ith the outbreak of COVID-19 in the United States, and the social distancing and other safety-related restrictions being implemented to contain it, schools throughout the country have almost universally switched to distance or virtual learning. The switch has raised countless questions for parents and school leaders alike.
One critical question is around how the confidentiality of student education records will be maintained as required by law, when schools adopt virtual means to educate their students. The U.S. Department of Education, Student Privacy Policy Office (SPPO), has provided some guidance through its “FERPA & Virtual Learning During COVID-19” webinar, in which it answered common questions related to the COVID-19 pandemic, shared best practices on privacy and security, and provided other useful resources.
Most importantly, the webinar is a reminder to school authorities that the Family Educational Rights and Privacy Act (FERPA), the federal privacy law that applies to educational institutions, remains in force even in these unprecedented circumstances. FERPA protects the rights of parents and eligible students to access and seek amendment to student education records, provide consent before personally identifiable information (PII) from a student’s education records may be disclosed to a third party and to file a complaint. The webinar used a number of scenarios to highlight elements of the law, address related questions and communicate important considerations for situations that may arise. Information regarding some of the scenarios are summarized below.
Can a teacher take home PII from a student’s education records? Generally, FERPA does not prohibit a teacher from taking home PII from a student’s education records as long as the teacher has a legitimate educational interest in the information. However, the teacher may not disclose that information except when otherwise permitted under FERPA and must use reasonable methods to protect the student’s education records.
Can a teacher conduct a teacher-parent/student conference from home when the teacher’s spouse is present? Regarding this second question, germane considerations include how the “conference” will occur, whether it is a phone call, video call, etc., the subject and what precautions will be necessary to protect the student’s information. As long as the teacher does not disclose PII from the student’s education record to the spouse or obtains consent in writing or electronically from the student’s parent for potential disclosure, the conference will not violate FERPA.
Can video conferencing or other virtual learning software apps be used for virtual learning under FERPA?
Though use of video conferencing or other software apps for virtual learning might involve disclosure of a student education record to a third-party provider, it is permitted pursuant to the “school official exception” to the general consent requirement. To do this, the provider must be under the direct control of the school, must have been determined to meet the criteria in the school’s annual notification of FERPA rights for being a “school official with a legitimate educational interest” in the education records or PII, and must use the student’s PII or education records only for authorized purposes and not redisclose to any other party.
Can non-students observe a virtual lesson? Is it permissible to record classes and share recordings later with absent students?
To answer both of these questions, the kind of information about students that might be disclosed during typical virtual classroom time must be considered. Thus, if PII from student education records is not disclosed, FERPA would permit a non-student from observing the lesson. The same is true for a video recording that does not disclose PII from student education records. Alternatively, a school could obtain prior written or electronic parent consent for a potential disclosure of PII from student education records in order to avoid a FERPA violation.
What steps can be taken to meet the 45-day timeline for access to education records under FERPA?
This is not explicitly addressed by FERPA. SPPO does counsel that in such situations, the school should consider how other administrative functions are handled during the school closure, and work with the parent to identify mutually acceptable options, which may include provision of electronic access to the requested record and/or emailing of a copy of it to the parent.
May the school identify that a student has COVID-19 to parents of other students in the school when the student has been out of school during the entire period of possible transmission and the school does not release the name?
A school may provide such information to parents so long as the information is in a non-personally identifiable form. In such a situation, the school must make a reasonable determination that the student’s identity will not be personally identifiable, whether through single or multiple releases, taking into account other reasonably available information.
It is important to understand that the “FERPA & Virtual Learning During COVID-19” webinar was based entirely on analyses under federal law and regulations. As some of those analyses may be affected by California law in certain instances, districts should review relevant California law when considering any of the matters addressed by the webinar. For example, FERPA requires a school to provide parents access to student records within a reasonable period of time but not later than 45 days after the request. On the other hand, California Education Code section 49069.7 provides that access must be granted a parent not later than five business days following the date of the request.
Finally, the webinar includes a listing of federal resources related to COVID-19. The webinar is available on the SPPO website – https://studentprivacy.ed.gov.