School district and BOCES employees sometimes must decide whether they should and may lawfully disclose personally identifiable information (PII) from student education records when the disclosure is designed to safeguard students and others. For example, if a student who is experiencing mental health concerns makes a threat of violence in school, administrators must determine what potentially pertinent information from student education records may be shared with law enforcement and others who may use the information to address the threat. It may also be appropriate to share information from student records with the student’s family, healthcare providers and others in the interest of student health and welfare.

Two federal agencies – the U.S. Department of Education and the Office for Civil Rights in the U.S. Department of Health and Human Services – addressed these situations in a December 2019 guidance update. The “Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to Student Health Records” update states that educational institutions, such as school districts, BOCES and their contracted healthcare providers, may share PII with parents and others in a position to prevent or lessen a serious and imminent threat to the health or safety of the individual, another person or the public, consistent with applicable law and standards of ethical conduct.

For instance, if a parent tells a child’s therapist he or she is worried because the child threatened to kill a teacher and has access to a weapon, it would be appropriate for the therapist to contact school officials, according to the guidance. In this scenario, the therapist would be acting out of a sincere belief that the disclosure to school officials is necessary to prevent or lessen a serious and imminent threat to the teacher.

The guidance also states that if an eligible student storms out of a teacher’s office stating, “I know where my parents keep their guns, and someone is going to pay” and the teacher believes that the student is on his/her way home and may try to use the weapons, FERPA’s health or safety exception would permit the teacher to contact and share pertinent PII from educational records with the parents, police, or others in a position to help, to warn them that the student is on the way home and threatened to use a weapon against others.

This article describes some of the laws that govern the disclosure of PII and related guidance issued by the federal government.

The Family Educational Rights and Privacy Act (FERPA)

A key federal law involving the privacy of student records is FERPA. It applies to educational agencies and institutions that receive federal funds, including public school districts and BOCES. This law protects the confidentiality of student education records, in addition to affording certain other rights to parents or “eligible” students (that is, students 18 years of age or older and those who attend an institution providing education beyond the secondary level, such as college students).

In accordance with FERPA, a school must obtain written consent of a parent or eligible student authorizing an educational institution to disclose PII from a student’s education records, unless an exception to the prior written consent requirement applies.

“Education records” are broadly defined under FERPA to generally include records that are directly related to a student and maintained by the educational institution or on its behalf. This includes not only student grades and progress reports, but also, for example, student physical and mental health records.

Notably, education records do not include “sole possession notes,” which are notes kept only by a school district or BOCES employee for his/her own use, not shared with anyone (other than a temporary substitute) and used as a memory aid.

Individuals with Disabilities Education Act (IDEA)

The confidentiality requirements for students with disabilities under IDEA are similar to but broader than those contained in FERPA. The IDEA generally incorporates FERPA’s exceptions to the prior written consent for disclosure requirement and contains other exceptions.

The Health Insurance Portability and Accountability Act (HIPAA)

HIPAA protects the confidentiality of records maintained by health care providers. According to the December 2019 updated federal guidance, school districts and BOCES generally are not covered by HIPAA’s Privacy Rule, because school nurses, physicians, psychologists and other health care providers typically do not engage in covered transactions under HIPAA, such as billing a health plan electronically for services. Moreover, even when health care providers do engage in covered transactions under HIPAA (e.g., billing Medicaid electronically for services provided to a student pursuant to the IDEA) school districts and BOCES generally are not subject to the HIPAA Privacy Rule’s requirements.

The reason is that education records are expressly excluded from the definition of “protected health information” under HIPAA. In other words, information related to a student’s health that is contained in the records of a school or a health care provider working under contract with a school generally are considered educational records subject to FERPA rather than medical records subject to HIPAA.

NYS Education Law Section 2-d

Education Law Section 2-d and its implementing regulations dictate specific requirements for third party contractors that receive student data. Contracts and agreements between the school district or BOCES and the outside contractor must include a data security and privacy plan that outlines how all federal, state, and local data security and privacy contract requirements will be implemented over the life of the contract, consistent with the school board’s policy on data security and privacy. This includes contractors who are healthcare providers. Consult with your school attorney regarding requirements related to sharing student and employee data with a third-party provider.

Disclosures to SROs and other law enforcement in the case of a student threat

When a concern arises that a student might pose a danger to himself, herself or others, questions arise regarding the ability of police to access or receive information from student records without permission of a student (if over 18), a parent or a guardian. One exception to FERPA’s prior written consent requirement permits school districts and BOCES to disclose PII from education records, including school health records, to “school officials” who have been determined to have a “legitimate educational interest” in the education records. “School officials” may include school resource officers (SROs). Therefore, school officials may be able to lawfully disclose information from student records to an SRO who has a legitimate need to know. An off-duty police officer who is hired by the district to provide security may also be considered a school official under FERPA, according to the December 2019 updated federal guidance.

Generally, law enforcement officials who are not SROs are not school officials in the context of FERPA and cannot be given information without written consent from the parent or eligible (18-year-old) student. In the case of a health and safety threat, however, an emergency exception allows school officials to disclose PII from education records, including school health records, to police and other individuals who are not school officials but have a need to know in order to prevent, mitigate or otherwise address the emergency.

A school offi cial’s feeling or belief that there is an emergency or a possible emergency, by itself, is not sufficient to establish an emergency in the eyes of the law. Rather, based on the information at hand, there must be a rational basis for the school district or BOCES’ determination that a health or safety emergency exists. Taking into account the totality of the circumstances, there must be an articulable and significant threat to health and safety for the emergency exception to apply.

The health and safety exception is limited to the period of the emergency only and does not allow a long term, blanket release of PII from education records. For instance, suppose a district attorney decides to pursue potential criminal charges against a student after an imminent threat or emergency has subsided. The school could not lawfully grant the DA or a police investigator access to PII from the student’s records in such instance without a subpoena or the written permission of the parent or eligible student in the absence of an imminent threat.

Good record-keeping is essential. After invoking the health or safety exception, the educational institution must, within a reasonable period of time, note in the student’s education records (1) the nature of the articulable and significant threat to the health or safety that formed the basis for the disclosure and (2) the names of parties to whom the information was disclosed.

Making disclosures to parents in the case of a student threat

FERPA permits school districts and BOCES to disclose PII from education records to parents of students under 18. Parents of students under 18 generally have the right to an opportunity to inspect and review their child’s education records within 45 days of the receipt of a request. This time frame may be shorter for special education matters, as requested records must be provided before the next Committee on Special Education meeting, due process hearing or resolution session.

Except in certain cases involving transgender students, students making inquiries about substance abuse services to a designated school official and certain other specific circumstances, it is generally the duty of school districts and BOCES to advise parents in writing when “any aspect of the total school health program” indicates that the student has a condition “which may require professional attention with regard to health.” This regulation – 8 N.Y.C.R.R. Section 136.3(a)(2) – may be relevant when school officials suspect a student may be experiencing problems with mental health or physical health. This is a complicated area of law, and district officials are advised to consult with their school attorney when questions arise regarding a specific student.

In determining whether to share PII from education records or other student-related information with parents, school districts and BOCES must keep in mind that students generally do not enjoy the equivalent of a psychologist-client confidentiality privilege when they confide in school officials, including certified professionals such as a school psychologist, school counselor, school social worker or school nurse. At least one New York court has held, for example, that communications with a school guidance counselor are not privileged under New York Civil Practice Laws and Rules (CPLR) Section 4508, which provides a privilege concerning communications made to master social workers and clinical social workers licensed under Article 154 of the Education Law. Moreover, the commissioner of education noted in a 2005 decision that no decision of the courts or the commissioner has yet granted privileged status to communications between a student and school personnel.

Complicating matters is a confusing reference to confidentiality in a relatively new section of the Education Law involving educational services related to substance use. Education Law Section 3038, which became effective in March 2019, requires the designation of a school official to provide information to students, parents, and staff regarding where and how to fi nd resources and services related use and abuse of alcohol, tobacco, prescription medications and other drugs. This individual may be a school social worker, school guidance counselor, or any other health practitioner or counselor employed by the school. The law states that a student’s communication with this individual regarding substance use related services will be considered confidential in the same manner as information provided pursuant to CPLR Section 4508, but does not relieve the designated individual of any legal duty to otherwise report such information. More guidance is needed with regard to the practical implications of this legislation.

Also, transgender and gender non-conforming students may be afforded a level of privacy and confidentiality to protect their safety, according to guidance from the State Education Department. This may apply in cases in which a student does not want a parent to know what the student has said to school officials about gender identity for reasons involving personal safety.

Another issue involves disclosures to parents when a student is 18 or older. When a student turns 18, parental FERPA rights transfer to the student. This does not mean in each case that a parent of a student age 18 or older has no right to obtain access to a student’s PII without prior written consent PII from his/her child, however. The parent maintains rights to access the student’s education records (1) if the student is claimed as his/her parents’ dependent for tax purposes; or (2) in connection with a health or safety emergency, as described above, if the parents’ knowledge of such PII is necessary to protect the health or safety of the student or others. Otherwise, if a student age 18 or older refuses to provide written consent to disclose PII to a parent, FERPA would prohibit the school district or BOCES from disclosing the information.

It is important to remember that FERPA pertains only to education records. Nothing in FERPA accordingly prohibits a school district or BOCES employee from listening to concerns or from sharing information or concerns regarding a student with his/her parents or others based on personal knowledge or observation.

Sharing information with healthcare providers in the case of a student threat

In accordance with FERPA, school district and BOCES employees may disclose PII from education records without prior written consent to the student’s outside healthcare providers in the case of a health or safety emergency, where the healthcare provider’s knowledge of the PII is necessary to protect the health or safety of the student or others, as detailed above.

FERPA additionally permits school employees to communicate with outside healthcare providers to verify information that is contained in a record created by the provider. A school nurse may, for example, verify with an outside healthcare provider a note excusing a student’s absence with that physician for particular health concerns, as long as other PII from the student’s education records is not disclosed without written consent (unless an exception to FERPA’s prior written consent requirement applies).

Requirements and repercussions when PII is improperly disclosed

If a student or parent believes a school district or BOCES has improperly released PII from an education record or otherwise violated FERPA, he or she cannot successfully sue in federal court pursuant to FERPA, as no private right of action exists under the federal law. New York Education Law Section 2-d, however, and its implementing regulations provide for possible civil penalties for third parties for privacy violations. Third-party contractors who violate Section 2-d may be banned from accessing PII.

Moreover, the New York State Stop Hacks and Improve Electronic Data Security (SHIELD) Act may also impose additional requirements on school districts and BOCES with regard to private information that they maintain. It remains to be seen how, if at all, the SHIELD Act applies to school districts and BOCES and the interplay with New York Education Law Section 2-d.

School districts and BOCES must verify adherence to all applicable federal, state and local laws governing student education records, data and confidentiality. Seek the advice of the school board’s attorney on specific questions that arise in your school district.

Members of the New York State Association of School Attorneys represent school boards and school districts. This article was written by Sara Visingard of Harris Beach PLLC.