Considerations in response to faculty concerns and petition regarding disclosure of positive student tests
Sent on behalf of:
S. Jack Hu, senior vice president for academic affairs and provost
Michael M. Raeber, general counsel
Individual faculty members have expressed concerns about the notification of classes when a student in the class tests positive for COVID-19. These same concerns are reflected in a petition apparently being circulated among USG faculty titled “Right to Inform and Be Informed,” which declares that all instructors “have the right to inform their students when those who attend their class in person have tested positive for the novel coronavirus.” The petition suggests that such notifications should be “stripped of specifics to protect the anonymity of students who test positive.” It claims that this procedure “aligns with expert consensus concerning the proper limits of privacy law and with the ‘health or safety emergency’ exception to Family Educational Rights and Privacy Act (FERPA).”
The petition does not identify this “expert consensus,” but includes three links: (1) March 2020 FAQs from the Department of Education Student Privacy Policy Office, (2) a Washington Post article, and (3) a communications protocol from another University System of Georgia (USG) institution. The federal student privacy law known as FERPA prohibits the disclosure of personally identifiable information from a student’s education record (which would include a reported positive COVID-19 test) absent an applicable exception. The petition states that the proposed notifications would be anonymous (or in FERPA terms, “de-identified”), but this is problematic because it does not address the fact that even “anonymous” notifications allow identification of individual students in some circumstances. The petition also states that the notification would be made under the “health or safety emergency” exception to FERPA, but that exception only applies to notifications that are not anonymous. In any event, both approaches to disclosure raise significant concerns:
- De-identification: FERPA permits the disclosure of information that is anonymous or “de-identified,” but the Department of Education has repeatedly made clear that the disclosure of student information that has been stripped of specific identifiers is still prohibited if a reasonable member of the campus community could determine the student’s identity with reasonable certainty. In a classroom setting, an instructor’s notification to the class that an anonymous member of the class has tested positive for COVID-19, combined with the student’s absence from class, could readily permit identification of the student in question. This is particularly true in smaller classes, and one individual quoted in the Washington Post article makes precisely this point (“Particularly in a small class, you could imagine if you say two students tested positive, maybe someone else in the class sees two students who aren’t there the next class.”).
- “Health or safety emergency” exception: One exception to FERPA permits the disclosure of information that is personally identifiable, without the student’s consent, if the information is disclosed to appropriate parties and knowledge of the information is necessary to protect the health or safety of students or other individuals. The Department of Education Guidance cited in the petition makes clear that to utilize this exception, the institution must determine on a “case-by-case basis” that there is an “articulable and significant threat” to health or safety and that the disclosure to “appropriate parties” is “absolutely necessary to protect the health or safety of students or other individuals” (emphasis added). The Department of Education Guidance notes that disclosure under this exception should be a “rare situation,” providing the example of a wrestler who is in direct, close physical contact with other students. The Guidance suggests that such determinations should be made by the institution (as opposed to individual faculty members) “in conjunction with health, law enforcement, or other such officials.”
The institution is responsible for compliance with FERPA, and, contrary to what one of the individuals cited in the Washington Post article erroneously claims, instructors are also subject to this compliance obligation, including with respect to the disclosure of protected information in the classroom. Whether a disclosure is permissible under FERPA—either because it is sufficiently de-identified or because there is an articulable health or safety emergency—is an important determination that the institution should make carefully and with consistency.
For these reasons, after careful consideration, the University has directed individual faculty members not to make these decisions independently or automatically notify classes of positive tests. Instead, the University has made the reasoned judgment to vest deans or their designees with the authority to determine on a case-by-case basis (1) when a positive test should be disclosed to students or employees, either on an anonymous basis or under the health or safety emergency exception to FERPA, and (2) the “appropriate parties” with whom such information should be shared as necessary to protect their health and safety. If an instructor feels that circumstances necessitate a notification, either de-identified or under the health or safety emergency exception, that instructor should notify the dean or the dean’s designee of the circumstances, so a careful and consistent determination can be made as to whether notification can and should be made in accordance with FERPA. In making this determination, the dean or designee may consult with the Preventative Measures Advisory Board (PMAB). After reviewing the individual circumstances, the dean or designee can work with the faculty member on the appropriate action to take, if any.
Finally, it should be noted that the Georgia Department of Public Health (DPH) is responsible for contact tracing, and the University is working in close coordination with DPH to identify close contacts with individuals who test positive, using information submitted through the DawgCheck reporting tool.