STUDENT PRIVACY POLICY OFFICE 

FERPA & Coronavirus Disease 2019 (COVID-19) 

Frequently Asked Questions (FAQs) 

March 2020 

Introduction 

The United States (U.S.) Department of Education (Department) is issuing these Frequently Asked 

Questions (FAQs) regarding the Family Educational Rights and Privacy Act (FERPA) and the 

coronavirus disease 2019, abbreviated as “COVID-19” and more commonly referred to as 

“coronavirus.”1 We are working with our Federal partners including the Centers for Disease 

Control and Prevention (CDC), which is leading the Federal effort to address coronavirus or 

COVID-19. The U.S. Department of Health and Human Services (HHS) issued on January 31, 

2020, a declaration of a Public Health Emergency regarding coronavirus or COVID-19.2 

The Department’s Student Privacy Policy Office (SPPO) prepared this document to assist school 

officials working with public health officials in managing public health issues related to 

COVID-19, while protecting the privacy of students’ education records. Understanding FERPA 

helps enable school officials to act quickly and with certainty when confronting challenges that 

affect the health or safety of students or other individuals. 

Educational agencies and institutions, such as school districts, schools, colleges and universities, 

can play an important role in slowing the spread of COVID-19 in U.S. communities. Through 

information sharing and coordination with public health departments, educational agencies and 

institutions can help protect their schools and communities. 

The purpose of this document is to assist school officials in protecting student privacy in the 

context of COVID-19 as they consider the disclosure of personally identifiable information (PII) 

from student education records to individuals and entities who may not already have access to that 

information. School officials should work with their State and local public health officials to 

determine the information needed to address this public health concern. Understanding how, what, 

and when information can be shared is a critical part of preparedness. 

Background 

FERPA is a Federal law that protects the privacy of student education records. (20 U.S.C. § 

1232g; 34 C.F.R. Part 99) The law applies to all educational agencies and institutions that receive 

funds under any program administered by the Secretary of Education. The term “educational 

agencies and institutions” under FERPA generally includes school districts and public schools at 

the elementary and secondary levels, as well as private and public institutions of postsecondary 

1 Please note that this FERPA & Coronavirus Disease 2019 (COVID-19) FAQ document updates the Department’s 

2009 FERPA & H1N1 document. Other than statutory and regulatory requirements included in the document, the 

contents of the guidance do not have the force and effect of law and are not meant to bind the public in any way. This 

document is intended only to provide clarity to the public regarding existing requirements under the law or agency 

policies. This document will be posted at https://studentprivacy.ed.gov and https://www.ed.gov/coronavirus. 2 HHS declaration posted at https://www.hhs.gov/about/news/2020/01/31/secretary-azar-declares-public-healthemergency-us-2019-novel-coronavirus.html. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

education. Private schools at the elementary and secondary levels generally do not receive funds 

from the Department and are, therefore, not subject to FERPA. 

FERPA gives parents certain rights with respect to their children’s education records at 

educational agencies and institutions to which FERPA applies. These rights transfer to the 

student when he or she reaches the age of 18 or attends an institution of postsecondary education 

at any age (thereby becoming an “eligible student”). 20 U.S.C. § 1232g(d); 34 C.F.R. § 

99.5(a)(1). Under FERPA, a parent or eligible student must provide a signed and dated written 

consent before an educational agency or institution discloses PII from education records, unless 

an exception to this general consent requirement applies. 34 C.F.R. § 99.30(a). Exceptions to the 

general consent requirement are set forth in 20 U.S.C. §§ 1232g(b)(1), (b)(2), (b)(3), (b)(5), 

(b)(6), (h), (i), and (j) and 34 C.F.R. § 99.31. The term “education records” is defined, with 

certain exceptions, as those records that are: (1) directly related to a student; and (2) maintained 

by an educational agency or institution, or by a party acting for the agency or institution. 20 

U.S.C. § 1232g(a)(4); 34 C.F.R. § 99.3, “Education records.” Accordingly, immunization and 

other health records, as well as records on services provided to students under the Individuals 

with Disabilities Education Act (IDEA), which are directly related to a student and maintained by 

an educational agency or institution are “education records” under FERPA.3 The term “PII” refers 

to a student’s name or identification number, as well as other information that can be used to 

distinguish or trace an individual’s identity either directly or indirectly through linkages with 

other information. 34 C.F.R. § 99.3, “Personally identifiable information.” 

FERPA prohibits educational agencies (e.g., school districts) and institutions (i.e., schools) from 

disclosing PII from students’ education record without the prior written consent of a parent or 

“eligible student,” unless an exception to FERPA’s general consent rule applies. 20 U.S.C. §§ 

1232g(b)(1) and (b)(2); 34 C.F.R. §§ 99.30 and 99.31. For instance, pursuant to one such 

exception, the “health or safety emergency” exception, educational agencies and institutions may 

disclose to a public health agency PII from student education records, without prior written 

consent in connection with an emergency if the public health agency’s knowledge of the 

information is necessary to protect the health or safety of students or other individuals. 20 U.S.C. 

§ 1232g(b)(1)(I); 34 C.F.R. §§ 99.31(a)(10) and 99.36. 

For all other situations where an exception to FERPA’s general consent requirement does not 

apply, educational agencies and institutions must obtain prior written consent of a parent or 

eligible student to disclose PII from student education records. 20 U.S.C. §§ 1232g(b)(1) and 

(b)(2); 34 C.F.R. §§ 99.30 and 99.31. We have attached a model consent form at the end of this 

document. We have also listed the email and contact information for SPPO, the Department office 

responsible for implementing and enforcing FERPA, if school officials have questions that are not 

covered in this document. 

3 Parts B and C of the IDEA contain separate privacy regulations that incorporate FERPA provisions and exceptions, 

including the health or safety emergency exception that is the primary subject of these FAQs. Where a student is placed 

in a private school for the provision of Individualized Education Program (IEP) services on behalf of a school or school 

district subject to FERPA, the education records of the privately placed student that are maintained by the private 

school are subject both to FERPA and to the confidentiality requirements under Part B of the IDEA.

2 
 

 

 

 

 

 

 

 

 

 

 

 

 

Questions and Answers on the Applicability of FERPA to Disclosures Related to COVID-19 

("Coronavirus") 

1. Do parents and eligible students have to provide consent before an educational 

agency or institution discloses PII from education records? 

Generally, yes. A parent or eligible student must provide written consent before an educational 

agency or institution discloses PII from a student’s education records, unless one of the exceptions 

to FERPA’s general consent rule applies. 20 U.S.C. §§ 1232g(b)(1) and (b)(2); 34 C.F.R. §§ 99.30 

and 99.31. FERPA requires that a consent form be signed and dated by a parent or eligible student 

and (1) specify the records that may be disclosed; (2) state the purpose of the disclosure; and (3) 

identify the party or class of parties to whom the disclosure may be made. 34 C.F.R. § 99.30(a) 

and (b). At the conclusion of this document, we have included a sample FERPA consent form. 

2. How does the health or safety emergency exception to FERPA’s consent requirement 

permit an educational agency or institution to disclose PII from the education records 

of affected students? 

Although educational agencies and institutions can often address threats to the health or safety 

of students or other individuals in a manner that does not identify a particular student, FERPA 

permits educational agencies and institutions to disclose, without prior written consent, PII from 

student education records to appropriate parties in connection with an emergency, if knowledge 

of that information is necessary to protect the health or safety of a student or other individuals. 

20 U.S.C. § 1232g(b)(1)(I); 34 C.F.R. §§ 99.31(a)(10) and 99.36. This “health or safety 

emergency” exception to FERPA’s general consent requirement is limited in time to the period 

of the emergency and generally does not allow for a blanket release of PII from student 

education records. Typically, law enforcement officials, public health officials, trained medical 

personnel, and parents (including parents of an eligible student) are the types of appropriate 

parties to whom PII from education records may be disclosed under this FERPA exception. 

For purposes of FERPA’s health or safety emergency exception, the determination by an 

educational agency or institution that there is a specific emergency is not based on a generalized 

or distant threat of a possible or eventual emergency for which the likelihood of occurrence is 

unknown, such as would be addressed in general emergency preparedness activities. If local 

public health authorities determine that a public health emergency, such as COVID-19, is a 

significant threat to students or other individuals in the community, an educational agency or 

institution in that community may determine that an emergency exists as well. 

Under the FERPA health or safety emergency exception, an educational agency or institution is 

responsible for making a determination, on a case-by-case basis, whether to disclose PII from 

education records, and it may take into account the totality of the circumstances pertaining to the 

threat. See 34 C.F.R. § 99.36(c). If the educational agency or institution determines that there is an 

articulable and significant threat to the health or safety of the student or another individual and 

that certain parties need the PII from education records, to protect the health or safety of the 

3 
 

 

 

 

 

 

 

 

 

 

 

student or another individual, it may disclose that information to such parties without consent. 

This is a flexible standard under which the Department will not substitute its judgment for that of 

the educational agency or institution so that the educational agency or institution may bring 

appropriate resources to bear on the situation, provided that, based on the information available at 

the time of the educational agency’s or institution’s determination, there is a rational basis for 

such determination. We note also that, within a reasonable period of time after a disclosure is 

made under this exception, an educational agency or institution must record in the student’s 

education records the articulable and significant threat that formed the basis for the disclosure and 

the parties to whom information was disclosed. 34 C.F.R. § 99.32(a)(5). 

3. May student education records, such as health records, maintained by an educational 

agency or institution be disclosed, without consent, to public health departments if the 

educational agency or institution believes that the virus that causes COVID-19 poses a 

serious risk to the health or safety of an individual student in attendance at the 

educational agency or institution? 

Yes. If an educational agency or institution, taking into account the totality of the circumstances, 

determines that an articulable and significant threat exists to the health or safety of a student in 

attendance at the agency or institution (or another individual at the agency or institution) as a 

result of the virus that causes COVID-19, it may disclose, without prior written consent, PII from 

student education records to appropriate officials at a public health department who need the 

information to protect the health or safety of the student (or another individual). Public health 

department officials may be considered “appropriate parties” by an educational agency or 

institution under FERPA’s health or safety emergency exception, even in the absence of a 

formally declared health emergency. Typically, public health officials and trained medical 

personnel are among the types of appropriate parties to whom PII from education records, may be 

non-consensually disclosed under FERPA’s health or safety emergency exception. 

4. If an educational agency or institution learns that student(s) in attendance at the 

school are out sick due to COVID-19, may it disclose information about the 

student’s illness under FERPA to other students and their parents in the school 

community without prior written parental or eligible student consent? 

It depends, but generally yes, but only if that information is in a non-personally identifiable form. 

Specifically, the the educational agency or institution must make a reasonable determination that a 

student’s identity is not personally identifiable, whether through single or multiple releases, and 

taking into account other reasonably available information. See 34 C.F.R. § 99.31(b)(1). If an 

educational agency or institution discloses information about students in non-personally 

identifiable form, then consent by the parents or eligible students is not needed under FERPA. For 

example, if an educational agency or institution releases the fact that individuals are absent due to 

COVID-19 (but does not disclose their identities), this would generally not be considered 

personally identifiable to the absent students under FERPA as long as there are other individuals 

at the educational agency or institution who are absent for other reasons. However, we caution 

educational agencies or institutions to ensure that in releasing such facts, they do so in a manner 

that does not disclose other information that, alone or in combination, would allow a reasonable 

4 
 

 

 

 

 

 

 

 

person in the school community to identify the students who are absent due to COVID-19 with 

reasonable certainty. 

5. May educational agencies and institutions disclose without consent the names, addresses, 

and phone numbers of absent students to the public health department so that the health 

department may contact their parents in order to assess the students’ illnesses? 

FERPA permits educational agencies and institutions to non-consensually disclose PII from 

education records in the form of contact information of absent students to the public health 

department in specific circumstances, such as in connection with a health or safety emergency 

(20 U.S.C. § 1232g(b)(1)(I); 34 C.F.R. §§ 99.31(a)(10) and 99.36) or pursuant to other applicable 

exceptions. 

While FERPA generally permits the nonconsensual disclosure of properly designated “directory 

information” (e.g., name, address, phone number, grade level) when parents or eligible students 

have not opted out of such a disclosure, it does not permit an educational agency or institution to 

disclose “directory information” on students that is linked to non-directory information (such as 

information regarding a student’s illness). For instance, an educational agency or institution may 

not disclose directory information on all students who are receiving special education services or 

those who have been absent from school. 

Therefore, unless a specific FERPA exception applies, educational agencies and institutions 

should prepare consent forms for parents and eligible students to sign to allow the potential 

sharing of this type of information if they create, or intend to create, a tracking or monitoring 

system to identify an outbreak before an emergency is recognized. 

6. If an educational agency or institution determines that a health or safety emergency 

exists, may it disclose, without consent, PII from student education records to the 

media? 

No. As explained previously, FERPA only permits nonconsensual disclosures of PII from 

students’ education records under the health or safety emergency exception to “appropriate 

parties” (such as public health officials) whose knowledge of the information is necessary to 

protect the health or safety of students or other individuals. While the media may have a role in 

alerting the community of an outbreak, they are not “appropriate parties” under FERPA’s health 

or safety emergency exception because they generally do not have a role in protecting individual 

students or other individuals at the educational agency or institution. “Appropriate parties” in this 

context are normally parties who provide specific medical or safety attention, such as public 

health and law enforcement officials. 

7. May the school identify a particular student, a teacher, or other school official as having 

COVID-19 to parents of other students in the school? 

In most cases, it is sufficient to report the fact that an individual in the school has been 

determined to have COVID-19, rather than specifically identifying the student who is infected. 

School notification is an effective method of informing parents and eligible students of an illness 

5 
 

 

 

 

 

 

 

 

 

 

 

 

 

in the school. For settings in which parents are primarily doing drop-offs and pick-ups, posting 

signs on the doors may be effective. In other settings, sending home or e-mailing a notification 

may also be effective. These methods serve to notify parents and eligible students of a potential 

risk, which may be particularly important for students who may be more susceptible to infection 

or to developing severe complications from an infection, and to alert parents to look for 

symptoms in their own children and eligible students to more closely monitor themselves for 

symptoms. 

Nothing in FERPA prevents schools from telling parents and students that a specific teacher or 

other school official has COVID-19 because FERPA applies to students’ education records, not 

records on school officials. However, there may be State laws that apply in these situations. 

There may be a rare situation during a health or safety emergency, however, in which schools 

may determine (in conjunction with health, law enforcement, or other such officials) that parents 

of students or eligible students are appropriate parties to whom to disclose identifiable 

information about a student with COVID-19. For example, school officials may determine that it 

is appropriate to disclose identifiable information about of a student with COVID-19 to parents 

of other students if parents need to know this information to take appropriate action to protect the 

health or safety of their children. For example if a student with COVID-19 is a wrestler and has 

been in direct and close contact with other students who are on the team or who are in the school 

and have higher health risks, school officials may determine it necessary to disclose the identity 

of the diagnosed student to the parents of the other students. In these limited situations, parents 

and eligible students may need to be aware of this information in order to take appropriate 

precautions or other actions to ensure the health or safety of their child or themselves, especially 

if their child or they may have a higher risk of susceptibility to COVID-19 or of developing 

severe complications from COVID-19.4 School officials should make the determination on a 

case-by-case basis whether a disclosure of the student’s name is absolutely necessary to protect 

the health or safety of students or other individuals or whether a general notice is sufficient, 

taking into account the totality of the circumstances, including the needs of such students or 

other individuals to have such information in order to take appropriate protective action(s) and 

the risks presented to the health or safety of such students or other individuals. 

8. May an educational agency or institution disclose PII from an eligible student’s 

education records to the student’s parents if the eligible student has been determined to 

have COVID-19? 

Yes, for dependent students and generally yes, but see below. Under FERPA, an educational 

agency or institution, including an institution of postsecondary education, may disclose, without the 

eligible student’s written consent, PII from an eligible student’s education records to his or her 

parents under certain conditions. For example, a university physician treating an eligible student for 

COVID-19 might determine that the student’s treatment records should be disclosed to the 

student’s parents. This disclosure may be made, without consent of the eligible student, if the 

parents claim the eligible student as a dependent under section 152 of the Internal Revenue Code of 

4 For helpful information on risk, please see the Centers for Disease Control and Prevention’s current risk assessment, 

which is available at: https://www.cdc.gov/coronavirus/2019-ncov/specific-groups/children-faq.html. 

6 
 

 

 

 

 

 

1986. 20 U.S.C. § 1232g(b)(1)(H); 34 C.F.R. § 99.31(a)(8). If the parents do not claim the eligible 

student as a dependent, then the disclosure may be made to the parents, without the eligible 

student’s written consent, if the disclosure is in connection with a health or safety emergency 

provided certain conditions are satisfied (as discussed in the response to question two above). 20 

U.S.C. § 1232g(b)(1)(I); 34 C.F.R. §§ 99.31(a)(10) and 36. 

9. What if a parent of a student who is not an eligible student refuses to provide written 

consent to permit the release of PII contained in student education records to the public 

health department? 

FERPA permits educational agencies and institutions to release information from education 

records without consent after the removal of all PII, provided that the agency or institution has 

made a reasonable determination that a student’s identity is not personally identifiable, whether 

through single or multiple releases, and taking into account other reasonably available 

information. 34 C.F.R. § 99.31(b)(1). Thus, it would be problematic to disclose that every student 

in a particular class or grade level is absent if there is, for instance, a directory with the names of 

every student in that class or grade. Therefore, it is prudent that educational agencies or 

institutions obtain written consent to permit the disclosure of PII from students’ education records 

to the public health department. If the parent or eligible student will not provide written consent 

for the disclosure of the PII, then the educational agency or institution may not make the 

disclosure unless it has determined that there is an applicable exception to the general 

requirement of consent that permits the disclosure, such as if a health or safety emergency exists 

and the PII is disclosed to an appropriate party whose knowledge of the information is necessary 

to protect the health or safety of the student or other individuals. 

10. Is an educational agency or institution required to record disclosures of PII from student 

education records submitted to the public health department or other outside parties, 

even in connection with a health or safety emergency? 

Yes. FERPA generally requires educational agencies and institutions to maintain a record of each 

request for access to and each disclosure of PII from the education records of each student. 34 

C.F.R. § 99.32(a)(1). Moreover, when making a disclosure under the health or safety emergency 

provision in FERPA, educational agencies and institutions are specifically required to record the 

articulable and significant threat to the health or safety of a student or other individual that formed 

the basis for the disclosure and the parties to whom the agency or institution disclosed the 

information. 34 C.F.R. § 99.32(a)(5). The record of each request for access to and each disclosure 

of PII from student education records must be maintained with the education records of each 

student as long as the records are maintained. 34 C.F.R. § 99.32(a)(2). This requirement enables 

parents and eligible students who do not provide written consent for disclosure of education 

records to see the circumstances under which and the parties to whom their information was 

disclosed. However, educational agencies and institutions are not required to record disclosures 

for which the parent or eligible student has provided written consent. 34 C.F.R. § 99.32(d)(3). 

***************************************************************************** 

7 
 

 

 

 

 

 

 

The Department’s Student Privacy Policy Office or SPPO is the office that administers FERPA. 

SPPO is available to respond to questions school officials may have about FERPA. School 

officials may e-mail questions to SPPO at FERPA@ed.gov. You may also call us at (202) 260-

3887. Additional information and guidance on FERPA is available on SPPO’s website at: 

https://studentprivacy.ed.gov/. 

The Department has a list of resources regarding COVID-19 (coronavirus) on our website at 

https://www.ed.gov/coronavirus. Questions related to the coronavirus may be emailed to the 

Department at COVID-19@ed.gov. 

In December 2019, the U.S. Department of Education, along with HHS, issued guidance on the 

applicability of FERPA and the HIPAA to student health records, the “Joint Guidance on the 

Application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance 

Portability and Accountability Act of 1996 (HIPAA) To Student Health Records.” See 

https://studentprivacy.ed.gov/sites/default/files/resource_document/file/2019%20HIPAA%20FER 

PA%20Joint%20Guidance%20508.pdf. This 2019 document updated the Department’s 2008 

guidance and explained that the HIPAA Privacy Rule does not apply to education records that are 

protected by FERPA. Student health records that are maintained by a public elementary and 

secondary educational agency or institution or by a party acting for the agency or institution are 

“education records” subject to FERPA, and school officials must follow the requirements of 

FERPA in making any disclosures of the PII from these records. At the postsecondary level, 

FERPA applies to most public and private institutions of postsecondary education and to the 

student health records that they maintain. Such student health records may either constitute 

“education records” or “treatment records,” if certain conditions are met, but in either case they 

are subject to FERPA and not the HIPAA Privacy Rule. 

For more information on the HIPAA Privacy Rule, please visit HHS’ HIPAA Privacy Rule 

website at: http://www.hhs.gov/ocr/privacy/. The website offers a wide range of helpful 

information about the HIPAA Privacy Rule, including frequently asked questions. 

8 
 

 

 

 

 

 

 

 

 

 

 

 

 

[Sample FERPA Consent Form] 

Disclosure of Information Protected by the Family Educational Rights and Privacy Act 

by ___________ [Name of School/School District] to [Name of Appropriate Authority] 

Pursuant to the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 

C.F.R. part 99), the written consent of a parent or eligible student is required before the education

records of a student, or personally identifiable information contained therein, may be disclosed to

a third party, unless an exception to this general requirement of written consent applies. If a

student is age 18 years or older, or is enrolled in an institution of postsecondary education, he or

she is an “eligible student” and must provide written consent for the disclosure of his or her

education records or personally identifiable information contained therein.

I, , hereby agree to allow _________________________ 

[SCHOOL OR DISTRICT NAME] to disclose the following personally identifiable information 

or education records: 

__________________________ [Specify education records or personally identifiable 

information that may be disclosed] on ________________________ 

[Name of Student] to [Name of Appropriate Authority] for the 

purpose of [State purpose of disclosure] _____________________________. 

You may withdraw your consent to share this information at any time. A request to withdraw your 

consent should be submitted in writing and signed. 

Signature of Parent, Guardian, or Eligible Student 

Date: 

9