Privacy laws and how student,  teacher, and employee information  will be protected 

It is important to make sure administrators, employees, and parents understand privacy laws and how they apply during the  COVID-19 pandemic. 

What laws protect student, 

teacher, and employee privacy? 

Public health laws 

COVID-19 is reportable by law, under Utah Code Annotated § 26-6-1 et seq., the  

Utah Communicable Disease Control Act, and Utah Administrative Code R386-702  

Communicable Disease Rule, to the Utah Department of Health or the local health  

department in the health district where the individual lives. This means a person’s  

COVID-19 test results must be reported to public health by the provider or testing  

location where the person was tested.  

A person’s test result is considered private health information and is kept confidential by public health. Public health agencies  are allowed, by law, to disclose the name of a person who tested positive to a school if it is necessary to protect the health and  safety of students, teachers, and employees. The information that is disclosed by the health department to the school is strictly  confidential and protected under Utah Code § 26-6-27. 

If the information is about an employee, Utah Code § 26-6-27 continues to  

protect the privacy of the information even after it is shared with the school’s  

point of contact (POC). The POC must maintain the confidentiality of the  

Educational Record 

employee while acquiring information necessary to assist the health department  to contact others who may have been exposed. The POC must emphasize the  importance of not re-disclosing the information to anyone else and that all  notifications will be made by the POC or the health department.  

If the information is about a student, the information, once shared with the  POC becomes protected by FERPA. The POC must ensure that this information  remains confidential and is shared only with those who have a need to know to  assist the POC in carrying out the responsibility to notify others who may have  been exposed. The POC must emphasize the importance of not re-disclosing the  information to anyone else and that all notifications will be made by the POC or  the health department. 

29 

The POC and the school officials cannot release the private health information disclosed  

by public health under any circumstances. This includes the name of the person who  

tested positive for COVID-19.  

The POC may need to share the identity of the person who has tested positive for  

COVID-19 with other school officials to determine the identity of individuals who have  

been in close contact with the person who has tested positive for COVID-19 and the risk  

level of those individuals. This must be limited to the least number of school officials  

possible and each must be notified that the information is confidential and cannot be  

redisclosed or shared with anyone else. 

Other laws schools need to consider 

There are other laws that protect the privacy of students, teachers, and employees.  

Schools are responsible to work with their legal counsel to understand these laws and  

how they apply during the COVID-19 pandemic. Schools must follow all regulatory  

requirements and governing structures that apply to an educational setting.  

Some of these laws may include: 

• Family Educational Rights and Privacy Act (FERPA32) 

• Utah Code Annotated § 53E-9-101 et seq., Student Privacy and Data Protection • State and federal labor laws 

There are very few circumstances when the name of an individual who tested positive  for COVID-19 may be released. If this situation were to occur, the determination to  release this information and to whom it may be released will be made on a case-by case basis by the local health officer.  

The Family Educational Rights and Privacy Act (FERPA33) is a federal law that protects  the privacy of student education records. FERPA gives parents certain rights about  their child’s education records. When a student turns 18 years old or if a student  attends a postsecondary institution (such as a college) at any age, the student  becomes an “eligible student” (a student who is 18 years old or a student of any age  who has taken postsecondary courses). This means the student, not the parent,  becomes the only person who has rights to the student’s educational record. In some  cases, FERPA information can still be provided to the parents of eligible students  without a written consent. 

FERPA says that in most cases, a parent or eligible student must give his or her written  consent, or permission, before a school can give out any personally identifiable  information (PII) from an education record.