Educational institutions, like private employers, have an obligation to provide a safe and healthy workplace.  To this end, when a district learns that an employee has been diagnosed with Coronavirus (“COVID-19”), the district must notify fellow employees of the potential exposure.  But how does a district balance health and safety with individual confidentiality?  What if the affected individual is a student?

The general rule of thumb is that an educational institution can disclose the fact of a positive COVID-19 diagnosis but should refrain from disclosing the name of the affected individual—regardless of whether that individual is a student or employee.

Despite the involvement of medical records, the Family Educational Rights and Privacy Act (“FERPA”), rather than the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), is controlling here.

HIPAA:

In most cases, the HIPAA Privacy Rule does not apply to public schools because the school is either: (1) not a HIPAA covered entity, or (2) a HIPAA-covered entity but maintains health information only on students in records that are by definition “education records” under FERPA and, therefore, not subject to the HIPAA Privacy Rule.

The HIPAA Privacy Rule only applies to health plans, health care clearinghouses, and those health care providers that transmit health information electronically in connection with certain administrative and financial transactions. (45 CFR § 160.102.)  Thus, even though a school employs school nurses, physicians, psychologists, or other health care providers, the school is not generally a HIPAA covered entity because the providers do not engage in covered transactions, such as billing a health plan electronically for medical services. (https://www.hhs.gov/hipaa/for-professionals/faq/513/does-hipaa-apply-to-an-elementary-school/index.html.)

However, if the school employs a health care provider that conducts medical transactions electronically, such as, transmitting health care claims to a health plan for payment, the school is a HIPAA-covered entity and must comply with the HIPAA confidentiality regulations with respect to such transactions.

Note that student health information obtained by a school is considered an “education record” and therefore confidential under FERPA.

 FERPA:

FERPA prohibits educational institutions from disclosing personally identifiable information (“PII”) from student education records without prior written consent.  (20 U.S.C. §§ 1232g(b)(1) and (b)(2); 34 C.F.R. §§ 99.30 and 99.31.)  There is, however, a relevant exception to this rule called the “health or safety emergency” exception.  (20 U.S.C. § 1232g(b)(1)(I); 34 C.F.R. §§ 99.31(a)(10) and 99.36.)

Under this exception, school districts may disclose student PII to a public health agency or other “appropriate party” without prior written consent, if the information is necessary to protect the health or safety of students or other individuals.  This “health or safety emergency” exception to FERPA's general consent requirement is limited in time to the period of the emergency and does not allow for a blanket release of PII from student education records.  This exception may be utilized on a case-by-case basis if the District determines, based on the totality of the circumstances, that the articulable and significant threat outweighs the need for student confidentiality.

Under this limited exception, information may be disclosed only to a public health agency, or other “appropriate party.” “Appropriate parties” include law enforcement officials, public health officials, trained medical personnel, and parents, whose knowledge of the information is necessary to protect the health and safety of students and other individuals.  The media is not an appropriate party.

While FERPA applies to student educational records and not employment records, Districts should also refrain from disclosing the names of employees with positive COVID-19 test results, per the Americans with Disabilities Act.

Should you have questions about student or employee confidentiality during the COVID-19 pandemic, please feel free to contact our office.  Our attorneys are working remotely and are available to assist you during this unprecedented time.

Resources:

• February 2020 Office for Civil Rights, U.S. Department of Health and Human Services BULLETIN: HIPAA Privacy and Novel Coronavirus: https://www.hhs.gov/sites/default/files/february-2020-hipaa-and-novel-coronavirus.pdf
• S. Department of Health & Human Services: FERPA and HIPAA: https://www.hhs.gov/hipaa/for-professionals/faq/ferpa-and-hipaa/index.html
  • 10 articles related to school districts
• March 2020 Student Privacy Policy Office, U.S. Department of Education FERPA & Coronavirus Disease 2019 (COVID-19) Frequently Asked Questions: https://studentprivacy.ed.gov/sites/default/files/resource_document/file/FERPA%20and%20Coronavirus%20Frequently%20Asked%20Questions_0.pdf