"Neither FERPA or HIPAA prevents schools from sharing non-identifiable information with the media and the general public"

 

“…Legal experts and government transparency advocates say schools, as a whole, have a long track record of abusing privacy laws to keep information secret and force the public to enter costly lawsuits to gain access to records. Justin Silverman, who leads the New England First Amendment Coalition, said several states also had cited HIPAA as a reason for withholding coronavirus case counts at nursing homes, although many later reversed course and released that information.

“Although there’s a fine balance between the public’s right to know and personal privacy, many health experts said clear and consistent disclosure of even basic case numbers is essential for sound decision-making. 

“Dr. Nathaniel Beers, who serves on the American Academy of Pediatrics Council on School Health, suggested school districts should have a tiered communication approach: providing the most detailed information to people with direct exposure; a more generic notification with health screening guidance for others in the school; and basic information on case counts and response for the general community. ‘For schools to be open, you need staff to feel like safety is first. You need students, [teachers and staff] and parents to feel safety is first. You need the broader community to feel like the school is taking care of business and not putting everyone else in harm’s way,’ said Beers, who also is president of the HSC Health Care System in Washington, D.C. ‘That’s where the broader communication is really critical.’ 

“Standing guidance from the U.S. Department of Health and Human Services says that HIPAA does not apply to elementary and secondary schools. 

“In particular, the agency notes they are ‘not a HIPAA covered entity,’ which means they do not provide health care services reimbursed by Medicare or Medicaid. Even if they did, the school would maintain the details in education records that are separately protected by FERPA, the Family Educational Rights and Privacy Act. 

“But even FERPA does not bar schools from releasing details about coronavirus cases, the U.S. Department of Education said in its own guidance in March. Schools can provide basic information to parents [teachers and staff] as long as it doesn't identify specific students.

“The education agency also said the need to act on a health emergency might outweigh personal privacy in some cases. As an example, the memo said schools might need to share identifiable information, including the affected person’s name, with members of a wrestling team if someone on the squad contracted COVID-19. ‘In these limited situations, parents and eligible students may need to be aware of this information in order to take appropriate precautions or other actions to ensure the health or safety of their child or themselves,’ wrote the agency. Neither HIPAA or FERPA bars schools from releasing such information about school employees. 

“Attorney Frank LoMonte, who has defended student rights to free speech and public records for decades, lauded parts of the federal guidance as an appropriate balance between personal privacy and the public’s right to know how their governments are making decisions. ‘It's totally proper for schools to be telling parents the number of cases,’ said LoMonte, who also leads The Brechner Center for Freedom of Information at the University of Florida, ‘and even, in exceptional cases, to reveal details about the individual afflicted student if there has been close physical contact, if that information is necessary for the health of others.’

“The memo noted that schools should not share personally identifiable information with the media, but LoMonte noted that neither FERPA or HIPAA prevents schools from sharing non-identifiable information with the media and the general public. He worried that school leaders might be confused on that fact because it was not specifically stated in the agency’s guidance. ‘That was a very poor choice that is only going to foster more confusion,’ he said, ‘but it's totally consistent with the Department's decades of disregard for public oversight of schools’” (Despite federal guidance, schools cite privacy laws to withhold info about COVID-19 cases, USA Today, August 9, 2020).

 

From the Illinois State Board of Education

…Communication and Reporting

41. Are schools required to report information to the local health department including cases, type and onset of symptoms, number of exposed persons, etc.?

Yes – schools must cooperate with the LHD to provide relevant information needed for mitigating the spread of COVID-19 infection and must be reported to the LHD for use in surveillance and contacting tracing public health activities. Schools must be aware of records and confidentiality laws pertaining to school student records, including exceptions to release of information in the event of an emergency, and requirements to notify parents and create a record of emergency releases of information. (105 ILCS 10/6(a)(7); 23 Il. Admin. Code 375.60).

42. Is there a template letter for schools to use when notifying parents/guardians, students, and staff of a case of COVID-19?

Yes, a template letter can be found here: https://www.isbe.net/_layouts/Download.aspx?SourceUrl=/Documents/Case-School-sampleletter.docx.

43. Is it a Family Educational Rights and Privacy Act (FERPA) violation to notify the LHD/IDPH or staff and parents of a confirmed or probable case(s) in our school?

No – a laboratory confirmed case of COVID-19 is reportable within 3 hours to the Local Health Department per the Communicable Disease Code. Identifiable information on a student or staff member including name and contact information, is reportable to IDPH or to the local public health authority for any notifiable disease or condition. Schools must be aware of records and confidentiality laws pertaining to school student records, including exceptions to release of information in the event of an emergency, and requirements to notify parents and create a record of emergency releases of information. (105 ILCS 10/6(a)(7); 23 Il. Admin. Code 375.60).

44. Does contact tracing violate the Health Insurance Portability and Accountability Act (HIPAA)?

No. The HIPAA Privacy Rule allows for reporting by covered entities to public health for the purpose of preventing the spread of infectious diseases. HIPAA recognizes the legitimate need for public health authorities, and others responsible for ensuring public health and safety, to have access to protected health information to carry out their public health mission 4.

46. Besides public health authorities, who should be notified of a case of COVID-19 at our school? Must we notify the entire district, or only the classroom or the building?

Communication of a confirmed or probable case of COVID-19 to the district and school community should align with the school’s policy for notification of cases of communicable diseases. The communication message should counter potential stigma and discrimination. In such a circumstance, it is critical to maintain confidentiality of the student or staff member as required by the Americans with Disabilities Act, the Family Education Rights and Privacy Act, and the Illinois School Student Records Act… (https://www.isbe.net/Documents/IDPH-School-FAQs.pdf).