New FERPA Guidance on Permitted Disclosures Necessary to Protect Health or Safety

By Sheila Sokolowski and Linh Nguyen

The U.S. Department of Education  through the Privacy Technical Assistance Center (“PTAC”)—an online resource on data privacy, confidentiality, and security practices for education stakeholders—recently issued a set of frequently asked questions (“FAQs”) on the requirements of the Family Educational Rights and Privacy Act (“FERPA”) in the context of school safety. As a general rule, school officials are not permitted to disclose students’ education records or personally identifiable information (“PII”) without written consent, subject to certain exceptions. One exception under 34 CFR §§ 99.31(a)(10) and 99.36 permits school officials to disclose PII when responding to an emergency, so long as the disclosure is necessary to protect the “health or safety” of the student or other individuals on campus.

The newly issued guidance is a response to the Federal Commission on School Safety report, which observed that “substantial misunderstanding remains at the local level among officials and educators concerning (FERPA), and in particular its application to school-based threats.” The stated purpose of the guidance is to “empower school officials to act decisively and quickly when challenges arise” and recognize the balance they must strike between safety and privacy for students. Consisting of 37 commonly asked questions relating to the disclosure of PII to school security units, outside law enforcement entities, School Resource Officers (SROs), and other schools, the FAQ’s focus is on health or safety emergencies in the context of public elementary and secondary schools with clear implications for postsecondary institutions, including colleges and universities, particularly as it relates to FERPA permitted disclosures necessary to protect health or safety of individuals on campus. Some noteworthy questions and answers in the FAQ include:

• When is it permissible for schools or districts to disclose, without appropriate consent, student education records or PII under FERPA’s health or safety emergency exception?
  • Disclosures to appropriate parties without student consent are permissible in order to address a specific and articulable threat of a health or safety emergency. This exception is limited to the period of the emergency and does not allow for a blanket release of PII from students’ education records.

• Who may receive disclosures under the health or safety emergency exception?
  • An “appropriate party,” defined as a party whose knowledge of such information is necessary to protect the health or safety of the student or other persons. Appropriate parties provided as examples in the FAQ include local or State law enforcement officials, public health officials, trained medical personnel, and parents.

• How does a school or district know when a health or safety emergency exists so that a disclosure may be made under this exception to consent?
  • This determination must be made on a case-by-case basis and must take into account the totality of the circumstances relating to the threat. An “articulable and significant” threat is one that can be explained. That is to say, when making and recording the disclosure school officials should be able to identify what the threat is and why the threat is significant based on available information at the time. Disclosures made during an emergency preparedness exercise do not qualify for the health or safety emergency exception since those circumstances are not actual, impending, or imminent.

• Does a school have to record disclosures made under FERPA’s health or safety emergency exception?
  • Yes, when making a disclosure under this exception the articulable and significant threat that formed the basis for the disclosure and the parties to whom the information was disclosed must be recorded in the student’s education records.

• Does FERPA permit school officials to release information that they personally observed or of which they have personal knowledge?
  • FERPA does not prohibit releasing this information because information obtained through a school official’s personal knowledge or observation is not from an education record. This does not apply to a school official who learns of information about a student through their official role of making a determination about the student and that determination is maintained in an education record.

The FAQ also touches upon best practices and recommendations for meeting FERPA requirements. Postsecondary institutions will want to consider the extent to which MOUs with law enforcement units specifically address access to students’ education records and whether members serving on a threat assessment team understand and acknowledge their responsibility to safeguard student information under FERPA. Additionally, postsecondary institutions will want to consider obligations beyond FERPA, such as under state law and other federal laws.

Should you have any questions or concerns about the topics discussed in this article, please feel free to contact HMBR.