Published by MOASBO, October 2010
Release of Personally Identifiable Student Information in the Face of an Emergency
The chance of a man-made or natural emergency occurring at your school is slight. However, it is imperative to take steps now to be prepared to respond to large-scale emergency situations. While emergency planning is a large task involving many layers of preparation, as a part of that planning, school officials should become familiar with the law regarding the disclosure of personally identifiable student information in emergency situations.
In general, the Family Educational Rights and Privacy Act (FERPA) prohibits school districts from disclosing personally identifiable information from student educational records without the consent of a parent or eligible student unless an exception to FERPA’s consent rule applies. Late this summer, the United States Department of Education’s Family Policy Compliance Office issued guidance with respect to the disclosure of protected student information without consent in the face of emergencies and disasters.
School officials are permitted under FERPA to release information from a student’s educational record without consent to school officials with a legitimate educational interest. 34 C.F.R. § 99.31. However, in times of emergency, there may be medical professionals and volunteers on the scene providing aid to students and staff. To what extent can school officials provide protected student information to these non-school personnel? While FERPA has had a “health or safety” exception in the past under which school officials could disclose education records or personally identifiable student information without parental consent in the event of an emergency, the exception was strictly construed, thus making school officials hesitant and unsure of how to utilize the exception. However, in response to the Virginia Tech shootings in 2007, FERPA exceptions were expanded and the updated federal regulations removed the strict construction of the health and safety exception to give school officials more discretion in deciding when it is necessary to disclose student information in the face of an emergency. A few months ago, the Department of Education’s Family Policy Compliance Office issued updated guidelines to provide additional assistance on interpreting and explaining the expanded FERPA regulations regarding emergencies and natural disasters. (See guidance at http://www2.ed.gov/policy/gen/guid/fpco/pdf/ferpa-disaster-guidance.pdf).
The updated FERPA guidelines note that school officials may disclose, without consent, education records, or personally identifiable information from education records, to appropriate parties in connection with an emergency, if knowledge of that information is necessary to protect the health or safety of a student or other individuals. 34 C.F.R. § 99.31(a)(10) and § 99.36. This exception applies “in connection with an emergency,” which means, “related to the threat of an actual, impending, or imminent emergency, such as a natural disaster, a terrorist attack, a campus shooting, or the outbreak of an epidemic disease.” See guidance p. 6. School officials are tasked with making the determination on a case-by-case basis, in connection with an emergency, and taking into account the totality of the circumstances, whether release of information is necessary to protect the health or safety of a student or other individuals. If the school official determines that there is an articulable and significant threat to the health or safety of a student or others, and release of personally identifiable information regarding a student is necessary to protect the health or safety of the student or other individuals, it may disclose that information to an appropriate party without consent. 34 C.F.R. § 99.36.
So, who is an “appropriate party” under FERPA? The Department of Education has identified law enforcement officials, public health officials, trained medical personnel, and parents as the types of parties to whom information may be disclosed under this FERPA exception. Be mindful when speaking to reporters or media following emergency situations as it is assumed they are not “appropriate parties” under this exception and it is important to protect confidential student information from those who do not have a legitimate need for the information.
It is important to note that this exception to FERPA’s consent requirement is limited to the period of the emergency and does not allow for a blanket release of personally identifiable information from the student’s educational records. Further, disclosure to address the threat of a possible or eventual disaster is not permissible under this FERPA exception. Also, if you face an emergency situation and you make disclosures under this exception, you must record in the students educational records the articulable and significant threat that formed the basis for the disclosure and the parties to whom information was disclosed. 34 C.F.R. § 99.32 (a)(5). This record must be maintained with the educational records of each student as long as the records are maintained. 34 C.F.R. § 99.32.
In summary, the Department of Education has adopted a more flexible standard for the release of student information in emergency situations. A school official has the discretion to decide in connection with an emergency, if the revelation of personally identifiable student information is necessary to protect the health or safety of students or other individuals. By reviewing Department of Education guidance on this subject and becoming familiar with and incorporating FERPA regulations into your emergency plans, you and your school officials will not hesitate in the face of an emergency to do what is necessary to protect your students and staff members.
© 2010 Mickes Goldman O’Toole, LLC
