Nurse
|
000NAME000 Nurse FAX |
Privacy laws and how student, teacher, and employee information will be protected
It is important to make sure administrators, employees, and parents understand privacy laws and how they apply during the COVID-19 pandemic.
What laws protect student,
teacher, and employee privacy?
Public health laws
COVID-19 is reportable by law, under Utah Code Annotated § 26-6-1 et seq., the
Utah Communicable Disease Control Act, and Utah Administrative Code R386-702
Communicable Disease Rule, to the Utah Department of Health or the local health
department in the health district where the individual lives. This means a person’s
COVID-19 test results must be reported to public health by the provider or testing
location where the person was tested.
A person’s test result is considered private health information and is kept confidential by public health. Public health agencies are allowed, by law, to disclose the name of a person who tested positive to a school if it is necessary to protect the health and safety of students, teachers, and employees. The information that is disclosed by the health department to the school is strictly confidential and protected under Utah Code § 26-6-27.
If the information is about an employee, Utah Code § 26-6-27 continues to
protect the privacy of the information even after it is shared with the school’s
point of contact (POC). The POC must maintain the confidentiality of the
EDUCATIONAL RECORD
employee while acquiring information necessary to assist the health department to contact others who may have been exposed. The POC must emphasize the importance of not re-disclosing the information to anyone else and that all notifications will be made by the POC or the health department.
If the information is about a student, the information, once shared with the POC becomes protected by FERPA. The POC must ensure that this information remains confidential and is shared only with those who have a need to know to assist the POC in carrying out the responsibility to notify others who may have been exposed. The POC must emphasize the importance of not re-disclosing the information to anyone else and that all notifications will be made by the POC or the health department.
29
The POC and the school officials cannot release the private health information disclosed
by public health under any circumstances. This includes the name of the person who
tested positive for COVID-19.
The POC may need to share the identity of the person who has tested positive for
COVID-19 with other school officials to determine the identity of individuals who have
been in close contact with the person who has tested positive for COVID-19 and the risk
level of those individuals. This must be limited to the least number of school officials
possible and each must be notified that the information is confidential and cannot be
redisclosed or shared with anyone else.
Other laws schools need to consider
There are other laws that protect the privacy of students, teachers, and employees.
Schools are responsible to work with their legal counsel to understand these laws and
how they apply during the COVID-19 pandemic. Schools must follow all regulatory
requirements and governing structures that apply to an educational setting.
Some of these laws may include:
- Family Educational Rights and Privacy Act (FERPA32)
- Utah Code Annotated § 53E-9-101 et seq., Student Privacy and Data Protection • State and federal labor laws
There are very few circumstances when the name of an individual who tested positive for COVID-19 may be released. If this situation were to occur, the determination to release this information and to whom it may be released will be made on a case-by case basis by the local health officer.
The Family Educational Rights and Privacy Act (FERPA33) is a federal law that protects the privacy of student education records. FERPA gives parents certain rights about their child’s education records. When a student turns 18 years old or if a student attends a postsecondary institution (such as a college) at any age, the student becomes an “eligible student” (a student who is 18 years old or a student of any age who has taken postsecondary courses). This means the student, not the parent, becomes the only person who has rights to the student’s educational record. In some cases, FERPA information can still be provided to the parents of eligible students without a written consent.
FERPA says that in most cases, a parent or eligible student must give his or her written consent, or permission, before a school can give out any personally identifiable information (PII) from an education record.
CONFIDENTIAL CONSENT
Personally identifiable information (PII)
- This is information that can be used to identify who a student is, such as a student’s name or identification number. • PII includes information that directly or indirectly identifies a student. This means PII does not just include information that has a student’s name on it. If someone can use a piece of information that does not say who the student is, with a different piece of information, and is able to link the pieces of information together to know who the student is, all of the information is considered to be PII.
Under FERPA, a school is allowed to disclose student PII to the
health department on a case-by-case basis if it is necessary to protect the health and safety of the student or others, without the written consent of an eligible student or parent or guardian.
The United States Department of Education oversees FERPA and has published Frequently Asked Questions (FAQs) regarding FERPA and COVID-19 which is linked within this document and may be consulted for more information in addition to specific guidance by a school’s legal counsel.
What information can a school disclose
when someone in the school tests positive
for COVID-19?
A school may disclose that someone at the school tested positive for
COVID-19, as long as the facts alone or in combination with other
information released, do not identify the person.
The school may not publicly release the PII of the student such as the
student’s name or whether they tested positive for COVID-19.
The school may not publicly release the name of a teacher or employee
who tested positive for COVID-19.