Department of Education Issues New FERPA Guidance
By Randy Geller
On February 12th, the U.S. Department of Education, Privacy Technical Assistance Center, issued a guidance document consisting of 37 commonly asked questions about the application of the Family Educational Rights and Privacy Act of 1974 (“FERPA”). The guidance document focuses on disclosures of information about students to school and campus security units, school resource officers, and law enforcement agencies, and also on disclosures in the event of a health or safety emergency. FERPA applies to educational agencies and institutions, including schools, school districts, private schools, colleges, and universities (collectively, ”educational institutions”) that receive funds under any program administered by the U.S. Department of Education.
The “Health or Safety Emergency” Exception to the Written Consent Requirement
Generally, FERPA requires written consent from a parent or “eligible student” before an educational institution may disclose student education records and the personally identifiable information (“PII”) in them to third parties. However, through its “health or safety emergency” exception, FERPA affords educational institutions some flexibility when responding to circumstances that threaten the health or safety of individuals.
In some situations, administrators may determine that it is necessary to disclose a student’s education records or PII to appropriate parties in order to address a specific and articulable threat of a health or safety emergency. FERPA’s health or safety emergency provision permits such disclosures when they are necessary to protect the health or safety of the student or other individuals. This exception to FERPA’s general consent requirement is limited to the period of the emergency and does not allow for a blanket release of PII from a student’s education records. An appropriate party under the health or safety emergency exception is a party whose knowledge of such information is necessary to protect the health or safety of the student or other persons. Typically, local or state law enforcement officials, public health officials, trained medical personnel, and parents are the types of appropriate parties to whom educational institutions may disclose information under this exception.
Disclosure of Personally Identifiable Information to Law Enforcement Unit Officials
Without regard to the health or safety emergency exception, disclosure to law enforcement unit officials is permissible under certain circumstances. A law enforcement unit official who is an employee of an educational institution generally would be considered a school official to whom education records or PII may be disclosed without consent, if the law enforcement unit official meets the relevant criteria specified in the annual notification of FERPA rights to parents and eligible students. In addition, law enforcement unit officials, such as off-duty police officers and SROs, may be school officials if the educational institution has outsourced the function of providing safety and security for the educational institution to the law enforcement unit officials. However, detailed requirements must be met.
Threat Assessment Teams
Many educational institutions have threat assessment teams who review incidents of threatening behavior by students, parents, employees, or other individuals and, relying on their collective expertise, provide guidance to administrators and others on how to respond to a potential threat. Generally, members of these teams who are employees of the educational institution will be school officials for purposes of receiving education records and PII. In addition, FERPA may permit educational institutions to disclose education records and PII, without consent, to outside law enforcement officials, mental health officials, and other experts in the community who serve on a school’s threat assessment team. However, certain conditions must be met.
Other State and Federal Laws
There are other state and federal laws that should be addressed when disclosure of PII is being considered. For example, at the K-12 level, state educational agencies and local educational agencies must comply with the requirements of Part B of the Individuals with Disabilities Education Act (IDEA) in educating children with disabilities, including IDEA’s confidentiality of information requirements. Further, the disclosure of medical information, even within an educational institution, may be subject to the Health Insurance Portability and Accountability Act (HIPAA) and the physician-patient and psychologist-patient privileges.
Since 1995, I have helped clients address a wide variety of challenging issues at the intersection of education, institutional management, public policy, and the law. With years of experience at two major universities and in private practice, I offer not only legal advice, but also practical advice to help clients manage problems and implement effective solutions. I would be pleased to assist your school with evaluating the potential disclosure of education records and personally identifiable information.
« Back to News & Insights