.

Ferpa does not prevent an institution from telling instructors which students in their classes have tested positive, Rooker said, because the “school official” exception to the law applies. That exception permits disclosures to officials at a college who have a legitimate educational interest in access to a student’s records.

Rooker said it’s legitimate for an instructor to know what’s going on for his or her safety and for that of the other students in class. Ferpa would permit the disclosure of the student’s name to a faculty member who taught the student, Rooker explained, but state privacy laws could prohibit it. “State law, if not in conflict with Ferpa, would prevail,” Rooker said.

We welcome your thoughts and questions about this article. Please email the editors or submit a letter for publication.
Tags
Health & Wellness
Share
  • Twitter
  • LinkedIn
  • Facebook
  • Email
About the Author
Elin Johnson
Elin Johnson is an editorial intern at The Chronicle. She covers faculty and student affairs.
ADVERTISEMENT
ADVERTISEMENT

More News

Harvard University
'Deeply Unsettling'
Harvard’s Battle With Trump Escalates as Research Money Is Suddenly Canceled
Photo-based illustration of a hand and a magnifying glass focusing on a scene from Western Carolina Universiy
Equal Opportunity
The Trump Administration Widens Its Scrutiny of Colleges, With Help From the Internet
Santa J. Ono, president of the University of Michigan, watches a basketball game on the campus in November 2022.
'He Is a Chameleon'
At U. of Michigan, Frustrations Grew Over a President Who Couldn’t Be Pinned Down
Photo-based illustration of University of Michigan's president Jeremy Santa Ono emerging from a red shape of Florida
Leadership
A Major College-President Transition Is Defined by an About-Face on DEI

From The Review

Illustration showing a valedictorian speaker who's tassel is a vintage microphone
The Review | Opinion
A Graduation Speaker Gets Canceled
By Corey Robin
Illustration showing a stack of coins and a university building falling over
The Review | Opinion
Here’s What Congress’s Endowment-Tax Plan Might Cost Your College
By Phillip Levine
Photo-based illustration of a college building under an upside down baby crib
The Review | Opinion
Colleges Must Stop Infantilizing Everyone
By Gregory Conti

Upcoming Events

Ascendium_06-10-25_Plain.png
Views on College and Alternative Pathways
Coursera_06-17-25_Plain.png
AI and Microcredentials
  • Explore Content
    • Latest News
    • Newsletters
    • Letters
    • Free Reports and Guides
    • Professional Development
    • Virtual Events
    • Chronicle Store
    • Chronicle Intelligence
    • Jobs in Higher Education
    • Post a Job
  • Know The Chronicle
    • About Us
    • Vision, Mission, Values
    • DEI at The Chronicle
    • Write for Us
    • Work at The Chronicle
    • Our Reporting Process
    • Advertise With Us
    • Brand Studio
    • Accessibility Statement
  • Account and Access
    • Manage Your Account
    • Manage Newsletters
    • Individual Subscriptions
    • Group and Institutional Access
    • Subscription & Account FAQ
  • Get Support
    • Contact Us
    • Reprints & Permissions
    • User Agreement
    • Terms and Conditions
    • Privacy Policy
    • California Privacy Policy
    • Do Not Sell My Personal Information
1255 23rd Street, N.W. Washington, D.C. 20037
© 2025 The Chronicle of Higher Education
The Chronicle of Higher Education is academe’s most trusted resource for independent journalism, career development, and forward-looking intelligence. Our readers lead, teach, learn, and innovate with insights from The Chronicle.
Follow Us
  • twitter
  • instagram
  • youtube
  • facebook
  • linkedin