GUIDE FOR DEVELOPING 

HIGH-QUALITY EMERGENCY 

OPERATIONS PLANS 

FOR INSTITUTIONS OF 

HIGHER EDUCATION

U.S. Department of Education 

U.S. Department of Health and Human Services 

U.S. Department of Homeland Security 

U.S. Department of Justice 

Federal Bureau of Investigation 

Federal Emergency Management Agency 

2013 
This report was prepared for the U.S. Department of Education under Contract Number EDESE12O0036 with Synergy 

Enterprises, Inc. Madeline Sullivan served as the contracting officer’s representative for the Readiness and Emergency 

Management for Schools (REMS) Technical Assistance (TA) Center. The views expressed herein represent the collective 

expertise of the federal agencies issuing this document. No official endorsement by the U.S. Department of Education 

of any product, commodity, service, or enterprise mentioned in this publication is intended or should be inferred. For 

the reader’s convenience, this publication contains information about and from outside organizations, including

hyperlinks and URLs. Inclusion of such information does not constitute an endorsement by the Department. 

U.S. Department of Education 

Arne Duncan 

Secretary 

Office of Elementary and Secondary Education 

Deborah S. Delisle 

Assistant Secretary 

Office of Safe and Healthy Students 

David Esquith 

Director 

June 2013 

This report is in the public domain. Authorization to reproduce the report in whole or in part is granted. While 

permission to reprint this publication is not necessary, the suggested citation is: U.S. Department of Education, Office of 

Elementary and Secondary Education, Office of Safe and Healthy Students, Guide for Developing High-Quality Emergency 

Operations Plans for Institutions of Higher Education, Washington, DC, 2013. 

To obtain copies of this report, 

Download online at Office of Safe and Healthy Students, 2013. Emergency Planning Webpage. Available at 

http://www2.ed.gov/admins/lead/safety/emergencyplan/index.html, or 

Readiness and Emergency Management for Schools (REMS) Technical Assistance (TA) Center, 2013. Available at 

http://rems.ed.gov/EOPGuides. 

Availability of Alternate Formats 

Requests for documents in alternate formats such as Braille or large print should be submitted to the Alternate Format 

Center by calling 202-260-0852 or by contacting the 504 coordinator via e-mail at om_eeos@ed.gov. 

Notice to Limited English Proficient Persons 

If you have difficulty understanding English you may request language assistance services for Department information 

that is available to the public. These language assistance services are available free of charge. If you need more 

information about interpretation or translation services, please call 1-800-USA-LEARN (1-800-872-5327) (TTY: 1-800-

437-0833), or e-mail us at ED.Language.Assistance@ed.gov. Or write to U.S. Department of Education, Information 

Resource Center, LBJ Education Building, 400 Maryland Ave. SW, Washington, DC 20202. 

 

 i 

Contents 

Introduction and Purpose ................................................................................................ 1

Planning Principles.......................................................................................................... 5

The Planning Process ..................................................................................................... 6

Step 1: Form a Collaborative Planning Team ............................................................ 6

Step 2: Understand the Situation ............................................................................. 16

Step 3: Determine Goals and Objectives ................................................................. 20

Step 4: Plan Development (Identifying Courses of Action) ...................................... 23

Step 5: Prepare, Review, and Approve the Plan...................................................... 25

Step 6: Implement and Maintain the Plan ................................................................ 28

Plan Content ................................................................................................................. 31

The Basic Plan......................................................................................................... 31

Introductory Material ................................................................................................ 32

Purpose and Situation Overview.............................................................................. 32

Concept of Operations ............................................................................................. 33

Functional Annexes Content.................................................................................... 36

Threat- and Hazard-Specific Annexes ..................................................................... 44

A Closer Look................................................................................................................ 46

1. The Jeanne Clery Disclosure of Campus Security Policy and Campus Crime 

Statistics Act (the Clery Act) ................................................................................ 47

2. Information Sharing .............................................................................................. 52

Family Educational Rights and Privacy Act (FERPA) .......................................... 53

Health Insurance Portability and Accountability Act of 1996 (HIPAA).................. 69

3. Incorporating International Students into IHE Emergency Management and 

Planning............................................................................................................... 71

4. Campus Public Safety.......................................................................................... 73

5. Active Shooter Situations..................................................................................... 75

6. Psychological First Aid (PFA)............................................................................... 86

List of Tables 

Table 1: Contributions to the Planning Team............................................................. 7
ii

Table 2: Assessments.............................................................................................. 18

Table 3: Sample Risk Assessment Workshop ......................................................... 20

Table 4: Threat and Hazard Types and Examples................................................... 45

List of Figures 

Figure 1: Steps in the Planning Process .................................................................... 6

Figure 2: Traditional EOP Format ............................................................................ 26
1

INTRODUCTION AND PURPOSE

Our nation’s postsecondary institutions are entrusted to provide a safe and healthy learning 

environment for students, faculty, and staff who live, work, and study on campus. Faced with 

emergencies ranging from active shooter situations to fires, tornadoes, floods, hurricanes, 

earthquakes, and pandemic influenza, this is no easy task. Many of these emergencies occur with 

little to no warning; therefore, it is critical for institutions of higher education (IHEs) to plan 

ahead to help ensure the safety and general welfare of all members of the campus community. 

IHEs face unique challenges in planning for potential emergencies in terms of geography, 

environment, governance, and the population served. Colleges and universities, including 

community colleges and technical colleges, are large, small, urban, rural, residential, transient, 

two-year, four-year, public, and private, and often operate around-the-clock.

IHE campuses often span large geographic areas, and many have additional locations in other 

cities, states, or countries. Many IHEs operate complex enterprises in addition to their academic 

programs, including hospitals, research and development facilities, performing arts venues, 

athletic complexes, agricultural centers, residential complexes, and transportation systems. They 

frequently have open campuses that are integrated into the surrounding community, with visitors 

regularly on campus touring facilities, attending events, and receiving medical care. 

Many campuses house sensitive materials and information and sponsor activities and events that 

increase their vulnerability. It is common for major universities to employ people and establish 

facilities dedicated to research in areas such as nuclear energy, engineering, biochemistry, 

medicine, public safety, defense, technology, and intelligence. In addition, many universities 

house critical research. Major universities also serve as contractors to government agencies such 

as the Department of Defense, Department of Justice, National Institutes of Health, National 

Security Agency, and the National Aeronautics and Space Administration, as well as to the 

nation’s largest corporations, and thus house important information.

Additionally, IHE governance is highly varied and often widely dispersed. Many institutions 

have decentralized organizational structures and academic departments with differing processes 

and decision-making responsibilities. In addition, the variance in purpose, structure, authority, 

and operations among campus police and security agencies makes one-size-fits-all programs and 

policies impractical. 

IHEs serve primarily adult students who are capable of making decisions on their own. The 

campus population is perpetually in flux, changing from day to day, semester to semester, and 

year to year. Some students commute to and from campus, others attend class virtually, while 

still others live in housing facilities located on or near the college campus, resulting in a 

dispersed population. IHEs also often host individuals from other nations. 

While these characteristics pose challenges, in collaboration with their local government and 

community partners, IHEs can take steps to plan for these potential emergencies through the 

creation of a higher education Emergency Operations Plan (higher ed EOP). 

Lessons learned from emergencies at IHEs highlight the importance of preparing IHE officials 

and first responders to implement emergency operations plans. By having plans in place to keep 
2 

students and staff safe, IHEs play a key role in taking preventative and protective measures to 

stop an emergency from occurring or reduce the impact of an incident. When an emergency 

occurs, IHE personnel must respond immediately, providing first aid, notifying response 

partners, and providing instruction before first responders arrive. IHE officials must work with 

partners across the institution as well as their community partners (governmental organizations 

that have a responsibility in the IHE emergency operations plan) including first responders (law 

enforcement officers, fire department officials, and emergency medical services [EMS] 

personnel), emergency managers, and public health and mental health practitioners to provide a 

cohesive, coordinated response. 

It is recommended that planning teams at IHEs responsible for developing and revising a higher 

ed EOP use this document to guide their efforts. It is recommended that IHEs compare existing 

plans and processes against the content and process outlined in this guide. To gain the most from 

it, users should read through the entire document prior to initiating their planning efforts and then 

refer back to it throughout the planning process. 

The guide is organized in four sections: 









The principles of emergency management planning for IHEs. 

A process for developing, implementing, and continually refining a higher ed EOP with 

community partners. 

A discussion of the content of higher ed EOPs.

“A Closer Look” which considers key topics that support emergency management for 

IHEs, including the Clery Act, information sharing, international students, psychological 

first aid, campus climate, campus law enforcement officers, and active shooter situations. 

As the team that developed this guide began its work to respond to the president’s call for model 

emergency management plans for IHEs, it became clear that there is a need to help ensure that 

college and university emergency planning efforts are aligned with the emergency planning 

practices at the national, state, and local levels. Recent developments have put a new emphasis 

on the process for developing higher ed EOPs. 

National preparedness efforts, including planning, are now informed by Presidential Policy 

Directive (PPD)-8, which was signed by the president in March 2011 and describes the nation’s

approach to preparedness. This directive represents an evolution in our collective understanding 

of national preparedness, based on the lessons learned from terrorist attacks, hurricanes, school 

and IHE incidents, and other experiences. 

PPD-8 defines preparedness around five mission areas: Prevention, Protection, Mitigation, 

Response, and Recovery. 
3











Prevention,1 for the purposes of this guide, means the capabilities necessary to avoid, 

deter, or stop an imminent crime or threatened or actual mass casualty incident. Prevention 

is the action IHEs take to prevent a threatened or actual incident from occurring. 

Protection means the capabilities to secure IHEs against acts of terrorism and man-made 

or natural disasters. Protection focuses on ongoing actions that protect students, teachers, 

staff, visitors, networks, and property from a threat or hazard. 

Mitigation means the capabilities necessary to eliminate or reduce the loss of life and 

property damage by lessening the impact of an event or emergency. In this document, 

mitigation also means reducing the likelihood that threats and hazards will happen. 

Response means the capabilities necessary to stabilize an emergency once it has already 

happened or is certain to happen in an unpreventable way; establish a safe and secure 

environment; save lives and property; and facilitate the transition to recovery. 

Recovery means the capabilities necessary to assist IHEs affected by an event or 

emergency in restoring the learning environment. 

Emergency management officials and emergency responders engaging with IHEs are familiar 

with this terminology. These mission areas generally align with the three timeframes associated 

with an incident: before, during, and after. 

The majority of Prevention, Protection, and Mitigation activities generally occur before an 

incident, although these three mission areas do have ongoing activities that can occur throughout 

an incident. Response activities occur during an incident, and Recovery activities can begin 

during an incident and occur after an incident. To help avoid confusion over terms and allow for 

ease of reference, this guide uses “before”, “during”, and “after.”

As IHEs plan for and execute response and recovery activities through the higher ed EOP, they 

should use the concepts and principles of the National Incident Management System (NIMS).

One component of NIMS is the Incident Command System (ICS), which provides a standardized 

approach for incident management, regardless of cause, size, location, or complexity. By using 

ICS during an incident, IHEs will be able to more effectively work with the responders in their 

communities. For more information on ICS and NIMS, please see the Resources section. 

While some of the vocabulary, processes, and approaches discussed in this guide may be new to 

the higher education community, they are critical. The vocabulary, processes, and approaches are 

critical to the creation of emergency management practices and plans that are integrated with the 

efforts of first responders and other key stakeholders, and incorporate everything possible to 

keep our campus communities safe. If an IHE has an existing plan, revising and adapting that 

plan using the principles and process described in this guide will help ensure alignment with the 

terminology and approaches used across the nation. 

 

1

In the broader PPD-8 construct, the term “prevention” refers to those capabilities necessary to avoid, prevent, or 

stop a threatened or actual act of terrorism. The term “prevention” also refers to preventing imminent threats.
4 

The Departments issuing this guidance are providing examples of good practices and matters to 

consider for planning and implementation purposes. The guidance does not create any 

requirements beyond those included in applicable law and regulations, or create any additional 

rights for any person, entity, or organization. The information presented in this document 

generally constitutes informal guidance and provides examples that may be helpful. The 

inclusion of certain references does not imply any endorsement of any documents, products, or 

approaches. There may be other resources that may be equally helpful. 

This guide replaces Action Guide for Emergency Management at Institutions of Higher 

Education (January 2010), which is rescinded. 

All websites listed in this guide were last accessed on June 3, 2013. 
5

PLANNING PRINCIPLES

The following principles are key to developing a comprehensive higher ed EOP that addresses a 

range of threats and hazards: 

Planning must be supported by IHE senior leadership. The IHE president, chancellor, or 

provost initiates and supports planning efforts to help ensure engagement from the entire campus 

community. Since budgetary realities may force campus administrators to make decisions within 

select fiscal parameters, it is important to have high-level support to provide both political and 

financial backing to the effort. 

Planning uses assessment to customize plans to the individual institution. Effective planning 

is built around comprehensive, ongoing assessment of the IHE’s unique physical, social, and 

environmental characteristics, including the academic programs offered, size and geographic 

location of the campus, the number and types of buildings and facilities (including athletic, 

health, and research facilities), the availability of campus and community resources, student 

demographics, campus law enforcement officers and security personnel, and pertinent physical 

security information. 

Planning considers all threats and hazards. The planning process must take into account a 

wide range of possible threats and hazards that may impact the IHE. Comprehensive IHE 

emergency management planning considers all threats and hazards throughout the planning 

process, addressing safety needs before, during, and after an incident. 

Planning provides for the access and functional needs of the whole IHE community. The 

“whole IHE community” includes students, staff and visitors, including those with disabilities 

and others with access and functional needs, those from religiously, racially, and ethnically 

diverse backgrounds, and people with limited English proficiency. 

Planning considers all settings and all times. Higher ed EOPs must account for incidents that 

may occur at any hour of the day or night, in numerous buildings and off-campus sites or satellite 

locations, including, but not limited to, laboratories and other facilities that house potentially 

dangerous materials. 

Planning considers the individual preparedness of students, faculty, and staff. The planning 

team should raise awareness of the importance of individual preparedness. Students should be 

informed of the possibility of a prolonged shelter-in-place condition and should understand that 

they will be responsible for ensuring that they have the necessary supplies, such as access to 

sufficient medication.

Planning meets the requirements of all applicable laws. A number of laws at all levels of 

government may apply to IHEs. For example, the Clery Act includes requirements for emergency 

response and evacuation procedures, as well as timely warning and emergency notifications. 

Creating and revising a model emergency operations plan is done by following a 

collaborative process. This guide provides a process, plan format, and content guidance that are 

flexible enough for use by all IHE emergency planning teams. If a planning team also uses 

templates, it must first evaluate their usefulness to ensure the tools do not undermine the 
6 

collaborative initiative and collectively shared plan. There are some jurisdictions that provide 

templates to IHEs, and these will reflect state and local mandates, as applicable. 

THE PLANNING PROCESS

Effective emergency management planning and development of a higher ed EOP are not done in 

isolation. It is critical that IHEs work with their community partners including first responders 

(e.g., law enforcement officers, fire officials, EMS personnel), emergency managers, public 

health officials, and mental health officials as well as with other local governmental officials and 

community organizations during the planning process, as an effective higher ed EOP is 

integrated with community, regional, and state plans. This collaboration makes more resources 

available and helps to ensure the seamless integration of all responders. 

There are many ways to develop a higher ed EOP. The planning process discussed in this section 

is flexible and can be adapted to accommodate an IHE’s unique characteristics and situation. 

IHEs can use the process outlined below to develop a plan, do a comprehensive review of their 

entire plan, or conduct periodic and incremental reviews of the plan’s components. 

Figure 1 depicts the six steps in the planning process.2 At each step in the planning process, IHEs 

should consider the impact of their decisions on ongoing activities such as training and exercises, 

as well as on equipment and resources. 

Figure 1: Steps in the Planning Process 

Step 1: Form a Collaborative Planning Team 

Lessons learned indicate that operational planning is best performed by a team. Case studies 

reinforce this concept by pointing out that the common thread found in successful operations is 

 

2

 U.S. Department of Homeland Security, Federal Emergency Management Agency. Developing and Maintaining 

Emergency Operations Plans: Comprehensive Preparedness Guide 101, Version 2.0. Washington, DC: Author, 

November 2010. Available at http://www.fema.gov/pdf/about/divisions/npd/CPG_101_V2.pdf. 
7

that participating organizations have understood and accepted their roles. Close collaboration 

between IHEs and their community partners ensures the coordination of efforts and the 

integration of emergency management plans. 

Identify Core Planning Team: The core planning team should include representatives from 

across the IHE. The table below illustrates some of the contributions that various IHE 

departments may make to the planning team. The team should also include student and family 

representatives, to the extent applicable. Additionally, the team should include individuals and 

organizations that serve and represent the interests of students, staff, and families with 

disabilities and others with access and functional needs, as well as those from diverse racial, 

ethnic, linguistic, and religious backgrounds, including international student populations, so that 

specific concerns will be included from the early stages of planning. In addition, the core 

planning team should include first responders (e.g., law enforcement officers, EMS personnel 

fire department officials), local emergency managers and public and mental health practitioners, 

all of whom have roles and responsibilities in IHE emergency management before, during, and 

after an incident. Campus and community partners’ expertise will inform the development, 

implementation, and refinement of the higher ed EOP. 

Table 1: Contributions to the Planning Team 

Department3

Illustrative Contributions 

to the Planning Team

Academic Affairs  Develop procedures to communicate with 

and account for teaching faculty in an 

emergency situation

 Develop plans to identify alternate facilities 

where institutional activities can be 

conducted in the event of the destruction, 

disablement, or denial or lack of access to 

existing facilities

 Identify and prioritize critical support services 

and systems

 Identify and help ensure recovery of critical 

assets and information

 Participate in the threat assessment team

(TAT)

 

3 Across varying types of IHEs, these departments are key to university functioning.
8 

Department3

Illustrative Contributions 

to the Planning Team

Business Office 





































Develop the processes and procedures for 

tracking employees’ time and issuing 

paychecks during disaster operations

Develop procedures for procuring 

emergency resources for responding to and 

recovering from emergencies

Develop the process for documenting the 

financial cost of emergency response and 

recovery operations

Develop a Business Continuity Plan (BCP)

Central Administration or Designee Provide resources and leadership support to 

drive the initiative

Develop procedures for declaring an 

emergency

Identify alternate administrative facilities

Develop procedures for increasing public 

information efforts

Develop and coordinate procedures for 

recruiting volunteers and additional staff

Develop procedures to coordinate and 

approve volunteers and manage donations 

during an emergency

Develop a Continuity of Operations (COOP)

Annex

Counseling and Mental Health Services Identify and train appropriate staff to provide 

developmentally and culturally appropriate 

mental health services

Train mental health staff on specific 

interventions

Provide basic training on available resources 

and common reactions to trauma for all staff 

(including administrators)

Train faculty and other staff on early warning 

signs of individuals who pose a potential 

danger

Assemble and train recovery teams

Identify both internal and external partners 

(consider local mental health agencies that 

may be able to assist, and develop a 

structure for support) and develop 

partnership agreements

Develop template letters (that can be 

tailored) for alerting students, families, staff, 

and the community to emergencies

Participate in the TAT
9

Department3

Illustrative Contributions 

to the Planning Team

EMS 































Develop and coordinate procedures for 

mobilizing resources needed for significant, 

longer-term emergencies

Identify sources for mutual aid agreements 

and assistance

Environmental Health and Safety Participate in vulnerability and hazard 

assessments

Review and update office standard operating 

procedures to align with the higher ed EOP 

Develop procedures for pre-positioning 

resources and equipment

Review and update processes and 

procedures for state and federal disaster 

declaration requests

Develop, review, and update state and 

federally required environmental emergency 

response plans, including management 

procedures for the plans

Coordinate with public safety operations 

(see next entry) to develop the process and 

procedures for increasing public information

Provide warning system information 

Facilities and Operations Participate in vulnerability and hazard 

assessments

Provide floor plans with room layout, 

electrical sources, and entrance and exit 

points for all campus buildings

Develop procedures for pre-positioning 

resources and equipment

Identify sources for mutual aid agreements 

and assistance 

Food Services Identify possible threats and mitigation 

strategies relating to food safety

Develop procedures for providing food to 

students, staff, faculty, and community 

partners during a major emergency

Develop mutual aid agreements for 

obtaining, preparing, and distributing food 
10

Department3

Illustrative Contributions 

to the Planning Team

Health Services 























Develop procedures to determine if there are 

adequate supplies and equipment to triage 

for an emergency and to support community 

health partners

Develop procedures for mobilizing personnel 

on campus and at external sites

Develop procedures for developing mutual 

aid agreements

Develop pandemic flu and infectious disease 

plans

Develop a system for disease surveillance 

and tracking

Coordinate with local and state public health 

partners

Human Resources Develop plans to maintain the continuity of 

the payroll together with the business office 

(see above) during an emergency

Develop plans to maintain employee benefit 

services during an emergency

Develop plans to hire or replace staff with 

temporary employees, if needed

Develop plans to serve as the liaison or 

organizer, or both, of volunteer assistance 

in the event of an emergency

Prepare to execute components of the 

COOP relating to staffing, including 

assessing faculty and staff availability, 

appropriation of personnel, and assisting 

employees with work-recovery needs (e.g., 

psychological help, time off for personal 

needs)

Develop processes to account for personnel 

during or after an event
11

Department3

Illustrative Contributions 

to the Planning Team

Information Technology 

























Develop procedures and systems for 

checking critical information and alert 

systems to disseminate emergency 

information in an accessible format via a 

website, cell phone, e-mail, and other

mechanisms. Coordinate beforehand with all 

departments to provide unified and factual 

messages to students, staff, faculty, families, 

and the media using multiple modalities, and 

in consideration of different language needs 

or accommodations, including effective 

communication with individuals with 

disabilities and others with access and 

functional needs, such as those who are 

blind or deaf.

Identify information technology resources 

needed to facilitate the emergency 

operations of all campus departments

Identify the need for and sources of 

emergency communication devices (e.g., 

ham radios, cell phones)

Develop plans to continue academic 

programs that significantly use technology 

for teaching purposes 

Legal Counsel Provide legal counsel on campus liability to 

key decision makers

Coordinate investigations completed by 

community partners

Review messages drafted by Public 

Information Officer (PIO)

Ensure that all campus and community 

actions are documented with a rationale for 

the action

Participate in the threat assessment team

Ensure compliance with applicable laws

Public Information Office Coordinate beforehand with all departments 

to provide unified and factual messages to 

students, staff, faculty, families, and the 

media using multiple modalities

Develop pre-agreements with the media 

concerning debriefings and media holding 

areas during an emergency

Designate a campus spokesperson 
12

Department3

Illustrative Contributions 

to the Planning Team

Public Safety Operations 

















Develop procedures for reviewing and 

updating higher ed EOP

Develop procedures for facilities and 

equipment, including testing systems

Develop procedures for mobilizing 

department of public safety personnel, and 

pre-positioning resources and equipment

Develop a process for managing incidents at 

the field level using the ICS

Develop a process for communicating with 

and directing the central dispatch center, 

including the activation of the emergency 

contact list 

Develop procedures to warn threatened 

elements of the population, including those 

individuals with different language needs or 

accommodations needs, including effective 

communication with individuals with 

disabilities and others with access and 

functional needs (e.g., those who are deaf 

or blind)

Ensure that hazardous material procedures 

are consistent with the state and local 

environmental safety hazardous materials 

plans

Participate in the TAT 

Become proficient in the understanding and 

use of the NIMS and ICS structures

referenced in this document
13

Department3

Illustrative Contributions 

to the Planning Team

Residential Life 













Develop procedures to coordinate the need 

for on-campus housing, temporary shelters, 

and temporary off-campus housing 

locations, including consideration of physical 

accessibility for individuals with disabilities 

and others with access and functional needs

Develop procedures for mobilizing 

residential life personnel and pre-positioning 

resources

Develop an on-call staffing system to ensure 

staff are available at all times

Develop procedures for identifying resident 

students in need of emergency evacuation 

assistance

Develop procedures for the evacuation and 

temporary shelter accommodations for 

resident students

Develop procedures for checking residential 

facilities and equipment

Participate in the TAT
14

Department3

Illustrative Contributions 

to the Planning Team

Student Affairs 

























Develop reunification procedures in 

collaboration with community reunification 

initiatives

Develop procedures for checking student 

affairs facilities and equipment, including 

those relating to on-campus recreation, 

student organizations, on-campus 

employment, community service, and 

volunteerism

Develop procedures for addressing the 

needs of students living in Greek housing or 

off-campus facilities

Develop procedures for pre-positioning 

resources to maintain functioning of such 

campus elements as career services and 

student government

Develop mutual aid agreements and prenegotiate with service providers for 

delivering goods and services in the event of 

an emergency

Ensure that all obligations under the 

Americans with Disabilities Act are 

considered throughout the planning and 

implementation of the higher ed EOP

Ensure that the plan is accessible to 

students whose primary language is not 

English

Develop parent or family notification 

procedures

Participate in the TAT

Create a Campus Community Emergency 

Response Team (Campus CERT)

Transportation Develop procedures for mobilizing campus 

wide transportation for an emergency and for 

maintaining control of traffic from private 

vehicles

Develop evacuation procedures from various 

campus locales

Develop procedures for IHE-sponsored 

transportation (e.g., buses)
15

Department3

Illustrative Contributions 

to the Planning Team

International Student Services Office 





Develop procedures for staff to support 

COOP during crises, including ongoing 

management of the access to the Student 

and Exchange Visitor Information System 

(SEVIS)

Develop procedures for international 

students to communicate safety 

concerns, location, and short-term plans 

during an emergency

Coordinate beforehand with all staff and 

international students to distribute 

communication procedures during an 

emergency

The planning team should be small enough to permit close collaboration, yet large enough to be 

representative of the campus community and its families, as well as its broader community. It 

should also be large enough to not place an undue burden on any single person. 

Connecting the Planning Team to Local or Regional, 

State, Tribal, and Federal Emergency Planning

IHEs undertake emergency operations planning within the context of local or regional, state, 

tribal, and federal agency emergency planning. In order to promote coordination among 

these entities, the planning team is strongly encouraged to include a local or regional 

emergency planning representative. The local or regional emergency planning policies, 

procedures, and training activities will inform and enhance the IHE’s planning to a significant 

degree. Similarly, representatives from the IHE planning team should participate on their 

partners’ teams.

In addition, from the onset, the planning team should be aware of any local, state, or federal 

requirements that may apply to the campus EOP.

Form a Common Framework: All team members need to take time to learn each other’s 

vocabulary, command structure, and culture to facilitate effective planning. 

Define and Assign Roles and Responsibilities: Each person involved in the development and 

refinement of the plan should know his or her role and responsibilities in the planning process. 

Determine a Regular Schedule of Meetings: IHE emergency management planning is an 

ongoing effort that is reinforced through regularly scheduled planning meetings. Establishing a 

flexible but regular schedule of meeting times will facilitate greater collaboration, coordination, 

and communication among team members and will help solidify crucial relationships. 
16

Step 1 Outcome 

After completing Step 1, the IHE has formed a planning team with representatives from all 

necessary stakeholders. The planning team has taken initial steps to form a common framework, 

define and assign roles and responsibilities in the planning process, and set a schedule of 

planning meetings. 

Step 2: Understand the Situation 

In Step 2, the planning team identifies possible threats and hazards, and assesses the risk and 

vulnerabilities posed by those threats and hazards. 

Effective planning depends on a consistent analysis and comparison of the threats and hazards a 

particular IHE faces. This is typically performed through a threat and hazard identification, and 

risk assessment process that collects information about threats and hazards, and assigns values to 

risk for the purposes of deciding which threats or hazards the plan should prioritize and 

subsequently address. 

Identify Threats and Hazards

The planning team first needs to understand the threats and hazards faced by the IHE and the 

surrounding community. 

The planning team can draw upon a wealth of existing information to identify the range of 

threats and hazards that might be faced by the IHE. First, the planning team members should 

share their own knowledge of threats and hazards the IHE and surrounding community have 

faced in the past or may face in the future. Institutional data, including crime statistics and crime 

logs required under the Clery Act4 may provide guidance (see the “A Closer Look” section, “The 

Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act” for more 

information about the Clery Act). The planning team should then reach out to local, state, and 

federal agencies for data about historical threats and hazards faced by the surrounding 

community. Local and county agencies that have a knowledge of threats and hazards include, but 

are not limited to, emergency management offices, fire and police departments, as well as local 

organizations and community groups (e.g., local chapter of the American Red Cross, CERT),

utilities, and other businesses that can provide helpful information.

Assess the Risk Posed by the Identified Threats and Hazards 

Once an initial set of threats and hazards have been identified through the process described 

above, the planning team should select suitable assessment tools to evaluate the risk posed by the 

 

4

 The Clery Act is the Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act (20 

U.S.C. Section 1092(f)).
17

identified threats and hazards.5Evaluating risk entails understanding the probability that the 

specific threat or hazard will occur; the effects it will likely have, including the severity of the 

impact; the time the IHE will have to warn students, faculty, and staff about the threat or hazard; 

and how long it may last. 

The local and county emergency management staff should be able to provide information on 

some of the risks posed by threats and hazards common to the IHE and surrounding community. 

This enables the planning team to focus its assessment efforts on threats and hazards unique to 

the campus community, as well as the particular vulnerabilities of the buildings and facilities, 

and their occupants. 

“Vulnerabilities” refers to the characteristics of the IHE (e.g., buildings, equipment, IT, or 

electrical systems, grounds, surrounding area) that could make it more susceptible to the 

identified threats and hazards. Assessing risk and vulnerability enables the planning team to 

focus its efforts on prioritized threats and hazards. 

There are numerous assessments that the planning team may use, including site assessments, 

culture and climate assessments, behavioral threat assessments, and capacity assessments. These 

assessments will help the planning team not only assess risk but also identify resources and 

issues that the plan may need to address. Through the assessment process, the planning team may 

also identify additional threats and hazards. 

The most successful assessments are conducted by a broad array of individuals, including 

support staff and first responders. Students and families, including students and families with 

disabilities and others with access and functional needs, should be included to the maximum 

extent appropriate. The assessment has to be strategic. If the IHE is in an isolated region of a 

county and the response times for law enforcement, fire department and EMS personnel are 

lengthy, that may alter the calculus of the assessment, and, if response time is lengthy, other 

security measures may need to be enacted to compensate for lengthy response times. Successful 

assessments also take into account strategic issues, such as the location of the IHE and the speed 

by which outside assets could arrive. 

Assessments will be used not only to develop the initial plan but also to inform updates and 

revisions to the plan on an ongoing basis. The table below provides more information about 

some of the most essential assessments the planning team should undertake (see Resources 

section for A Guide to School Vulnerability Assessments produced by the Readiness and 

Emergency Management for Schools Technical Assistance Center. 

 

5

 For more information on the threat and hazard identification and risk assessment process, please see the Federal 

Emergency Management Agency’s Threat and Hazard Identification and Risk Assessment Guide (CPG 201) 

available at http://www.fema.gov/plan/. 
18

Table 2: Assessment 

Assessment Description Purpose and Results

Site 

Assessment

A site assessment examines the safety, 

accessibility, and emergency 

preparedness of the buildings, facilities, 

and grounds. This assessment includes,

but is not limited to, a review of building 

access control measures, visibility 

around the exterior of the buildings, 

compliance with applicable architectural 

standards for individuals with disabilities

and others with access and functional 

needs, structural integrity of the 

buildings, and emergency vehicle 

access.













Increased understanding of the 

potential impact of threats and 

hazards on the buildings, 

facilities, and grounds. 

Increased understanding of risk 

and vulnerabilities of the 

buildings, facilities, and grounds 

when developing the plan.

Knowledge of which facilities are 

physically accessible to 

individuals with disabilities and 

others with access and 

functional needs and can be 

used in compliance with the law.

Climate 

Assessment

In a nurturing, inclusive environment, 

members of a community are more likely 

to succeed, feel safe, and report threats.

If a student survey is used to assess 

culture and climate, student privacy must 

be protected. A range of personnel 

across the IHE can assist in the 

assessment of climate, including 

counselors and mental health staff.

Knowledge of students’ and 

staff’s perceptions of their 

safety.

Knowledge of problem 

behaviors that need to be 

addressed to improve climate.

Threat 

Assessment 

Teams

A campus threat assessment analyzes 

campus members’ communications and 

behaviors to determine whether or not a 

member may pose a threat. These 

assessments must be based on fact 

must comply with applicable privacy, 

civil rights, and other applicable laws

and are often conducted by multidisciplinary TATs. While a planning 

team may include the creation of a 

threat assessment team in its plan, the 

assessment team is a separate entity 

from the planning team and meets on its 

own regular schedule.

Students, staff, or other 

persons that may pose a threat 

are identified before a threat 

develops into an incident and 

are referred for services.

 
19

Assessment Description Purpose and Results 

Capacity 

Assessment

The planning team needs to know what 

resources will be at its disposal. A 

capacity assessment examines the 

capabilities of students, faculty, and staff 

as well as the services and material 

resources of community partners. This 

assessment is used to identify 

individuals on campus with applicable 

training and skills (e.g., first aid 

certification, search and rescue training, 

counseling and mental health expertise,

ability to assist individuals with 

disabilities and others with access and 

functional needs). Equipment and 

supplies should also be inventoried. The 

inventory should include an evaluation of

equipment and supplies uniquely for 

individuals with disabilities and others

with access and functional needs, such 

as evacuation chairs, the availability of 

sign language interpreters and 

technology used for effective 

communication, accessible 

transportation, and consumable medical 

supplies and durable medical equipment 

that may be necessary during a shelterin-place or evacuation.





An increased understanding of 

the resources available.

Information about staff 

capabilities will help planners 

assign roles and responsibilities 

in the plan.

After conducting these assessments, the planning team should consolidate all of the information 

it has obtained into a format that is usable for comparing the risks posed by the identified threats 

and hazards. This information will then be used to assess and compare the threats and hazards, 

and their likely consequences. This is referred to as a “risk and vulnerability assessment.” One 

effective method for organizing information is to create a table with a range of information about 

each possible threat and hazard, including any new threats or hazards identified through the 

assessment process. The table should include: 











Probability or frequency of occurrence (i.e., how often a threat or hazard may occur); 

Magnitude (i.e., the extent of expected damage); 

Time available to warn staff, students, and visitors; 

Duration (i.e., for how long the hazard or threat will be occurring); and 

Follow-on and cascading effects of threat or hazard. 
20

While some of the information collected will directly feed into this table, other information, for 

example details on campus climate challenges, may have to be organized differently. The most 

important outcome is that information is clearly presented so that it can be easily used to inform 

the plan’s development. 

Prioritize Threats and Hazards 

Next, the planning team should use the information it has organized to compare and prioritize the 

risks posed by threats and hazards. This will allow the team to decide which threats or hazards it 

will directly address in the plan. The team must consider several factors in order to develop an 

indicator of risk. One option is a mathematical approach, which assigns index numbers (e.g., a 

1-to-4 scale) for different categories of information used in the ranking scheme. Using this 

approach, the planning team will categorize threats and hazards as posing a relatively high, 

medium, or low risk. The Table 3 below (separate from the Table 2, above) provides a sample 

risk assessment worksheet for comparing and prioritizing threats and hazards. 

Table 3: Sample Risk Assessment Worksheet 

Hazard Probability Magnitude Warning Duration Risk Priority

Fire 4. Highly likely

3. Likely

2. Possible

1. Unlikely

4. Catastrophic

3. Critical

2. Limited

1. Negligible

4. Minimal

3. 6–12 hrs.

2. 12– 24 hrs.

1. 24+ hrs.

4. 12+ hrs.

3. 6–12 hrs.

2. 3– 6 hrs.

1. < 3 hrs.

 High 

 Medium 

 Low 

Hazmat 

spill inside 

a campus 

building

4. Highly likely

3. Likely

2. Possible

1. Unlikely

4. Catastrophic

3. Critical

2. Limited

1. Negligible

4. Minimal

3. 6–12 hrs.

2. 12–4 hrs. 

1. 24+ hrs.

4. 12+ hrs.

3. 6–12 hrs.

2. 3–6 hrs.

1. < 3 hrs.

 High

 Medium

 Low

Step 2 Outcome 

After completing Step 2, the planning team has a prioritized (high, medium, or low risk) list of 

threats and hazards based on the results of the risk assessment. 

Step 3: Determine Goals and Objectives 

In Step 3, the planning team decides which of the threats and hazards identified in Step 2 will be 

addressed in the higher ed EOP. The planning team may decide to address only those threats and 
21

hazards that rank “high” in risk priority, or they may decide to also address some of the threats 

and hazards that rank “medium.” This is a critical decision point in the planning process that is 

left up to the planning team. It is recommended that the team address more than just the “high” 

risk priority threats and hazards. 

Once the planning team has decided which threats and hazards will be addressed in the higher ed 

EOP, it will develop goals and objectives for each. 

Develop Goals and Objectives 

Goals are broad, general statements that indicate the desired outcome in response to the threat or 

hazard identified by planners in the previous step. They are what personnel and other resources 

are supposed to achieve. They also help identify when major activities are complete and what 

defines a successful outcome. 

The planning team should develop at least three goals for addressing each threat or hazard 

(though the planning team may want to identify more). Those three goals should indicate the 

desired outcome for (1) before; (2) during, and (3) after the threat or hazard. For a fire, for 

instance, three possible goals include 







Hazard Goal Example 1 (before): Prevent a fire from occurring in IHE-governed student 

housing facilities.

Hazard Goal Example 2 (during): Protect all persons from injury and property from 

damage by the fire. 

Hazard Goal Example 3 (after): Provide necessary medical attention to those in need. 

Objectives are specific, measurable actions that are necessary to achieve the goals. Often, 

planners will need to identify multiple objectives in support of a single goal. 

Using the goal in Example 1 of preventing a fire in IHE-governed student housing facilities, 

possible objectives include 





Objective 1.1: Provide fire prevention training to all students and resident advisors who 

use combustible materials or equipment. 

Objective 1.2: Store combustible materials in fireproof containers or rooms. 

Using the goal in Example 2 of protecting all persons from injury by the fire, possible objectives 

include 





Objective 2.1: Evacuate all persons from the building immediately. 

Objective 2.2: Account for all persons. 

Using the goal in Example 3 of providing necessary medical attention to those in need, possible 

objectives include 
22





Objective 3.1: Immediately notify fire department and EMS personnel of any fire in a 

student housing facility. 

Objective 3.2: Immediately begin to provide first aid. 

After the team has finished compiling the objectives for the prioritized threats and hazards, it will 

find that certain critical “functions” or activities, apply to more than one threat or hazard. 

Examples of these cross-cutting functions include evacuating, providing medical care, and 

accounting for all students, faculty, staff, and visitors. 

After identifying these functions, the planning team should develop three goals for each function. 

As with the goals already identified for threats and hazards, the three goals should indicate the 

desired outcome for (1) before, (2) during, and (3) after the function has been executed. These 

commonly occurring functions will be contained in a “Functional Annex” within the higher ed 

EOP. More details on these functions are included in the Plan Content section of this guide, 

including issues to consider as you develop goals and objectives for these functions. 

For an evacuation function, three possible goals are 







Function Goal Example 1 (before): Ensure all students, faculty, and staff know the 

evacuation routes for the chemistry building. 

Function Goal Example 2 (during): Evacuate the chemistry building immediately. 

Function Goal Example 3 (after): Confirm that all individuals have left the chemistry 

building.

Once the goals for a function are identified, possible supporting objectives are identified. For the 

evacuation goals above, objectives could include 







Objective 1.1 (before): Assess, identify, and communicate the location of rally points to 

be used during an evacuation of the chemistry building. 

Objective 2.1 (during): Evacuate the chemistry building using assigned routes. 

Objective 3.1 (after): Safely sweep the chemistry building. 

Step 3 Outcome 

After completing Step 3, the planning team has at least three goals (i.e., before, during, and after) 

for each threat or hazard and function, as well as objectives for each goal. 
23

Step 4: Plan Development (Identifying Courses of Action) 

In Step 4, the planning team develops courses of actions for accomplishing each of the objectives 

identified in Step 3 (for threats, hazards, and functions). Courses of action address the what, who,

when, where, why, how for each threat, hazard, and function. The planning team should examine 

each course of action to determine whether it is feasible and whether the stakeholders necessary 

to implement it find it acceptable. For additional issues to consider as you develop courses of 

action for functions, please see the Plan Content section. 

Courses of action include criteria for determining how and when each response will be 

implemented under a variety of circumstances. Subsequently, the planning team develops 

response protocols and procedures to support these efforts. 

Possible courses of action are typically developed using the following steps: 

1. Depict the scenario. Create a potential scenario based on the threats and hazards 

identified and prioritized in Step 2. 

2. Determine the amount of time available to respond. This will vary based on the type 

of threat or hazard and the particular scenario. For example, in the case of a hurricane, the 

IHE might have days or hours to respond before the storm makes landfall, while the IHE 

may have to respond in minutes to an active shooter.

3. Identify decision points. Decision points indicate the place in time, as threats or hazards 

unfold, when leaders anticipate making decisions about a course of action. Walking 

through each scenario in detail will help identify the relevant decision points for each 

one, such as whether or not to evacuate, shelter-in-place, or lockdown. 

4. Develop courses of action. Planners develop courses of action to achieve their goals and 

objectives by answering the following questions: 

















What is the action? 

Who is responsible for the action? 

When does the action take place? 

How long does the action take and how much time is actually available? 

What has to happen before? 

What happens after? 

What resources are needed to perform the action? 

How will this action affect specific populations, such as individuals with disabilities and 

others with access and functional needs who may require medication, wayfinding, 

evacuation assistance, or personal assistance services, or who may experience severe 

anxiety during traumatic events? 
24

PLANS MUST COMPLY WITH THE AMERICANS WITH DISABILITIES ACT

Plans must comply with the Americans with Disabilities Act, among other prohibitions on 

disability discrimination, across the spectrum of emergency management services, 

programs, and activities, including preparation, testing, notification and alerts, evacuation, 

transportation, sheltering, emergency medical care and services, transitioning back, 

recovery, and repairing and rebuilding. Plans should include students, staff, and parents with 

disabilities. Among other things, IHE emergency plans must address the provision of 

appropriate auxiliary aids and services to ensure effective communication with individuals 

with disabilities (e.g., interpreters, captioning, and accessible information technology); ensure 

individuals with disabilities are not separated from service animals and assistive devices, and 

can receive disability-related assistance throughout emergencies (e.g., assistance with 

activities of daily living, administration of medications, etc.); and comply with the law’s 

architectural and other requirements. (Information and technical assistance about the 

Americans with Disabilities Act is available at http://www.ada.gov.)

Select courses of action 

After developing courses of action, planners compare the costs and benefits of each proposed 

course of action against the goals and objectives. Based on this comparison, planners select the 

preferred course or courses of action to move forward in the planning process. Plans often 

include multiple courses of action for a given scenario to reflect the different ways it could 

unfold. 

After selecting courses of action, the planning team identifies resources necessary to accomplish 

each course of action without regard to resource availability. Once the planning team identifies 

all of the requirements, it begins matching available resources to requirements. This step 

provides planners an opportunity to identify resource gaps or shortfalls that must be taken into 

account. 

Step 4 Outcome 

After completing Step 4, the planning team will have identified goals, objectives, and courses of 

action for before, during, and after threats and hazards, as well as functions. 

Goals, objectives, and courses of action for threats and hazards will go into the “Threat- and 

Hazard-Specific Annexes” section of the higher ed EOP. 

PLANS MUST ADDRESS LANGUAGE ACCESS

Effective communication with individuals with limited English proficiency (LEP), including 

students and parents, is an essential component of emergency planning and response. 

Plans must comply with applicable legal requirements on language access, including Title VI 

of the Civil Rights Act of 1964 (available at 

http://www.justice.gov/crt/about/cor/coord/titlevi.php) and the Title VI regulation of the Civil 

Rights Act of 1964 (available at http://www.justice.gov/crt/about/cor/fedagencies.php).
25

Goals, objectives, and courses of action for functions will be contained in the “Functional 

Annexes” section of the higher ed EOP. 

Step 5: Prepare, Review, and Approve the Plan 

In Step 5, the planning team develops a draft of the higher ed EOP using the courses of action 

developed in Step 4. In addition, the team reviews the plan, obtains official approval, and shares 

the plan with community partners (e.g., first responders, local emergency managers, public and 

mental health officials), staff, and stakeholders. 

Format the Plan 

An effective higher ed EOP is presented in a way that makes it easy for users to find the 

information they need and that is compatible with local and state plans. This may include using 

plain language and providing pictures or visual cues for key action steps. This guide presents a 

traditional format that can be tailored to meet individual IHE needs. This format has three major 

sections: the Basic Plan, Functional Annexes, and Threat- and Hazard-Specific Annexes. 

The Basic Plan section of the higher ed EOP provides an overview of the IHE’s approach to 

emergency operations. Although the Basic Plan section guides the development of the more 

operationally oriented annexes, its primary audiences consist of the IHE, local emergency officials, 

and the community (as appropriate). The elements listed in this section should meet the needs of 

these audiences while providing a solid foundation for the development of supporting annexes. 

The Functional Annexes section details the goals, objectives, and courses of action of functions 

(e.g., evacuation, communications, recovery) that apply across multiple threats or hazards. 

Functional Annexes set forth how the IHE manages a function before, during, and after 

an emergency. 

The Threat- and Hazard-Specific Annexes section specifies the goals, objectives, and courses of 

action that an IHE will follow to address a particular type of threat or hazard (e.g., hurricane, 

active shooter). Threat- and Hazard-Specific Annexes, like Functional Annexes, discuss how the 

IHE manages a function before, during, and after an emergency. 

The following functional format can be used for the Functional Annexes section as well as for 

the Threat- and Hazard-Specific Annexes sections. Using the format below and the work the 

planning team did in Step 4, each function, threat, and hazard will have at least three goals, with 

one or more objectives for each goal, and a course of action for each of the objectives. 







Title (the function, threat, or hazard) 

Goal(s) 

Objective(s) 
26

 Courses of action (Describe the courses of action you developed in Step 4 in the sequence 

in which they will occur). 

Figure 2 below outlines the different components of each of these three sections. This guide 

details the contents of these three sections under Plan Content6.

Figure 2: Traditional EOP Format

Higher Ed EOP Format

Basic Plan

1. Introductory Material

1.1. Cover Page

1.2. Promulgation Document and 

Signatures Page

1.3. Approval and Implementation

1.4. Record of Changes

1.5. Record of Distribution

1.6. Table of Contents

2. Purpose, Scope, Situation Overview, 

and Assumptions

2.1. Purpose

2.2. Situation Overview

2.3. Planning Assumptions

3. Concept of Operations

4. Organization and Assignment of 

Responsibilities

5. Direction, Control, and Coordination

6. Information Collection, Analysis, and 

Dissemination

7. Training and Exercises 

8. Administration, Finance, and Logistics

9. Plan Development and Maintenance

10. Authorities and References

Functional Annexes

NOTE: This is not a complete list, but it is 

recommended that all EOPs include at least 

the following functional annexes:

1. Evacuation

2. Deny Entry or Closing (Lockdown)

3. Shelter-in-Place or Secure-In-Place

4. Accounting for All Persons

5. Communications and Notifications 

6. Continuity of Operations (COOP)

7. Recovery

8. Public Health, Medical and Mental 

Health

9. Security 

10. Rapid Assessment

Threat- or Hazard-Specific Annexes

NOTE: This is not a complete list. Each IHE’s 

annexes will vary based on its threats and 

hazard analysis.

1. Hurricane or Severe Storm

2. Earthquake

3. Tornado

4. Hazardous Materials Incident

5. Mass Casualty Incident

6. Active Shooter

7. Pandemic or Disease Outbreak

8. Bomb Threat or Explosion

Write the Plan 

As the planning team works through the draft, the members add necessary tables, charts, and 

other supporting graphics. The planning team circulates a draft to obtain the comments of 

stakeholders that have responsibilities for implementing the plan. Successful plans are written 

according to the following simple rules: 

 

6

 The term annex is used throughout this guide to refer to functional, hazard-, or threat-specific, or other 

supplements to the basic plan. Some plans may use the term appendix in the same fashion (e.g., hazard-specific 

appendix). 
27

1. Summarize important information with checklists and visual aids, such as maps and 

flowcharts. 

2. Avoid using jargon, minimize the use of abbreviations, and use short sentences and the 

active voice. Qualifiers and vague wording only add to confusion. 

3. Write clearly, using plain language. Use a logical, consistent structure that makes it easy 

for readers to grasp the rationale for the sequence of the information and to scan for the 

information they need. 

4. Provide enough detail to convey an easily understood plan that is actionable. For 

example, faculty may have a one-page document that covers what they will need to know 

and do during an emergency, or create signs giving simple directions. Organize the 

contents in a way that helps users quickly identify solutions and options. Plans should 

provide guidance for carrying out common courses of action, through the functional and 

Threat- and Hazard-Specific Annexes, while also staying out of the weeds. 

5. Develop accessible tools and documents. Use appropriate auxiliary aids and services 

necessary for effective communication, such as accessible websites, digital text that can 

be converted to audio or Braille, text equivalents for images, and captioning of any audio 

and audio description of any video content. 

Review the Plan 

Planners should check the written plan for compliance with applicable laws and for its usefulness 

in practice. Commonly used criteria can help determine the effectiveness and efficiency of the 

plan. The following measures can help determine if a plan is of high quality: 



















A plan is adequate if it identifies and addresses critical courses of action effectively, it

can accomplish the assigned function, and its assumptions are valid and reasonable. 

A plan is feasible if the IHE can accomplish the assigned function and critical tasks by 

using available resources within the time contemplated by the plan. 

A plan is acceptable if it meets the requirements driven by a threat or hazard, meets cost 

and time limitations, and is consistent with the law. 

A plan is complete if it 

Incorporates all courses of action to be accomplished for all selected threats and hazards 

and identified functions; 

Integrates the needs of the whole IHE community; 

Provides a complete picture of what should happen, when, and at whose direction; 

Estimates time for achieving objectives, with safety remaining as the utmost priority; 

Identifies success criteria and a desired end state; and 
28





Conforms with the Planning Principles outlined in this guide. 

The plan must comply with applicable states and local requirements because these 

provide a baseline that facilitates both planning and execution. 

Additionally, when reviewing the plan, the planning team does not have to provide all of the 

resources needed to execute a course of action or meet a requirement established during the 

planning effort. However, the plan should explain where or how the IHE will obtain the 

resources to support those requirements. 

Approve and Share the Plan 

After finalizing the plan, the planning team should present it to the appropriate leadership and 

obtain official approval of the plan. The team should then share the plan with all community 

partners (e.g., first responders, local emergency managers, public and mental health officials) 

and all other entities that have a role in the plan, including relevant local, regional, and/or state 

agencies with which the plan will be coordinated. The plan should also be shared with other 

organizations that may use the campus and its building(s). 

Institutions should be careful to protect the plan from those who are not authorized to have it, 

and should consider how they will secure documents shared electronically. Law enforcement 

agencies and first responders have a secured, web-accessible site available to house copies of 

plans, building schematics, phone contact sheets, and other important details that round out 

planning. IHEs must comply with states and local open records laws in storing and protecting 

the plan. 

The team should maintain a record of the people and organizations that receive a copy of 

the plan. 

Step 5 Outcome 

After completing Step 5, the planning team will have a final higher ed EOP. 

Step 6: Implement and Maintain the Plan 

Train Stakeholders on the Plan and Their Roles 

Everyone involved in the plan needs to know their roles and responsibilities before, during and 

after an emergency. Key training components include the following: 

Hold a meeting. At least once a year, hold a meeting to educate all parties on the plan. Go 

through the plan to familiarize these stakeholders with it. These meetings should include campus 

administration, department heads, the PIO, student affairs, community partners (first responders, 

emergency managers, public and mental health officials), other community entities and 

stakeholders, as well as the media. 
29

Visit evacuation sites. Show involved parties not only where evacuation sites are located but 

also where specific areas, such as media areas and triage areas, will be located. 

Give involved parties appropriate and relevant literature on the plan, policies, and 

procedures. It may also be helpful to provide all parties with quick reference guides that remind 

them of key courses of action. 

Post key information throughout the building. It is important that students, faculty, and staff 

are familiar with and have easy access to information such as evacuation routes and shelter-inplace procedures and locations. Ensure information concerning evacuation routes and shelter-inplace procedures and locations is effectively communicated to students and staff, such as by 

distributing materials by e-mail in an accessible format. 

Familiarize the campus community with the plan and community partners. Holding open 

house meetings for community partners, such as law enforcement officers, fire department 

officials, EMS personnel, emergency managers, public and mental health practitioners as well as 

the campus community to talk about the plan will make students, faculty, and staff more 

comfortable working with these partners. Consider involving students who volunteer with 

community partners and in the community in these events. 

Train members of the campus community on the skills necessary to fulfill their roles. Each 

member of the college community may be assigned specific roles in the plan that will require 

special skills, such as first aid, threat assessment, using the ICS, and providing personal assistance 

services for students and staff with disabilities and others with access and functional needs. 

Exercise the Plan 

The more a plan is practiced and stakeholders are trained on the plan, the more effectively they 

will be able to act before, during, and after an emergency to lessen the impact on life and 

property. Exercises provide opportunities to practice with community partners including first 

responders and local emergency management as well as to identify gaps and weaknesses in the 

plan. The exercises below require increasing amounts of planning, time, and resources. Ideally, 

IHEs will create an exercise program, building from a tabletop exercise up to a more advanced 

exercise, like a functional exercise. 







Tabletop exercises: Tabletop exercises are small-group discussions that walk through a 

scenario and the courses of action an IHE will need to take before, during, and after an 

emergency to lessen the impact on the IHE community. This activity helps assess the 

plan and resources, and facilitates an understanding of emergency management and 

planning concepts. 

Drills: During drills, community partners such as first responders and local emergency 

managers and relevant IHE personnel use the actual campus buildings, facilities, and 

grounds to practice responding to a scenario. 

Functional exercises: Functional exercises are similar to drills but involve multiple 

partners. Participants react to realistic simulated events (e.g., a bomb threat or an intruder 

with a gun in a classroom), and implement the plan and procedures using the ICS. 
30

 Full-scale exercises are the most time-consuming activities in the exercise continuum 

and are multi-agency, multi-jurisdictional efforts in which all resources are deployed. 

This type of exercise tests collaboration among the agencies and participants, public 

information systems, communications systems, and equipment. An Emergency 

Operations Center is established by either law enforcement or fire services, and the ICS is 

activated. 

Before making a decision about how many and which types of exercises to implement, an IHE 

should consider the costs and benefits of each, as well as any state or local requirements. For 

example, while a tabletop exercise may be less costly and less time-consuming to run, a fullscale exercise provides a more realistic context for the simulated response to an emergency 

situation, thus providing more constructive feedback to improve the plans. Students should be 

included to the maximum extent possible, and IHEs should also consider whether to include 

families. The IHE should also take into account the cultural diversity of its population when 

designing exercises and training. 

It is up to the planning team to decide how often exercises should be conducted. Note, however, 

that IHEs that are subject to the Clery Act are required to test their “emergency response and 

evacuation procedures” on at least an annual basis (see the “A Closer Look” section of this 

document for more details on the requirements of the Clery Act). While frequent exercise is 

important, it is imperative that exercises are of high quality. 

To effectively execute an exercise 















Include first responders (e.g., law enforcement officers, EMS personnel, fire department 

officials), local emergency managers, and public and mental health officials; 

Include additional stakeholders such as community organizations; 

Communicate information in advance to avoid confusion and concern; 

Exercise under different and non-ideal conditions (e.g., time of day, weather, points in the 

academic calendar, absence of key personnel and various IHE events); 

Be consistent with common emergency management terminology; 

Debrief and develop an after-action report that evaluates results, identifies gaps or 

shortfalls, and documents lessons learned; and 

Discuss how the higher ed EOP and procedures will be modified, if needed, and specify 

who has the responsibility for modifying the plan. 

For additional information on conducting exercises, please see the Homeland Security Exercise 

and Evaluation Program Guide at https://hseep.dhs.gov/pages/1001_HSEEP10.aspx. 

Review, Revise, and Maintain the Plan 

This step closes the loop in the planning process. It focuses on adding the information gained 

from exercising the plan to the research collected in Step 2, starting the planning cycle over 
31

again. Remember, planning is a continuous process even after the plan is published. Plans should 

evolve as the IHE and planning team learn lessons, obtain new information and insights, and 

update their priorities. 

Reviews should be a recurring activity. Planning teams should establish a process for reviewing 

and revising the plan. Many IHEs review their plans on an annual basis. In no case should any 

part of a plan go for more than 2 years without being reviewed and revised. 

Some IHEs have found it useful to review and revise portions instead of reviewing the entire 

plan at once. IHEs may consider reviewing a portion each month or at natural breaks in the 

academic calendar. Certain events will also provide new information that will be used to inform 

the plan. IHEs should consider reviewing and updating their plans or sections of their plans after 















Actual emergencies; 

Changes have been made in policy, personnel, organizational structures, processes, 

facilities, or equipment; 

Formal updates of planning guidance or standards have been finalized; 

Formal exercises have taken place; 

Changes in the IHE and surrounding community have occurred; 

Threats or hazards change or new ones emerge; or 

Ongoing assessments generate new information. 

The planning team should ensure that all first responders, local emergency management, and all 

community partners have the most current version of the higher ed EOP. 

PLAN CONTENT

Step 5 of the planning process in this guide introduced a format with three sections for IHEs to 

follow in developing a higher ed EOP. This section provides greater detail about what each of 

the three sections should include and some key considerations in developing the content. 

The Basic Plan 

The Basic Plan section of the higher ed EOP provides an overview of the IHE’s approach to 

operations before, during, and after an emergency. This section addresses the overarching 

activities the IHE undertakes regardless of the function, threat, or hazard. The content in this 

section provides a solid foundation for the IHE’s operations. The information in this section 

should not duplicate information contained in other parts of the plan. Almost all of the 

information contained in the Basic Plan should be able to come from the planning team. If the 

planning team finds that it has to go outside its members for a significant amount of information, 

it may be an indication that the planning team membership needs to be expanded. 
32

Introductory Material 

Introductory material can enhance accountability with community partners, including first 

responders, and local emergency managers, and make a higher ed EOP easier to use. Typical 

introductory material includes 













Cover Page. The cover page includes the title of the plan, a date and the campus(es) 

covered by the plan. 

Promulgation Document and Signature Page. This document or page contains a signed 

statement formally recognizing and adopting the higher ed EOP. It gives both the 

authority and the responsibility to IHE officials to perform their tasks before, during, or 

after an incident, and therefore should be signed by the authorized IHE administrator or 

another authorizing official. 

Approval and Implementation Page. The approval and implementation page introduces 

the plan, outlines its applicability, and indicates that it supersedes all previous plans. It 

includes a delegation of authority for specific modifications that can be made to the plan 

and by whom they can be made without the authorized IHE administrator’s signature. It 

also includes a date and should be signed by the authorized IHE administrator. 

Record of Changes. Each update or change to the plan should be tracked. The record of 

changes, usually in table format, contains, at a minimum, a change number, the date of 

the change, the name of the person who made the change, and a summary of the change. 

Record of Distribution. The record of distribution, usually in table format, indicates the 

title and the name of the person receiving the plan, the agency to which the recipient 

belongs (either the IHE department, or if from outside the IHE, the name of the 

appropriate government agency or private-sector entity), the date of delivery, and the 

number of copies delivered. Other relevant information could be considered. The record 

of distribution can be used to prove that individuals and organizations with specified 

roles have acknowledged their receipt, review, and/or acceptance of the plan. Copies of 

the plan can be made available to the public and media without sensitive information, in 

accordance with public records laws. 

Table of Contents. The table of contents is a logically ordered, clearly identified layout 

of the major sections and subsections of the plan that will make finding information 

within the plan easier. 

Purpose and Situation Overview 

The Purpose and Situation Overview section includes the following components: 





Purpose. The purpose sets the foundation for the rest of the higher ed EOP. The basic 

plan’s purpose is a general statement of what the higher ed EOP is meant to do. The 

statement should be supported by a brief synopsis of the basic plan and annexes. 

Situation Overview. The situation section explains why a higher ed EOP is necessary. 

The situation section covers a general discussion of
33





The threats and hazards that pose a risk to the IHE and would result in a need to use this 

plan; and 

Dependencies on parties outside the IHE for critical resources. 

Concept of Operations 

The Concept of Operations section explains in broad terms the authorized IHE administrator’s 

intent with regard to an operation. This section is designed to give an overall picture of how the 

IHE will protect the students, faculty, staff, and visitors, and should 















Identify those with authority to activate the plan (e.g., IHE administrators, department 

heads); 

Describe the process by which the IHE coordinates with all appropriate agencies, boards, 

or divisions within the jurisdiction; 

Describe how plans take into account the architectural, programmatic, and 

communication rights of individuals with disabilities and others with access and 

functional needs; 

Identify other response and support agency plans that directly support the implementation 

of this plan (e.g., city or county EOP); 

Explain that the primary purpose of actions taken before an emergency is to prevent, 

protect from, and mitigate the impact on life or property; 

Explain that the primary purpose of actions taken during an emergency is to respond to 

the emergency and minimize its impact on life or property; and 

Explain that the primary purpose of actions taken after an emergency is to recover from 

its impact on life or property. 

Organization and Assignment of Responsibilities 

This section provides an overview of the broad roles and responsibilities of IHE faculty and staff, 

students, families, first responders, local emergency management, and community partners, and 

of organizational functions during all emergencies. 

 Describes the broad roles and responsibilities of individuals that apply during7all 

emergencies. 

 Individuals that the planning team may wish to include in this section of the plan are 

IHE administrators, faculty, and staff; IHE board members; counselors; social 

workers; medical staff; and students. 

 

7

 If the planning team considers the information critical to the successful implementation of the plan, it may identify 

roles and responsibilities of one or more of these individuals before and after an emergency in addition to during an 

emergency. 
34





The planning team may also wish to include the community partners represented on it.

The following is an example of the type of information that would be included in the 

plan to describe the broad roles and responsibilities of the resident director of a 

student housing facility during an emergency. 

 The resident director will be responsible for the supervision of residents located in 

his or her housing units and shall remain with residents until directed otherwise. 

Resident director responsibilities include: 







evacuating residents to inside or outside assembly areas according to 

instructions provided by the Incident Commander or designee; 

obtaining first aid services for injured students; and 

if trained and certified in first aid, rendering first aid, if necessary. 

 Describes informal and formal agreements in place for the quick activation and sharing of 

resources during an emergency (e.g., evacuation locations to a nearby business’ parking 

lot). Agreements may be between the IHE and response groups (e.g., fire department, 

police department, emergency management agency), other IHEs, organizations, and 

businesses.

Direction, Control, and Coordination 









This section describes the framework for all direction, control, and coordination 

activities. It should explain 

The ICS structure as used by the IHE; 

The relationship between the higher ed EOP and the broader community’s emergency 

management system; and 

Who has control of the equipment, resources, and supplies needed to support the higher 

ed EOP.

Information Collection, Analysis, and Dissemination 

This section addresses the role of information in the successful implementation of the activities 

that occur before, during, and after an emergency. 







Identify the type of information that will be helpful in the successful implementation of 

the activities that occur before, during, and after an emergency, such as 

Before and during: weather reports, law enforcement alerts, National Oceanic and 

Atmospheric Administration radio alerts, Clery Act crime statistics and crime logs, and 

local crime reports. 

After: mental health, emergency management, and relief agencies’ websites and hotlines

assisting in all aspects of recovery. 
35













For each of the identified types of information, provide answers to the following 

questions: 

What is the source of the information? 

Who analyzes and uses the information? 

How is the information collected and shared? 

What is the format for providing the information to those who will use it? 

When should the information be collected and shared? 

Training and Exercises 

This section describes the critical training and exercise activities the IHE will use in support of 

the plan. This includes the core training objectives and frequency to ensure that staff, students, 

faculty, families, and community representatives understand roles, responsibilities, and 

expectations. This section also establishes the expected frequency of exercises to be conducted 

by the IHE. Content may be influenced based on similar requirements at the district and/or local 

jurisdiction levels. Exercises may range from basic fire and shelter-in-place drills to full-scale 

communitywide drills that realistically portray a crisis and show the role the IHE plays in school 

district and municipal planning. 

Administration, Finance, and Logistics 

This section covers general support requirements and the availability of services and support for 

all types of emergencies, as well as general policies for managing resources. It should identify 

and reference policies and procedures that exist outside the plan. This section should 









Identify administrative controls (e.g., budget and acquisition policies and procedures) and 

requirements that will be used to provide resource and expenditure accountability; 

Briefly describe how the IHE will maintain accurate logs of key activities; 

Briefly describe how vital records (e.g., student records) will be preserved (details may 

be contained in a COOP Annex); and 

Identify general policies for keeping financial records, tracking resource needs, tracking 

the source and use of resources, acquiring ownership of resources, and compensating the 

owners of private property used by the IHE. 

Plan Development and Maintenance 

This section discusses the overall approach to planning and the assignment of plan development 

and maintenance responsibilities. This section 

 Describes the planning process, participants in that process, and how development and 

revision of different sections of the higher ed EOP (basic plan and annexes) are 

coordinated before an emergency; 
36





Assigns responsibility for the overall planning and coordination to a specific position or 

person; and 

Provides for a regular cycle of training, evaluating, reviewing, and updating of the higher 

ed EOP.

Authorities and References 

This section provides the legal basis for emergency operations and activities, and includes 





Lists of laws, statutes, ordinances, executive orders, regulations, and formal agreements 

relevant to emergencies; and 

Provisions for the succession of decision-making authority and operational control to 

ensure that critical emergency functions can be performed in the absence of the 

authorized IHE administrator. 

Functional Annexes Content 

Functional annexes focus on critical operational functions and the courses of action developed to 

carry them out. This section of the guide describes functional annexes that IHEs should address 

in developing a comprehensive, high-quality campus EOP. As the planning team assesses the 

IHE’s needs, it may need to prepare additional or different annexes. Also included in this section 

are issues the planning team should consider as it develops goals, objectives, and courses of 

action for these functions. While these are some the most important issues, they are not meant to 

constitute an exhaustive list. For sources of more detailed information about these functions, 

please see the Resources section of this guide. 

While these functions should be described separately, it is important to remember that many 

functions will occur consecutively. For example, a shelter-in-place during an emergency may be 

implemented but if a building is damaged the IHE may then initiate an evacuation of that 

building. 

Often, multiple functions will also be performed concurrently. For example, during an 

evacuation, once all individuals are safely out of the building, the accounting for students, 

faculty, staff, and visitors function will begin. The evacuation function, however, will still be in 

effect as IHE personnel or first responders work to locate and evacuate any persons not 

accounted for. 

While functions build upon one another and overlap, it is not necessary to repeat a course of 

action in one functional annex if it appears in a second Functional Annex. For example, though 

an evacuation may lead to reunification, it is not necessary to list a course of action for 

reunification within the Evacuation Annex. 

Evacuation Annex 

This annex focuses on the courses of action that IHEs will execute to evacuate buildings, 

facilities, and grounds. 
37

The planning team should consider the following when developing its goals, objectives, and 

courses of action: 









How to account for students, faculty, staff, and visitors located in various locations at 

different points in the day 

How to safely move students, faculty, staff, and visitors from unsafe areas to designated 

assembly areas such as classrooms, student housing facilities, campus grounds, dining 

halls, stadiums, and other IHE locations 

How to evacuate when the primary evacuation route is unusable 

How to evacuate individuals with disabilities (along with service animals and assistive 

devices, e.g., wheelchairs) and others with access and functional needs, including 

language, transportation, and medical needs 

Deny Entry or Closing (Lockdown) Annex 

This annex focuses on the courses of action IHEs will execute to secure IHE buildings, facilities, 

and grounds during incidents that pose an immediate threat of violence in or around the IHE, 

such as a crime or bomb threat. The primary objective of a lockdown is to quickly ensure all 

faculty, staff, students, and visitors are secured in rooms away from immediate danger. 

The planning team should consider the following when developing its goals, objectives, and 

courses of action: 









How to account for students, staff, faculty, and visitors located in various locations at 

different points in the day 

How to secure exterior doors to campus buildings and facilities and when it may or may 

not be safe to do so 

How particular classroom and building characteristics (i.e., windows, doors) impact 

possible lockdown courses of action 

When to use the different variations of a lockdown (when outside activities are curtailed, 

doors are locked, and visitors closely monitored but all other activities continue as 

normal) 

Shelter-in-Place/Secure-in-Place Annex 

A Shelter-in-Place or Secure-in-Place Annex focuses on courses of action when students, faculty, 

and staff are required to remain indoors, potentially for an extended period of time, because it is 

safer inside a building or a room than outside. Depending on the threat or hazard, students, 

faculty, and staff may be required to move to rooms that can be sealed (such as in the event of a 

chemical or biological hazard) or are without windows, or to a weather shelter (such as in the 

event of a tornado). 
38

The planning team should consider the following when developing its goals, objectives, and 

courses of action: 











What supplies will be needed to seal the room and to provide for the needs of students, 

faculty, and staff (e.g., water) 

How a shelter-in-place can affect individuals with disabilities and others with access and 

functional needs who require durable medical equipment and personal assistance services 

How to move individuals when the primary route is unusable 

How to locate and shelter all students, faculty, staff, and visitors 

Consider the need for and integration of “safe rooms” for protection against extreme 

wind hazards (such as a tornado or hurricane) in order to provide immediate life-safety 

protection when evacuation is not an option 

Accounting for All Persons Annex 

This annex focuses on developing courses of action for accounting for the whereabouts and wellbeing of students, faculty, staff, and visitors, and identifying those who may be missing. 

The planning team should consider the following when developing its goals, objectives, and 

courses of action: 









How IHE personnel will determine who should be in attendance at the assembly area 

What to do when a student, faculty, staff member, or visitor cannot be located 

How IHE personnel will report to the assembly supervisor 

How and when will students, faculty, and staff will be permitted to resume their activities 

Communications and Notification Annex 

The communications and notification function includes communication and coordination during 

emergencies and disasters (both internal communication and communication with external 

stakeholders), as well as the communication of emergency protocols before an emergency and 

communication after an emergency. 

The planning team should consider the following when developing its goals, objectives, and

courses of action: 







How the IHE’s communications system integrates into the local disaster response 

communications network (e.g., fire department, law enforcement agency) 

How the IHE will communicate with community partners in accordance with preestablished agreements (e.g., memoranda of understanding) 

How to ensure relevant staff members can operate communications equipment 
39























How the IHE will communicate with students, families and the broader community 

before, during, and after an emergency, including by using alert and notification systems 

How to account for technology barriers faced by students, faculty, staff, and families 

How to effectively address language access barriers faced by students, faculty, staff, and 

guardians 

How impacts will be communicated to the broader community, including off-campus 

student activities or events on IHE grounds not sponsored by the IHE (i.e., third-party use 

of campus grounds, athletic events) 

How the IHE will ensure effective communication with individuals with disabilities and 

others with access and functional needs (e.g., coordinating with local emergency 

management staff to provide sign language interpreters for use during press conferences, 

publishing only accessible documents, ensuring information on websites is accessible) 

How to obtain and update emergency contact information for students, faculty, and staff 

How to reach out to emergency contacts, including international contacts, during or 

following an emergency

How to track students, faculty, staff, or visitors transported to another location for care or 

shelter, including hospitals 

How to coordinate information sharing among hospitals, families, and the IHE 

Whether goals, objects, and courses of action are consistent with the requirements in the 

Clery Act, the Health Insurance Portability and Accountability Act (HIPAA), the Family 

Educational Rights and Privacy Act (FERPA), and civil rights laws (see the “A Closer 

Look” section for more information on these federal laws) 

How to communicate with students, staff, or members of the public who refuse to comply 

with safety instructions 
40

Telling Family Members That Their 

Loved One Is Missing, Injured, or Killed

When reunification is not possible because an individual is missing, injured, or killed, 

how and when this information is provided to families is critical. Before an emergency, the 

planning team must determine how, when, and by whom loved ones will be informed if their 

loved one is missing or has been injured or killed. Law enforcement typically takes the lead 

on death notifications, but all parties must understand their roles and responsibilities. This 

will ensure that parents and loved ones receive accurate and timely information in a 

compassionate manner. 

While law enforcement and medical examiner procedures must be followed, families should 

receive accurate information as soon as possible. Having trained personnel on hand or 

immediately available to talk to loved ones about death and injury can ensure the notification 

is provided to family members with clarity and compassion. Counselors should be on hand to 

immediately assist family members.

The higher ed EOP should include pre-identified points of contact (e.g., counselors, police 

officers) to work with and support family members. These points of contact should be 

connected to families as early in the process as possible, including while individuals are still 

missing but also before any victims have been positively identified. After an incident, it is 

critical to confirm that each family is getting the support it needs, including over the longterm.

The higher ed EOP should consider printed and age-appropriate resources to help families 

recognize and seek help in regard to a variety of reactions that they or their loved ones can 

experience during and after an emergency. Often, a family that has lost a child may have 

other children or another child in the school. It is critical that these families and loved ones 

are supported as they both grieve their loss and support their surviving child(ren).

The school EOP also should explicitly address how impacted families and children will be 

supported if they prefer not to engage with the media. This includes strategies for keeping 

the media separate from families and students while the emergency is ongoing and support 

for families that may experience unwanted media attention at their homes. 

Continuity of Operations (COOP) Annex 

This annex describes how an IHE will help ensure essential functions continue during an 

emergency and its immediate aftermath. Essential functions include business services (e.g., 

payroll and purchasing), communication (internal and external), computer and systems support, 

facilities maintenance, safety and security, and continuity of teaching and learning. For more 

information on COOP for IHEs, see the Resource section. 
41

The planning team should consider the following when developing its goals, objectives, and 

courses of action: 









How the COOP will be designed so that it can be activated at any time and sustained for 

up to 30 days 

How the COOP will set priorities for re-establishing essential functions, such as 

restoration of IHE operations, and maintaining the safety and well-being of students and 

the learning environment 

How COOP will ensure students receive related services (e.g., financial aid, instruction, 

food, and housing for residents) in the event of a prolonged closure 

Whether to develop agreements with other institutions to prepare for situations, such as 

a hurricane, where the IHE may not be able to provide routine services for long periods 

of time 

Recovery Annex 

This annex describes how IHEs will recover from an emergency. The four most fundamental 

kinds of recovery are academic recovery, physical recovery, fiscal recovery and psychological 

and emotional recovery. 

The planning team should consider the following when developing its goals, objectives, and 

courses of action: 



















Academic recovery 

When the IHE should be closed and reopened, and who has the authority to close and 

reopen the IHE 

What temporary space(s) the IHE may use if IHE buildings and facilities cannot be 

immediately reopened 

How to provide alternate educational programming in the event that students cannot 

physically reconvene 

Physical recovery 

How to document IHE assets, including physically accessible facilities, in case of damage 

Which personnel have expert knowledge of the IHE’s assets, and how and where they 

will access records to verify current assets after an emergency 

How to provide for the housing and nutrition needs of students, faculty, or staff living 

on campus 

How to address research facilities that contain sensitive information, materials, or 

animals 
42





























How the IHE will work with utility and insurance companies before an emergency to 

support a quicker recovery 

Fiscal recovery 

How the IHE leadership will be included (e.g., the president or chief executive officer, 

chief business officer, personnel director, and risk manager) 

How faculty and staff will receive timely and factual information regarding returning 

to work

What sources the IHE may access for emergency relief funding 

Psychological and emotional recovery 

Who will serve as the team leader 

Where counseling and psychological first aid will be provided 

How the IHE will create a calm and supportive environment for its community, share 

basic information about the incident, provide psychological first aid (if trained), and 

identify those who may need immediate crisis counseling 

Who will provide trained counselors 

How to address immediate, short-, and long-term counseling needs of students, faculty, 

staff, and families 

How to handle commemorations, memorial activities, or permanent markers and/or 

memorial structures (if any will be allowed), including concerns such as when a 

commemoration site will be closed, what will be done with notes and tributes, and how 

students will be informed in advance 

How memorial activities will strike a balance among honoring the loss, resuming IHE 

and class routines and schedules, and maintaining hope for the future 

How the Public Health, Medical, and Mental Health annex will inform the actions and 

plans for all components of the Recovery annex 

Public Health, Medical and Mental Health Annex 

This annex describes the courses of action that the IHE will implement to address emergency 

medical (e.g., first aid), public health, and mental health counseling issues. IHEs should 

coordinate these efforts with the appropriate emergency medical services, public health, mental 

health, law enforcement, fire department, and emergency management representatives. Mental 

health needs after an emergency will be addressed in the Recovery annex. 
43

The planning team should consider the following when developing its goals, objectives, and 

courses of action: 













What is the role of staff members is in providing first aid during an emergency 

Where emergency medical supplies (first aid kits, AEDs, etc.) will be located and who is 

responsible for purchasing and maintaining those materials 

Which staff have relevant training or experience such as first aid or CPR 

How the IHE will secure a sufficient number of counselors and others trained in 

psychological first aid in the event of an emergency 

How the IHE will promptly share and report information about outbreaks or epidemics or 

other unusual medical situations to the local health department 

How the IHE will support the needs of students, faculty, and staff identified by the TAT 

Security Annex 

This annex focuses on the courses of action that IHEs will implement on a routine, on-going 

basis to secure the IHE from criminal threats originating from both inside and outside the IHE. 

This includes efforts done in conjunction with law enforcement officers. 

The planning team should consider the following when developing their goals, objectives and 

courses of action courses of action: 



















How agreements with law enforcement agencies address the daily role of law 

enforcement officers in and around campus (For more information about this topic, see 

the “A Closer Look” section, “Campus Public Safety”). 

How to help ensure the buildings and facilities are physically secure (including 

implementation of Crime Prevention Through Environmental Design [CPTED]) 

How to assist students, faculty, and staff in safely traveling to, from, and within the 

campus safely (including traffic control and pedestrian safety) 

How to keep prohibited items or materials off the campus 

How to respond to threats identified by the TAT 

How to address issues related to cybersecurity and threats to the IHE’s information 

technology systems 

How security will be provided at stadiums, arenas, and other large-event facilities 

How to provide security for sensitive facilities, including research labs and test reactors 

on the campus 

How to account for students, faculty, staff, and visitors in a variety of locations at 

different points in the day 
44

 How information will be shared with law enforcement officers or other responders 

(keeping in mind any requirements or limitations of applicable privacy laws, including 

FERPA, HIPAA, and other civil rights laws. More information on FERPA and HIPAA can 

be found in the “A Closer Look” section, “Information Sharing”.) 

Rapid Assessment Annex 

This annex focuses on the courses of action that IHEs will implement when it is notified of or 

becomes aware of an occurring or impending emergency situation. 

The planning team should consider the following when developing its goals, objectives, and 

courses of action: 











How to immediately gather information to determine the type and scale of the incident 

How to determine an appropriate response 

How to determine which annexes should be implemented 

How the institution will take immediate action to protect life and property 

Whether goals, objects, and courses of action are consistent with the requirements of the 

Clery Act (see the “A Closer Look” section for more information on the Clery Act).

The IHE’s response team lead (Incident Commander) has responsibility for the management of 

all emergency activities, including development, implementation, and review of strategic 

decisions. These actions and decisions are made in concert and in consultation with other 

community response partners and leaders as applicable. 

Threat- and Hazard-Specific Annexes 

The Threat- and Hazard-Specific annexes describe the courses of action unique to particular 

threats and hazards. Courses of action already outlined in a Functional Annex need not be 

repeated in a hazard-specific annex. IHEs will develop these based on the prioritized list of 

hazards determined in the assessment process. As planning teams develop courses of action for 

threats and hazards, they should consider the federal, state, and local regulations or mandates that 

often apply to specific hazards. 

If there is a functional annex that applies to one of the threat or hazard annexes, the latter will 

include it by reference. For example, if a “during” course of action for a fire hazard involves 

evacuation and there is an evacuation annex, the fire annex would indicate “see Evacuation 

annex” in the “during” course of action section rather than repeat the evacuation courses of 

action in the fire annex. 
45

Table 4: Threat and Hazard Types and Examples

Threat/Hazard 

Type Examples

Natural Hazards 



























































Earthquakes

Tornadoes

Lightning

Severe wind

Hurricanes

Floods

Wildfires

Extreme temperatures

Landslides or mudslides

Tsunamis

Volcanic eruptions

Winter precipitation

Infectious diseases, such as pandemic influenza, extensively drugresistant tuberculosis, Staphylococcus aureus, and meningitis

Contaminated food outbreaks, including salmonella, botulism, and E. 

coli

Technological 

Hazards

Explosions or accidental release of toxins from industrial plants

Accidental release of hazardous materials from within the IHE, such 

as gas leaks or laboratory spills

Hazardous materials releases from major highways or railroads

Radiological releases from nuclear power stations

Dam failure

Power failure

Water failure

Fire

Adversarial and 

Human-caused 

Threats

Arson

Active shooters

Criminal threats or actions

Gang violence

Bomb threats

Domestic violence and abuse

Cyber attacks 

Suicide
46

A CLOSER LOOK 

This section of the guide provides users with information on six key topics to enhance the 

implementation of their Emergency Operations Plans (EOP). These topics are described in the 

following chapters: 













“The Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics 

Act” provides an overview of Institutions of Higher Education (IHE) responsibilities, 

focusing on the emergency notification and timely warning requirements. 

“Information Sharing, FERPA, and HIPAA” provides an overview of the Family 

Educational Rights and Privacy Act, the Health Insurance Portability and Accountability 

Act, and the implications that these federal statutes may have for information sharing in 

the emergency planning process. 

“Incorporating International Students into IHE Emergency Management and Planning” 

describes the unique needs of international students that IHEs should consider when 

planning for and responding to crises. 

“Campus Public Safety” describes the unique challenges faced by campus public safety 

departments and provides recommendations for working with campus public safety 

throughout the emergency planning process. 

“Active Shooter Situations” describes the unique challenges involved in preparing for, 

responding to, and recovering from a shooting at an IHE. 

“Psychological First Aid” (PFA) describes PFA and how IHEs can use it to help students 

and staff during and immediately after a traumatic incident. 
47

1. The Jeanne Clery Disclosure of Campus Security Policy and

Campus Crime Statistics Act (the Clery Act)

The Clery Act, found in section 485(f) of the Higher Education Act of 1965, as amended (HEA), 

requires IHEs that participate in the Title IV HEA federal student financial assistance programs to 

disclose campus crime statistics and security information.8 Among other things, the Clery Act

requires IHEs to provide timely warnings to the campus community of certain crimes reported to 

campus security authorities that represent a threat to students and employees, and to maintain a 

log of crimes reported to the campus police or security department. In addition, IHEs must 

include in their annual security report, a statement of policy regarding the institution’s 

emergency response and evacuation procedures. This requirement complements and supports a 

number of the concepts described throughout this guide, such as the importance of clearly 

delineating the responsibilities of individuals involved during an emergency response, the need 

to develop and implement notification and communication strategies to share information with 

the campus community, the imperative of testing and practicing a higher ed EOP, and the 

importance of keeping the community informed of current policies and procedures. 

Generally, the requirements under the Clery Act fall into three categories: 

1) Reporting crime statistics and disclosing security-related policies

a. Every IHE must collect, classify, and count reported crimes and disclose crime

statistics for certain crimes (see the chart below) to the campus community and

the public (through the U.S. Department of Education’s campus security website).

Crimes Reported under the Clery Act

Criminal Offenses Hate Crimes (any of the 

crimes listed under Criminal 

Offenses in addition to the 

ones below)

Arrests and Referrals for 

Disciplinary Action 

Murder and Non-Negligent 

Manslaughter

Larceny-Theft Weapons Law Violations

Negligent Manslaughter Simple Assault Liquor Law Violations

Sex Offenses





Forcible

Non-forcible (i.e.,

incest and statutory

rape)

Intimidation Drug Law Violations

Robbery Destruction, Damage, or 

Vandalism of Property

Aggravated Assault

Burglary

Motor Vehicle Theft

Arson

8

 The implementing regulations for the Clery Act are found in 34 C.F.R. Sections 668.14(c)(2)(i), 41(e), 46, and 49. 

In March 2013, the Clery Act was amended by the Violence Against Women Reauthorization Act of 2013 (VAWA). 

VAWA expanded the scope of the Act and requires IHEs to take additional steps to provide information to students 

and employees. 
48

b.

c.

d.

Under certain circumstances an IHE must issue a campus alert to provide 

members of the campus community with information necessary to make informed 

decisions about their health and safety. There are two kinds of alerts under the 

Clery Act: 

i.

ii.

Timely warnings are issued for certain crimes that represent a threat to the 

safety of students or employees. 

Emergency notifications are issued upon the confirmation of a significant 

emergency or dangerous situation occurring on the campus that involves 

an immediate threat to the health or safety of students or employees. 

Every IHE must publish an annual security report that contains safety- and 

security-related policy statements and crime statistics, and distribute it to all 

current students and employees. IHEs also must inform prospective students and 

employees about the availability of the report. 

Every IHE must submit crime statistics to the U.S. Department of Education 

annually. Those statistics are available to the public available at 

http://www.collegenavigator.gov, as well as via the Office of Postsecondary 

Education’s Campus Safety and Security Data Analysis Cutting Tool available at 

http://www.ope.ed.gov/security/. 

2)

3)

Maintaining a crime log at IHEs that have a campus police or security department. IHEs 

that maintain a campus police or security department must keep a daily crime log of 

reported crimes that is open to public inspection. 

Disclosing missing student notification and fire-safety requirements for IHEs that have 

any on-campus student housing facility 

a.

b.

IHEs with on-campus student housing facilities must disclose missing student 

notification procedures that pertain to students residing in those facilities. 

IHEs with on-campus student housing facilities must disclose fire safety 

information related to those facilities. IHEs must provide this information to 

students and employees, and potential students and employees, in the same 

manner as they disclose crime information under the Clery Act.

9

These IHEs must 

i.

ii.

Keep a fire log that is open for public inspection; 

Publish an annual fire safety report with policy statements and fire 

statistics associated with each on-campus student housing facility, provide 

 

9

Please see the U.S. Department of Education’s regulations on fire safety at 34 CFR Section 668.49 available at 

http://www.ecfr.gov/cgi-bin/textidx?c=ecfr&SID=676893907309b77d0c88954dcce41914&rgn=div8&view=text&node=34:3.1.3.1.34.4.39.9&idno=34/. 
49

students and employees with the report, and inform prospective students 

and employees of the availability of the report; and 

iii. Submit fire statistics to the U.S. Department of Education annually. 

As part of the emergency planning process, it is critical that IHEs take the time to review and 

understand all the Clery Act requirements. In this “A Closer Look” section, however, we focus 

on two of those requirements: timely warnings and emergency notifications. These issues tie 

directly to and reinforce other concepts in this guide. The U.S. Department of Education’s 

Handbook for Campus Safety and Security Reporting (listed in the Resources section of this 

guide) details all of the Clery Act requirements in depth and provides sample policy statements, 

diagrams, and other helpful aids for IHEs in complying with this statute. 

Timely Warnings 

The Clery Act requires IHEs to alert the campus community to certain crimes that are reported to 

campus security authorities or local police agencies, and are considered by the IHE to represent a 

threat to students and employees. These alerts must be done in a manner that is timely and that 

will aid in the prevention of such crimes. The Clery Act does not include a specific definition of 

“timely”. However, the intent of a timely warning is to enable people to protect themselves; 

therefore, warnings should be issued as soon as pertinent information is available. The decision 

to issue a timely warning should be made on a case-by-case basis, taking into account the nature 

of the crime, the danger to the campus community, and the possible risk of compromising law 

enforcement efforts. 

An IHE must include in the annual security report a policy statement that accurately reflects the 

institution’s timely warning policy and practice. The policy should specify the circumstances 

under which the IHE will issue a timely warning, how those timely warnings will be distributed, 

and the individual or office responsible for issuing a timely warning. IHEs must take appropriate 

steps to ensure that timely warnings are communicated to individuals with disabilities, including 

those who have hearing or vision disabilities, as effectively as they are to others. 

Emergency Notification 

IHEs must also develop and disclose emergency response and evacuation procedures, including 

emergency notification procedures that describe their response to significant emergency or 

dangerous situations involving an immediate threat to the health or safety of students or 

employees occurring on the campus.10 This requirement is intended to ensure that an IHE has 

sufficiently prepared for an emergency situation on campus, has tested those procedures to 

identify and improve on weaknesses, and has considered how it will inform the campus 

community and other individuals, such as parents and guardians. 

IHEs must include a policy statement in their annual security reports that accurately reflect their 

emergency response and evacuation procedures. This policy statement must include 

 

10 The Clery Act differentiates among “on-campus locations,” “public property,” and “non-campus buildings or 

property.” These geographic categories drive a number of Clery Act requirements, including crime reporting and 

disclosures, and emergency response and evacuation procedures. See Chapter 2 of the Handbook for Campus Safety 

and Security Reporting available at http://www2.ed.gov/admins/lead/safety/handbook.pdf. 
50













The procedures the IHE will use to immediately notify the campus community upon the 

confirmation of a significant emergency or dangerous situation involving an immediate 

threat to the health or safety of students or staff occurring on the campus, unless issuing a 

notification will compromise efforts to contain the emergency; 

A description of the process the IHE will use to confirm that there is a significant 

emergency or dangerous situation, determine the appropriate segment or segments of the 

campus community to receive a notification, determine the content of the notification, 

and initiate the notification system; 

A statement that the IHE will, without delay and taking into account the safety of the 

community, determine the content of the notification and initiate the notification system, 

unless issuing a notification will, in the professional judgment of responsible authorities, 

compromise efforts to assist a victim or to contain, respond to, or otherwise mitigate the 

emergency; 

A list of the titles of the person(s) or organization(s) responsible for carrying out the 

actions described above; 

The IHE’s procedures for disseminating emergency information to the larger community; 

and

The IHE’s procedures to test the emergency response and evacuation procedures on at 

least an annual basis. 

In addition, the IHE should take steps to ensure the emergency notification planning, testing, and 

implementation will provide such notifications and related information to individuals with 

disabilities, including those with vision or hearing disabilities, as effectively as they are provided 

to others. 

As stressed elsewhere in this guide, testing a higher ed EOP is critical to the successful 

implementation of the appropriate course of action during an emergency situation. The Clery Act 

provides flexibility to IHEs in designing their tests and does not prescribe a particular type that 

must be used. These tests may be announced or unannounced, but IHEs must publicize their 

emergency response and evacuation procedures in conjunction with at least one test per calendar 

year. They must also document, for each test, a description of the exercise, the date and time of 

the exercise, and whether it was announced or unannounced.
51

Emergency Notification and Timely Warning: Sorting Out the Differences

Emergency Notification Timely Warning

Scope: Wide focus on any significant 

emergency or dangerous situation (e.g., crime, 

severe storm, chemical spill, disease 

outbreak)

Scope: Required for certain crimes

Why: Emergency notification is triggered by 

an event that is currently occurring on or 

imminently threatening the campus. Initiate 

emergency notification procedures for any 

significant emergency or dangerous situation 

involving an immediate threat to the health or 

safety of students or employees occurring on 

campus.

Why: Timely warnings are triggered by crimes 

that have already occurred (but may be 

continuing) but which represent an ongoing 

threat. An IHE must issue a timely warning for 

certain crimes that are reported to its campus 

security authorities11 or a local law 

enforcement agency, and is considered by the 

institution to represent a serious or continuing 

threat to students and employees.

Where: Applies to situations that occur on 

campus

Where: Applies to crimes that occur on 

campus, in or on non-campus buildings or 

property, and on public property.

When: Initiate procedures immediately upon 

confirmation that a dangerous situation or 

emergency exists or threatens.

When: Issue a warning as soon as the 

pertinent information is available.

An IHE that follows its emergency notification procedures is not required to issue a timely 

warning based on the same circumstances; however, the institution must provide adequate 

follow-up information to the community as needed.

 

11 “Campus security authority” is a specific term under the Clery Act that includes four groups of individuals and 

organizations associated with the institution: 1) a campus police department or campus security department; 2) 

individuals with responsibility for campus security but who do not constitute a police or security department; 3) 

individuals or organizations specified in the IHE’s statement of campus security policy as entities to whom students 

and employees should report criminal offenses; and 4) an IHE official with significant responsibility for student and 

campus activities. 
52

2. Information Sharing 

This section of “A Closer Look” section provides an overview of the Family Educational Rights 

and Privacy Act (FERPA) and the implications that this and other federal statutes have for 

information sharing in the emergency planning process. This section also provides a brief 

overview of the more limited circumstances when the Health Insurance Portability and 

Accountability Act (HIPAA) may apply to impact information sharing in the IHE setting. 

While it is critical that IHEs comply with these laws, there is often confusion about their 

applicability, which results in IHEs sharing less than allowed with law enforcement officers or 

the appropriate authorities, even when there is appropriate cause for sharing information. If IHEs 

understand when and how these laws apply, they can both ensure public safety and protect 

student privacy. 

While this section of the guide focuses on FERPA, and to a lesser extent HIPAA, there may be 

additional federal and state civil rights and other laws that place restrictions on when and with 

whom IHEs may share information. At the federal level, for instance, postsecondary institutions 

are subject to federal civil rights laws, including laws that prohibit discrimination based on 

disability (ADA and Section 504 of the Rehabilitation Act of 1973), race, color, and national 

origin (Titles IV12and VI of the Civil Rights Act of 1964), sex (Title IX of the Education 

Amendments of 1972 and Title IV of the Civil Rights Act of 1964); and religion (Title IV of the 

Civil Rights Act of 1964). For example, Section 504 and Title II of the ADA13 prohibit 

discrimination on the basis of disability, and generally would prohibit unnecessary disclosures of 

disability status, or information related to that disability, to third parties.14 Disclosures may be 

necessary when the student presents a significant, articulable threat to others.15

Postsecondary institutions are strongly urged to take the time to review these laws, as well as 

others that apply in their jurisdictions, when working with their community partners (e.g., law 

enforcement agencies, fire departments, emergency management agencies, public and mental 

health agencies) to ensure that all parties have a strong understanding of applicable laws when 

deciding whether to disclose information from education records without consent. In particular, it 

is critical to train the institutions’ employees, including contractors, on applicable laws to ensure 

that institutions, IHE officials, or employees do not release information inappropriately or make 

 

12 Title IV of the Civil Rights Act of 1964 applies to public postsecondary institutions. 

13 Title II of the ADA prohibits discrimination based disability by public entities, including public institutions of 

higher education. 

14 See 34 CFR § 104.4 available at http://www.ecfr.gov/cgi-bin/textidx?c=ecfr&SID=38a42834a329452c07d853e5091f6d3f&rgn=div5&view=text&node=34:1.2.1.1.3&idno=34#34:1.2.

1.1.3.1.132.4; 28 CFR § 35.130 available at http://www.ecfr.gov/cgi-bin/textidx?c=ecfr&SID=fed2599073ee2b61363d831ea8e2b5f1&rgn=div8&view=text&node=28:1.0.1.1.36.2.32.1&idno=28; 

and “Dear Colleague Letter and Frequently Asked Questions on Report Cards and Transcripts for Students with 

Disabilities Attending Public Elementary and Secondary Schools,” October 2008, available at

http://www2.ed.gov/about/offices/list/ocr/letters/colleague-20081017.pdf. 

15 See 28 CFR 35.139 available at http://www.ecfr.gov/cgi-bin/textidx?c=ecfr&SID=263f01c0db63e7266a3711907eab6bd3&rgn=div8&view=text&node=28:1.0.1.1.36.2.32.10&idno

=28 to 28 CFR 36.208 available at http://www.ecfr.gov/cgi-bin/textidx?c=ecfr&SID=01903fc38a7bdb19c90e9c2e84fa788e&rgn=div8&view=text&node=28:1.0.1.1.37.2.32.8&idno=28/. 
53























decisions about students or release of records based upon myths, fears, or stereotypes related to 

race, color, national origin, sex, sexual orientation, gender identity, religion, or disability.16

Family Educational Rights and Privacy Act (FERPA) 

In this section:

What Is FERPA? 

FERPA is a federal law that protects the privacy of student education records. The law applies to 

all educational agencies and institutions that receive funds under any U.S. Department of 

Education program (termed “institutions” below). FERPA gives parents certain rights with 

respect to their children's education records. These rights transfer to the student when he or she 

reaches the age of 18 or attends a school beyond the high school level. Students to whom the 

rights have transferred are “eligible students.” The Family Policy Compliance Office at the U. S. 

Department of Education administers FERPA.

FERPA protects the rights of eligible students to: 





What Is FERPA?

What Are “Education Records?”

Who May Access FERPA-Protected Education Records?

Balancing Safety and Privacy

The Health and Safety Emergency Exception to the Consent Requirement

The Law Enforcement Unit Records Exception to the Definition of Education Records

Common FERPA Misunderstandings

Additional Situations With FERPA Considerations

Incorporating FERPA Into Your Emergency Planning Process

Frequently Asked Questions Pertaining to FERPA

FERPA Guidance and Resources

Inspect and review education records; 

Seek to amend education records; and 

 

16 For more information about applicable civil rights laws, please visit http://www.justice.gov/crt/, 

http://www.ed.gov/ocr/, or http://www.ada.gov/. Information about the appropriate training and management of 

campus public safety may be found at http://www.cops.usdoj.gov/.
54

 Consent to the disclosure of personally identifiable information (PII)17 from education 

records, except as specified by law. 

For a thorough review of FERPA, in addition to what is provided in this document, please see the 

implementing regulations for FERPA found in Title 34 of the Code of Federal Regulations 

(CFR), part 99 available at 

http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&tpl=/ecfrbrowse/Title34/34cfr99_main_02.tpl. 

What are “Education Records?”

Different types of records and information may be protected by FERPA if that information 

constitutes PII from “education records.” Education records are protected by FERPA and are 

broadly defined as records that are directly related to a student and maintained by an institution, 

or by a party acting for the institution. 

The non-exhaustive chart below shows several examples of what types of records generally are

and are not considered to be education records. 

Education Records Not Education Records

Transcripts Records that are kept in the sole possession 

of the maker and used only as personal 

memory aids

Disciplinary records Law enforcement unit records

Immunization and other health records, unless 

the records meet the exclusion for “treatment 

records” under FERPA

Records made or maintained by a physician or 

other medical professional used only in 

connection with treatment of the student 

(“treatment records”)

Records on services and accommodations 

provided to students under Section 504 of the 

Rehabilitation Act of 1973, and Title II and Title 

III of the ADA

Records created or received by an institution 

after an individual is no longer in attendance 

and that are not directly related to the 

individual’s attendance at the institution

Records on a student who is employed as a 

result of his or her status as a student (i.e., 

work-study)

Grades on peer-graded papers before 

they are collected and recorded by an 

instructor

Information obtained through a school official’s 

personal knowledge or observation and not 

from the student’s education records

Employment records (unless the individual is 

employed as a result of his or her status as a 

student)

 

17 Under FERPA, “personally identifiable information” is a term that includes, but is not limited to the student’s 

name; the name of the student’s parent or other family members; the address of the student or student’s family, a 

personal identifier, such as the student’s social security number, student number, or biometric record; other indirect 

identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name; other information that, 

alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school 

community, who does not have personal knowledge of the relevant circumstances, to identify the student with 

reasonable certainty; or information requested by a person who the educational agency reasonably believes knows 

the identity of the student to whom the education record relates. (See 34 CFR 99.3.) 
55

Additionally, records created and maintained by the institution’s law enforcement unit are not 

likely to fall into the protected definition of “education records.” See the discussion under 

“Balancing Safety and Privacy” below for more detail on law enforcement units under FERPA, 

what constitutes a law enforcement unit record, and how these records may be used. 

Treatment records are also not considered to be education records. The term “treatment records”

generally applies to records involving students who are at least 18 years old or who are attending 

an institution of postsecondary education, and means records that are 







Made or maintained by a physician, psychiatrist, psychologist, or other recognized 

professional or paraprofessional acting in his or her professional capacity or assisting in a 

paraprofessional capacity; 

Made, maintained, or used only in connection with treatment of the student; and 

Disclosed only to individuals providing the treatment. 

Treatment does not include remedial educational activities or activities that are part of the 

program of instruction at the institution. In a college setting, treatment records typically include 

those created and maintained at the campus health clinic. 

Who May Access FERPA-Protected Education Records? 

“School officials with a legitimate educational interest” may access FERPA-protected 

education records. Institutions determine the criteria for who is considered a school official 

with a legitimate educational interest under FERPA regulations. In a postsecondary context, there 

is a wide variety of individuals in different functions at the institution who could meet this 

definition. For example, faculty, administrators, and support staff, including law enforcement 

unit personnel, health center personnel, students serving on an official committee, the board of 

trustees, and others could be considered school officials with a legitimate educational interest. 

The term “school official with a legitimate educational interest” may also include contractors, 

consultants, volunteers, and other parties if those individuals 







Perform an institutional service or function for which the institution would otherwise use 

employees; 

Are under the direct control of the agency or institution with respect to the use and 

maintenance of education records; and 

Are subject to the requirements of 34 CFR § 99.33(a) which specifies that individuals 

who receive information from education records may use the information only for the 

purposes for which the disclosure was made and which generally prohibits the 

redisclosure of PII from education records to any other party without the prior consent of 

the parent or eligible student. There are, however, exceptions to this prohibition. 

In addition, institutions must notify eligible students of their rights under FERPA, and must 

include in this notification the criteria for who constitutes an IHE official and what constitutes a 
56

legitimate educational interest. The U.S. Department of Education provides model notification 

statements on its website at http://www2.ed.gov/policy/gen/guid/fpco/ferpa/ps-officials.html.

18

This means that if an institution wishes to consider non-employee members of its threat 

assessment team, its contracted counseling, nursing, service, or security staff, campus safety 

officials, and other non-employees as “school officials” who may have access to education 

records, the institution must ensure that these individuals meet the criteria in the bullets above 

and the criteria in the IHE’s annual notification of FERPA rights. 

Parents of an eligible student may, in some cases and at the discretion of the institution, 

access FERPA-protected records. When a student turns 18 years old or enters a postsecondary 

institution, all rights afforded to parents under FERPA transfer to the student (the “eligible 

student”). However, institutions may – but are not required to – share information from an 

eligible student’s records with parents, without the eligible student’s consent, if an exception to 

the general requirement of consent is applicable, such as 









If the student is claimed as a dependent for tax purposes; 

If the student is under 21 at the time of disclosure and if the student has violated any law 

or institutional rule or policy concerning the use or possession of alcohol or a controlled 

substance, and the postsecondary institutions determines that the student has committed a 

disciplinary violation with respect to that use or possession; 

Information based on that official’s personal knowledge or observation of the student; or

During a health or safety emergency involving their child. 

Balancing Safety and Privacy 

Postsecondary institution officials must balance safety interests and student privacy interests. 

FERPA contains exceptions to the general consent requirement, including the “health or safety 

emergency exception,” and exceptions to the definition of education records, including “law 

enforcement unit records,” which provide school officials with tools to support this goal. 

The Health or Safety Emergency Exception to the Consent Requirement 

FERPA generally requires written consent before the IHE may disclose PII from the student’s 

education records. However, the FERPA regulations permit IHE officials to disclose PII from 

education records without consent to appropriate parties only when there is an actual, impending, 

or imminent emergency, such as an articulable and significant threat. Information may be 

disclosed only to protect the health or safety of students or other individuals. In applying the 

health and safety exception, note that: 

 Institutions determine what constitutes a health or safety emergency. 

 

18 See 34 CFR § 99.7(a)(3)(iii) for further information. Available at http://www.ecfr.gov/cgi-bin/textidx?c=ecfr&SID=ea1af3867103d06eb14b239518b24822&rgn=div8&view=text&node=34:1.1.1.1.33.1.132.7&idno=34/.
57













“Appropriate parties” typically include law enforcement officials, first responders, public 

health officials, trained medical personnel, and parents, including parents of an eligible 

student.

This FERPA exception is temporally limited to the period of the emergency and does not 

allow for a blanket release of PII. It does not allow disclosures to address emergencies 

that might occur, such as would be the case in emergency preparedness activities. 

The information that may be disclosed is limited to only PII from an education record 

that is needed based on the type of emergency. 

Disclosures based on this exception must be documented in the student’s education 

records to memorialize the 

Emergency that formed the basis for the disclosure; and 

Parties with whom the IHE shared the PII. 

The U.S. Department of Education would not find an institution in violation of FERPA for 

disclosing FERPA-protected information under the health or safety exception as long as the 

institution had a rational basis, based on the information available at the time, for making its 

determination that there was an articulable and significant threat to the health or safety of the 

student or other individuals. 

For more information on the health and safety exception, see Addressing Emergencies on 

Campus, June 2011, available at http://www2.ed.gov/policy/gen/guid/fpco/pdf/emergencyguidance.pdf and see 34 CFR §§ 99.31(a)(10) and 99.36 available at 

http://www2.ed.gov/policy/gen/guid/fpco/pdf/ferparegs.pdf and http://www.ecfr.gov/cgibin/retrieveECFR?gp=&SID=a6d8c41c13e4156f3e961aaa1be8f9df&n=34y1.1.1.1.33.1&r=SUB

PART&ty=HTML.

The Law Enforcement Unit Records Exemption to the Definition of Education 

Records 

FERPA defines a “law enforcement unit” as any individual, office, department, division, or other 

component of an educational agency or institution, such as a unit of commissioned police 

officers or non-commissioned security guards, that is officially authorized or designated by that 

agency or institution to 

(i) Enforce any local, state, or federal law, or refer to appropriate authorities a matter for 

enforcement of any local, states, or federal law against any individual or organization 

other than the agency or institution itself; or 

(ii) Maintain the physical security and safety of the institution. 

Significantly, to be considered a “law enforcement unit” under this definition, an individual or 

component must be officially authorized or designated to carry out the functions listed above by 

the institution. IHEs may designate a traditional law enforcement entity (such as a campus safety 

department, campus police officer, or other IHE security personnel), or opt to designate another 
58

non-law-enforcement school official to serve as their law enforcement unit, such as a provost or 

other school official. 

FERPA does not prevent institutions from disclosing information from records maintained by the 

law enforcement unit that were created for law enforcement purposes by the law enforcement 

unit to anyone, subject to state law, including outside law enforcement authorities, without the 

consent of the eligible student during an emergency or otherwise. 

Law enforcement unit records, which are not subject to the FERPA consent requirements, are 

defined as records that are 







Created by a law enforcement unit; 

Created for a law enforcement purpose; and 

Maintained by the law enforcement unit. 

Law enforcement unit records do NOT include 







Records created by a law enforcement unit for a law enforcement purpose that are 

maintained by a component of the institution other than the law enforcement unit, such as 

a provost, dean, disability services coordinator, or health clinic;

Records received from another component of the IHE, such as health records, PII 

collected about or related to the disability of a student, and disciplinary records; and

Records created and maintained by a law enforcement unit exclusively for a non-law 

enforcement purpose, such as an institutional disciplinary action or proceeding.

In designating a law enforcement unit and using law enforcement unit records, note that 





To be given access to PII from a student’s education records, law enforcement unit 

officials who are employed by the institution must meet the criteria set forth in the 

institution’s FERPA notification for “school officials with a legitimate educational 

interest.” While law enforcement unit officials are not required to be an institution’s

officials under FERPA, many institutions have found that it is useful for them to be their 

officials so that they may access education records that may be necessary to ensure IHE 

safety. For instance, if a student has been barred from campus for a period of time (a fact 

that would be recorded in the student’s education records), the law enforcement unit 

might need to know this in case the student attempts to enter a campus building when not 

permitted to do so. 

An institution’s law enforcement unit officials must protect the privacy of education 

records they receive and may disclose them only in compliance with FERPA. For that 

reason, we recommend that law enforcement unit records be maintained separately from 

education records.
59

For more information on law enforcement unit records and FERPA, refer to the following sources: 









“Addressing Emergencies on Campus,” June 2011, available at 

http://www2.ed.gov/policy/gen/guid/fpco/pdf/emergency-guidance.pdf 

The discussion in the preamble to the final rule in the Federal Register published Dec. 9, 

2008, starting on page 74,815 addresses law enforcement unit records and starting on 

page 74,834, discusses FERPA (available at 

http://www2.ed.gov/legislation/FedRegister/finrule/2008-4/120908a.pdf). 

The Family Policy Compliance Office website at 

http://www.ed.gov/policy/gen/guid/fpco/index.html

The regulatory definition of “Law Enforcement Unit” under FERPA in 34 CFR § 99.8(a) 

available at http://www.ecfr.gov/cgibin/retrieveECFR?gp=&SID=ae535d41f8bb03bedfef79634883360f&n=34y1.1.1.1.33&r

=PART&ty=HTML#34:1.1.1.1.33.1.132.8.

Common FERPA Misunderstandings 

Institutional administrators and their partner organizations must understand FERPA and its 

implications because misinterpretations of the law and subsequent delays in information sharing 

can hinder first responders’ efforts to provide necessary assistance in a health or safety 

emergency. 

Sharing Personal Observation or Knowledge 

Misinterpreting FERPA can lead institutional administrators to miss opportunities to share 

crucial information that could prevent an emergency situation. For instance, some institutions 

incorrectly believe that information obtained from a school official’s personal observations or 

knowledge is protected by FERPA. In fact, personal observation or knowledge is generally not 

considered to be part of the student’s education records (see “What Are Education Records” 

above) and therefore may be disclosed. For example, if a faculty member overhears a student 

making threatening remarks to other students or is concerned after having a discussion with a 

student that the student may be violent, the faculty member is not prohibited from sharing that 

information with appropriate authorities, including the parents of the students who were 

threatened and the student’s parents. While FERPA would not prohibit the sharing of such 

information with others, there may be state laws or institutional policies and procedures that 

would preclude the faculty member from sharing the information. 

However, if a school official learns of information about a student through his or her official role 

in creating or maintaining an education record, then that information would be covered by 

FERPA. For instance, if an institutional disciplinary panel takes action against a student, then an 

individual serving on the panel would not be permitted to non-consensually disclose that 

information because he or she gained personal knowledge of that information in making the 

disciplinary determination and the determination is maintained in an education record. 

The Clery Act’s Timely Warning Requirement and FERPA

The Clery Act requires institutions to, among other things, give timely warnings of crimes that 

represent a threat to the safety of students or employees (see the “A Closer Look” section on the 
60

Clery Act for more information about it). These warnings are intended to enable members of the 

campus community to protect themselves. While the Clery Act does not specify what information 

should be included in a timely warning,19 it should include all information that would promote 

safety and that would aid in the prevention of similar crimes. Institutions often incorrectly 

believe that FERPA conflicts with this timely warning requirement. It does not. FERPA allows 

the release of PII from education records in the case of an emergency without consent when 

needed to protect the health and safety of others. In addition, if institutions utilize the law 

enforcement unit records of a campus law enforcement unit to issue a timely warning, FERPA is 

irrelevant as those records are not protected by FERPA. (See Clery Act, 20 U.S.C. §1092(f), 20

with implementing regulations at 34 CFR § 668.46.) 21

Releasing Directory Information 

In some circumstances, institutions may be able to disclose “directory information” to prevent an 

emergency situation. Directory information means information contained in a student’s 

education record that would not generally be considered harmful or an invasion of privacy if 

disclosed. Some examples of directory information include a student’s name, address, telephone 

number, or e-mail address. Institutions must follow certain requirements in publicly designating 

“directory information,” and they may not disclose directory information from a student’s 

education record if the eligible student has opted out of allowing that disclosure. (See 34 CFR 

§99.37.) For example, an institution could disclose properly designated directory information to 

first responders for emergency-preparedness exercises if the eligible students have not opted out 

of the disclosure. 

Additional Situations With FERPA Considerations 

FERPA has implications in a variety of different situations, and new questions arise as 

institutions become more creative and innovative in developing their campus safety plans. In 

many cases, however, it is helpful to review the FERPA basics to help you clearly think through 

each scenario. Following are some scenarios that may arise. 

 Infectious Disease

Under the health or safety emergency exception, school officials may, without consent, 

disclose PII from education records to appropriate parties in connection with an 

emergency. In the case of an influenza outbreak, for instance, if an institution’s officials 

determine that an emergency exists, they may share immunization records with parties, 

such as state and local public health officials, whose knowledge of the information is 

necessary to protect the health or safety of students or others in the campus community. 

Under this exception, institutions may share information only during the limited period of 

time connected with the emergency. A blanket release of information is not allowed. You 

 

19 Beginning in March 2014, the Clery Act will prohibit the release of victims’ names in timely warning notifications 

and crime logs. 

20 20. U.S.C. 1092(f)is available at http://www.gpo.gov/fdsys/pkg/USCODE-2011-title20/html/USCODE-2011-

title20-chap28-subchapIV-partF-sec1092.htm.

21 34 CFR § 668.46 is available at http://www.ecfr.gov/cgi-bin/textidx?c=ecfr&SID=676893907309b77d0c88954dcce41914&rgn=div8&view=text&node=34:3.1.3.1.34.4.39.6&idno=34.
61

must instead determine what information to disclose on a case-by-case basis depending 

on the particular threat. 







Threat Assessment Teams 

Some institutions may need assistance in determining whether a health or safety 

emergency exists for purposes of complying with FERPA. Federal agencies encourage 

institutions to implement a threat assessment program, including the establishment of a 

multi-disciplinary TAT that utilizes the expertise of representatives from mental health 

service providers, persons familiar with emergency procedures, and law enforcement 

agencies in the community, as well as from the major areas of the institutions, such as 

student affairs, academic affairs, the campus security department, and other appropriate 

professionals. 

The TAT must comply with applicable civil rights and other federal and state laws. 

Under a properly implemented threat assessment program, IHEs can respond to student 

behavior that raises safety concerns that is not based on assumptions, stereotypes, or 

myths about people with disabilities (including mental health-related disabilities) and 

people of a particular race, color, ethnicity, national origin, religion, or sex. 

If a TAT member meets the definition of an official of the institution (as a party to whom 

the IHE has outsourced administrative functions or services) with a legitimate 

educational interest under FERPA, (see “Who May Access FERPA-Protected Education 

Records” above), then he or she would be able to access students’ education records in 

which he or she has legitimate educational interests. A TAT member, however, may not 

disclose PII from education records to anyone without consent or unless one of the 

exceptions to consent under FERPA, such as the health or safety emergency exception, 

applies. 

Security Videos 

Institutions are increasingly using security cameras as a tool to monitor and improve 

student safety. Images of students captured on security videotapes that are created and 

maintained by the IHE’s law enforcement unit for a law enforcement purpose, are not 

considered education records under FERPA. Accordingly, these videotapes may be 

shared with outside authorities, such as local law enforcement authorities, as appropriate. 

Transfer of Education Records 

FERPA permits school officials to disclose any and all education records, including 

disciplinary records, to another institution at which the student seeks or intends to
62

enroll.22 While student consent is not required for transferring education records in this 

scenario, the institution’s annual FERPA notification should indicate that such 

disclosures are made. In the absence of information about disclosures in the annual 

FERPA notification, school officials must make a reasonable attempt to notify the student 

about the disclosure, unless the student initiates the disclosure. Additionally, upon 

request, the institution must provide a copy of the information disclosed and an 

opportunity for a hearing to address information the student believes to be inaccurate, 

misleading, or in violation of the student’s rights of privacy. 





FERPA and Student Health Information 

Postsecondary institutions that provide health or medical services to students may 

disclose an eligible student’s treatment records to health care professionals who are 

providing treatment to the student, including health care professionals who are not part of 

or not acting on behalf of the institution (i.e., third-party providers), as long as the 

information is being disclosed only for the purpose of providing treatment to the student. 

In addition, an eligible student’s treatment records may be disclosed to a third-party 

provider when the student has requested that his or her records be reviewed by a 

physician or other appropriate professional of the student’s choice. 

While, by definition, treatment records are not available to anyone other than 

professionals providing treatment to the student, this does not prevent an institution from 

disclosing these records for other purposes. However, once such a disclosure is made, the 

treatment records are no longer excluded from the definition of “education records” and 

are subject to all of the FERPA requirements as “education records” under FERPA. For 

example, if the institution chooses to do so, it may make a disclosure to the eligible 

student’s parents, under one of the exceptions to the general consent requirement. The 

records may also be disclosed to appropriate parties in connection with a health or safety 

emergency. 

FERPA and Student and Exchange Visitor Information System (SEVIS) 

FERPA permits institutions to comply with information requests from the U.S. Department 

of Homeland Security (DHS), U.S. Immigration and Customs Enforcement (ICE) in order 

to comply with the requirements of SEVIS. Officials who have specific questions about 

this and other matters involving international students should contact the U.S. Department 

of Education’s Family Policy Compliance Office at 400 Maryland Avenue SW, 

Washington, DC 20202-8520 or by calling 1-800-872-5327 (1-800-USA-LEARN).

 

22 Please note that civil rights laws may apply. For instance, Section 504 of the Rehabilitation Act prohibits pre-admission 

inquiries about an applicant’s disability. See 34 CFR § 104.42(b)(4) available at http://www.ecfr.gov/cgi-bin/textidx?c=ecfr&SID=ec9ff20a16040ddc021d2d0b60f6f668&rgn=div8&view=text&node=34:1.2.1.1.3.5.132.2&idno=34.
63





Disciplinary Records 

While student disciplinary records are protected as education records under FERPA, there 

are certain circumstances in which specified information contained in disciplinary records 

may be disclosed without the student’s consent. Under the Clery Act, an IHE must 

disclose to the accuser and the accused the outcome of an institutional disciplinary 

proceeding alleging a sex offense. For this purpose, the outcome of a disciplinary hearing 

means the institution’s final determination with respect to the alleged sex offense and any 

sanction imposed against the accused. The final results must include the name of the 

alleged perpetrator, the violation committed, and any sanction imposed by the institution 

against the alleged perpetrator. An institution may disclose to anyone—not just the 

victim—the final results of a disciplinary proceeding, if it determines that the student is 

an alleged perpetrator of a crime of violence or non-forcible sex offense, and with respect 

to the allegation made against him or her, the student has committed a violation of the 

institution's rules or policies. 

Missing Students 

The Clery Act, as amended, requires postsecondary institutions that maintain on-campus 

student housing facilities to establish, for students who reside in on-campus student 

housing, a missing student notification policy that includes notifying students that they 

may register “confidential” contact information for an individual to be contacted if the 

student is determined to be missing. Although missing student contact information would 

be considered PII from a student’s education records under FERPA, under the Higher 

Education Act, only authorized campus officials and law enforcement officers in 

furtherance of a missing person investigation may have access to this confidential contact 

information. This means that an institution may not disclose a student’s confidential 

contact information to a student’s parent or guardian or any other person other than 

authorized campus officials and law enforcement officers. A student’s identification of a 

confidential contact is accepted as permission for law enforcement personnel to contact 

the identified individual if the student is determined to be missing. 

Incorporating FERPA into Your Emergency Planning Process 

Below are critical questions and concepts that institutions should discuss with their community 

partners (e.g., first responders, emergency managers, public and mental health officials) while in 

the process of developing or revising an emergency management plan. While building 

partnerships is critical, in gathering information to support these partnerships, institutions must 

also take steps to balance student privacy with their mission of safety. Be sure to refer to the 

sections elsewhere in this guidance to review any concepts with which you are unfamiliar. 

What Information is FERPA-Protected, and When May the Institution Share It? 

Education records are protected by FERPA, and institutions may generally disclose PII from 

those records only with written consent from an eligible student, unless a FERPA exception to 

consent applies. (See “What Are ‘Education Records’” above.) The following are examples of 

how FERPA would apply in a variety of situations. 
64

Example: At the start of flu season, your local public health agency requests the names of 

those students showing influenza-like symptoms, as well as the name and location of 

their dorm rooms. You know that you may not disclose PII from a student’s education 

records without consent if there is not a health or safety emergency or another exception 

to consent under FERPA that applies. So, to facilitate this disclosure of information, you 

opt to develop a consent form that identifies students’ names and the name or location of 

their dorm rooms as specific PII from student education records that you would like to 

share with the local public health agency, as well as the purpose of the disclosure. The 

form gives eligible students the option to allow or to not allow this sharing of 

information. After collecting the signed and dated consent forms, for the students for 

whom you received consent, you begin to share with the local health agency the names of 

those students who are showing influenza-like symptoms and the name and location of 

their dorm rooms. Your purpose in sharing this information is to help the health agency 

be able to conduct real-time surveillance to prevent the spread of the illness. (See “What

Is FERPA?” above.)

Example: Your institution’s TAT includes representatives from your community partners 

(e.g., law enforcement, public health officials), and you have properly designated them as 

“school officials with a legitimate educational interest.” (See “Who May Access FERPAProtected Records?” above.) The local law enforcement agency representative on your 

team does not share with his police chief or other local law enforcement officials the PII 

that he obtains from a student’s education records as a TAT member while working to 

identify possible threats because he knows that this is not permitted. Several months after 

the TAT initially convened to review a collection of behaviors and communications 

concerning a particular student and determined that there was not sufficient information 

demonstrating that the student posed a threat, the team learns that the student has now 

communicated his intent to harm one of his professors. At this juncture, the local law 

enforcement representative (and other members of the TAT) shares pertinent PII from 

education records with appropriate parties so they can take steps, such as consulting with 

the municipal police agency, to protect the health or safety of the professor. (See also the 

discussion of TATs under “Additional Situations With FERPA Considerations” above.)

Example: At the beginning of the fall term, your institution notified eligible students that 

you had designated students’ names, phone numbers, and e-mail addresses as “directory 

information,” explaining to them that you would disclose this information upon request to 

anyone contacting the IHE. In your notice, you provided an option to opt out of this 

disclosure, and you explained how and by when they could opt out. When a reporter 

contacts your institution requesting the directory information about a student, you check 

to see whether the student opted out of the disclosure of directory information. Because 

the eligible student did not opt out of the IHE’s directory information policy, you decide 

to provide that directory information to the reporter. (See “Common FERPA

Misunderstandings” above.)

Example: Two students have an altercation in their residence hall, and one student is 

stabbed in the abdomen and falls unconscious. A bystander calls 911 for an ambulance 

and contacts the resident-life director. When the ambulance arrives, the resident-life 

director discloses to the EMS practitioner the PII from the student’s education record
65

related to the stabbed student with hemophilia without obtaining the wounded student’s 

consent under the health or safety emergency exception. (See “The Health or Safety 

Emergency Exception” above.) 

Example: A parent of a student at your institution calls requesting PII from their child’s 

education records after learning that the student has been disciplined by the institution for 

underage drinking. Because you know that you may share information without the 

student’s consent because the student is under 21 and has violated a law concerning the 

use or possession of alcohol, and there has been a disciplinary finding, you comply with 

the parent’s request. (See “Who May Access FERPA-Protected Records” above.) 

What Information Is Not FERPA-Protected, and When May the IHE Share It?

Records that are created and maintained by an IHE’s law enforcement unit for law enforcement 

purposes are not protected by FERPA, and there are no FERPA restrictions on the sharing of 

information in law enforcement unit records. (See “What Are ’Education Records’?” and 

“Balancing Safety and Privacy” above.) 

Example: Your institution contracts with a security company to provide campus security, 

and you properly designate the security officer as your institution’s law enforcement unit.

You also properly designate the officer as a “school official with a legitimate educational 

interest.” (See “Who May Access FERPA-Protected Records” above.) The officer knows 

that he may not redisclose PII from education records to anyone unless there is a health or 

safety emergency or another FERPA exception to consent applies. However, he shares his 

law enforcement unit records about a student who was arrested for smoking marijuana on 

campus with the other law enforcement officials because he knows that law enforcement 

unit records are not protected by FERPA. 

Are Processes and Protocols, Including Memoranda of Understanding (MOUs), in 

Place for Information Sharing and Record Keeping That Comply With FERPA? 

It is important for institutions to consider entering into MOUs with law enforcement officials and 

their other community partners to formalize roles, responsibilities, and protocols. MOUs can be 

tailored to the needs of the individual campuses in the jurisdiction. Any policies regarding 

information sharing between the institution and the law enforcement agency, however, must 

comply with applicable federal, state, and local laws, including FERPA. While informationsharing MOUs should be developed regarding what information can be shared between 

departments and what information is protected, no provision in an MOU can override an IHE’s 

obligations under FERPA.

Frequently Asked Questions Pertaining to FERPA

Q: To what entities does FERPA apply?

A: FERPA applies to educational agencies and institutions that receive funds under any program 

administered by the U.S. Department of Education. This includes virtually all public schools and 

school districts, and most private and public postsecondary institutions, including medical and 

other professional institutions. 
66

Q: Does an interagency agreement with partners such as the state or local health 

department enable an institution to non-consensually disclose education records? 

A: No. Interagency agreements do not supersede the consent requirements under FERPA. 

Although an interagency agreement would be a helpful tool for planning purposes, institutions 

must comply with FERPA’s requirements regarding the disclosure of PII from students’ 

education records. 

Q: Under the health and safety emergency exception, may an IHE non-consensually 

disclose PII from education records to the media? 

A: No. You generally may not disclose FERPA-protected information to the media, unless the 

PII disclosed is directory information on eligible students who have not opted out. While the 

media play a role in alerting the community of a health epidemic or violent incident, they do not 

generally have a role in protecting the health or safety of individual students or others at the 

institution. 

Q: When would the health or safety exception apply? 

A: Under FERPA, an emergency means a situation in which there is an articulable and 

significant threat to the health or safety of students or other individuals. This determination must 

be made by the institution. 

Q: Do I need to tell eligible students or otherwise document when I have disclosed 

information from their education records without consent under a health or safety 

emergency or other exception? 

A: When an educational agency or institution makes a disclosure under this exception, an 

institution must record in the student’s education records the articulable and significant threat 

that formed the basis for the disclosure, and the parties to whom the information was disclosed. 

Eligible students have a right to inspect and review the record of disclosure but do not need to be 

proactively informed that records have been disclosed.

Q: Can members of our TAT have access to student education records? 

A: School officials with legitimate educational interests may have access to a student’s education 

records. Members of a TAT who are not an institution’s employees may be designated as such if 

they are under the direct control of the institution with respect to the maintenance and use of PII 

from education records; are subject to the requirements of 34 CFR § 99.33(a) governing the use 

and redisclosure of PII from education records; and otherwise meet the IHE’s criteria for being 

school officials with legitimate educational interests. 

Members of a TAT who are considered school officials with a legitimate educational interest 

generally cannot non-consensually redisclose PII from a student’s education records to which he 

or she was privy as part of the team. However, if a TAT determines that a health or safety 

emergency exists, as defined under FERPA, members may non-consensually redisclose PII from 

a student’s education records on behalf of the institution to appropriate officials under the health 

or safety emergency exception. 
67

For example, a representative from the city police force who serves on an IHE’s TAT generally 

could not redisclose, without consent, PII from the student’s education records to the city police 

during the initial discussions about a particular student. However, once the TAT determines that 

a health or safety emergency exists, as defined under FERPA, the representative may redisclose, 

without consent, PII from a student’s education records on behalf of the institution to appropriate 

officials. (See the discussion under “Additional Situations With FERPA Considerations” above.)

Q: How does FERPA interact with the Health Insurance Portability and Accountability Act 

of 1996 (HIPAA)?

A: The U.S. Department of Education and the U.S. Department of Health and Human Services 

(HHS) jointly developed guidance on the application of FERPA and HIPAA. This guidance 

explains that records that are protected by FERPA are exempt from the HIPAA Privacy Rule. 

Accordingly, school officials must follow the requirements of FERPA with regard to the 

disclosure of records protected by FERPA. For more information, please see the guidance at 

http://www2.ed.gov/policy/gen/guid/fpco/doc/FERPA-HIPAA-guidance.pdf, as well as the 

HIPAA information in this “A Closer Look” section.

Q: What are some of the other federal and states laws that are relevant to the access and 

sharing of information about students that relate to emergency management planning? 

A: As noted in the introduction to this “A Closer Look” section, IHEs may also be subject to 

federal and state civil rights laws that protect the disclosure of information about students. IHEs 

and their community partners should review guidance from the U.S. Departments of Education 

and Justice on any applicable civil rights or other statutes governing privacy and information 

sharing, and discuss their implications for emergency management and related planning 

processes. At a minimum, in determining what constitutes an “emergency,” IHEs and their 

community partners must base their decisions on actual risks and not on assumptions, 

stereotypes, fears, or myths about people with disabilities (including mental health-related 

disabilities) or people of a particular race, color, ethnicity, national origin, religion, sex, sexual 

identity, or gender identification.23,24

 

23 See Title 28 of the Code of Federal Regulations, Section 35.139 available at http://www.ecfr.gov/cgi-bin/textidx?c=ecfr&SID=c6b7e6addf8451d18de7740dffed1706&rgn=div8&view=text&node=28:1.0.1.1.36.2.32.10&idno=

28.

24 In enacting ADA, Congress relied on School Board of Nassau County, Florida v. Arline, 480 U.S. 273, 284 (1987) 

to “acknowledge[] that society’s accumulated myths and fears about disability and disease are as handicapping as 

are the physical limitations that flow from actual impairment.” As explained in the preamble to the U.S. Department 

of Justice’s 1991 ADA regulation, codification of the Arline standard was deemed essential if the ADA is to achieve 

its goal of protecting disabled individuals from discrimination based on prejudice, stereotypes, or unfounded fear, 

while giving appropriate weight to legitimate concerns, such as the need to avoid exposing others to significant 

health and safety risks. See 28 C.F.R. pt. 36, app. C, sec. 36.208 available at http://www.ecfr.gov/cgibin/retrieveECFR?gp=&SID=01903fc38a7bdb19c90e9c2e84fa788e&n=28y1.0.1.1.37&r=PART&ty=HTML#28:1.

0.1.1.37.2.32.8/. This rationale applies with equal force to making determinations based on stereotypes about other 

characteristics protected by Titles IV and VI of the Civil Rights Act of 1964. 
68

Q: Whom should I contact for more information related to FERPA?

A: The U.S. Department of Education’s Family Policy Compliance Office is available to respond 

to any questions about FERPA. For quick responses to routine questions, please e-mail the U.S. 

Department of Education at FERPA@ed.gov. For more in-depth technical assistance or a more 

formal response, you may call the Family Policy Compliance Office at 202-260-3887 or write to 

them at

Family Policy Compliance Office 

U.S. Department of Education 

400 Maryland Avenue SW

Washington, DC 20202-8520

In addition, please see the U.S. Department of Education’s website at 

http://www2.ed.gov/policy/gen/guid/fpco/index.html for the most recent guidance. 

FERPA Guidance and Resources 

The Family Policy Compliance Office (FPCO) at the U. S. Department of Education administers 

FERPA. FPCO has developed, and continues to develop, extensive guidance pertaining to the 

implementation of FERPA and emergency situations. For more detailed information or additional 

guidance, please see the documents below and the FPCO website at www.ed.gov/fpco. In 

addition, please see the Navigating Information Sharing Toolkit, developed by the National 

Center for Mental Health Promotion and Youth Violence Prevention, at 

http://sshs.promoteprevent.org/nis.
69

Health Insurance Portability and Accountability Act of 1996 (HIPAA) 

What Is HIPAA? 

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing 

regulations, commonly known as the HIPAA Privacy Rule and the HIPAA Security Rule, protect 

the privacy and security of individually identifiable health information, called “protected health 

information” or “PHI.” Such information is held by health plans, health care clearinghouses, and 

most health care providers, collectively known as “covered entities,” and their business 

associates (entities that have access to individuals’ health information to perform work on behalf 

of a covered entity). 

The Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, 

establishes national standards to protect the privacy of individuals’ identifiable health 

information. In doing so, the Privacy Rule sets forth the circumstances under which covered 

entities and their business associates may use or disclose an individual’s health information, 

requires safeguards to protect the information, and gives individuals rights, including rights to 

examine and obtain a copy of their health records and to request corrections. 

A major goal of the Privacy Rule is to ensure that individuals’ health information is properly 

protected while allowing the flow of health information needed to provide and promote highquality health care, and to protect the public's health and well-being. Given that the health care 

marketplace is diverse, the Privacy Rule is designed to be flexible and comprehensive to cover 

the variety of uses and disclosures that need to be addressed. 

The Security Rule, or Security Standards for the Protection of Electronic Protected Health 

Information, establishes a national set of security standards for protecting health information that 

is held or transferred in electronic form. The Security Rule sets out the technical, administrative, 

and physical safeguards that covered entities and business associates must put in place to secure 

individuals’ electronic health information. The Security Rule is designed to be flexible and 

scalable, and technology neutral, so a covered entity or business associate can implement 

policies, procedures, and technologies that are appropriate for the entity’s particular size, 

organizational structure, and risks to consumers’ electronic health information.

The U.S. Department of Health and Human Services Office for Civil Rights has responsibility 

for administering and enforcing the Privacy and Security Rules. 

In this section:







What Is HIPAA?

How Does HIPAA Apply in Schools?

HIPAA Guidance and Resources
70

How Does HIPAA Apply in Institutions of Higher Education? 

Basic Principle. A major purpose of the Privacy Rule is to define and limit the circumstances in 

which an individual’s protected heath information may be used or disclosed by covered entities. 

A covered entity may not use or disclose protected health information, except either: (1) as the 

Privacy Rule permits or requires; or (2) as the individual who is the subject of the information 

(or the individual’s personal representative) authorizes in writing. 

Generally, HIPAA does not apply to health information in student records maintained by an IHE. 

While IHEs may maintain student health records, these records are in most cases not protected 

by HIPAA. Rather, student health information maintained at an IHE would be considered 

education or treatment records protected by FERPA.

HIPAA may apply, however, to patient records at a university hospital, which may include 

records on students and non-students, or to the health records of non-students at a university 

health clinic. 

During the emergency planning process, if you believe health information to which access may 

be needed is covered by HIPAA, you should consult the guidance and resources below for further 

information about how HIPAA applies. 

HIPAA Guidance and Resources 

The Office for Civil Rights has developed, and continues to develop, extensive guidance 

pertaining to the implementation of HIPAA Privacy Rule and emergency situations. The Office 

for Civil Rights website has guidance about the intersection between HIPAA and FERPA, and 

the release of PHI for common emergency preparedness issues and public health purposes, such 

as terrorism preparedness and outbreak investigations. For more detailed information or 

additional guidance, please see the Office for Civil Rights website at 

http://www.hhs.gov/ocr/privacy/index.html. 
71

3. Incorporating International Students into IHE Emergency 

Management and Planning 

Each year, approximately 800,000 international students and scholars come to the United States 

to study at our colleges and universities. While here, these students and their family members 

become members of campus communities, participating in activities in and outside of the 

classroom. As members of a campus community, international students are affected, as all 

students are, during crises. They also present a set of unique needs for IHEs to consider in 

planning for and responding to crises. IHE and community preparedness can be enhanced by 

IHEs incorporating these unique needs into their emergency management plans. When a crisis 

occurs, IHE officials must be able to quickly communicate with international students and help 

manage their individual situations. 

IHEs must also have procedures in place to ensure proper reporting with federal authorities. All 

international students who come to the United States in F, M, or J visa classes are monitored by 

the U.S. Department of Homeland Security through its online database, SEVIS. Colleges and 

universities certified by the ICE Student and Exchange Visitor Program (SEVP) to enroll 

international students must have Designated School Officials on campus. Designated School 

Officials maintain responsibility for advising international students and inputting data into 

SEVIS regarding student programs, location, and status to assist the U.S. Department of 

Homeland Security in monitoring compliance with immigration law. During emergencies, IHEs 

maintain the responsibility of making timely updates to SEVIS to reflect the status and location 

of international students. Likewise, international students need to know how to maintain their 

immigration status and other timely information about their options, such as transferring, if they 

are unable to continue their studies at their current IHEs. 

To aid in appropriate and timely handling of international student issues during emergencies, 

prior to any emergency, it is important that IHEs consider the following actions: 













Understand the key issues related to international students in emergency management 

scenarios outlined above; 

Incorporate the Principal Designated School Official (PDSO), the IHE’s international 

student office, and appropriate law enforcement points of contact into its EOP; 

Define IHE policies for staff and international students to support continuity of 

operations during crises; 

Establish processes for international students to communicate to the IHE their location, 

safety concerns, and short- and long-term plans; 

Incorporate the PDSO and/or other key international student contacts into the crisis 

response process; 

Develop the ability to access SEVIS from alternate facilities or remote locations; and 
72

 Support the PDSO and/or other key international student contacts in understanding the 

principles of emergency management and their role(s) in the IHE’s emergency 

management plans. 

There may be instances in which an international student is a victim of an event or an alleged 

perpetrator. In this scenario, IHEs may have to coordinate with local, state, and federal law 

enforcement officials on administrative or criminal matters. Understanding the IHE’s role and 

accompanying rules for communication can lead to swifter and more efficient resolution by the 

appropriate authorities. 

Examples such as Hurricane Katrina and the April 2013 Boston Marathon bombing illustrate the 

need to incorporate international students into higher ed EOPs. During Hurricane Katrina, many 

IHEs in the Gulf Coast region suffered damage and were forced to close in its aftermath. This 

left thousands of international students displaced, requiring timely communication to address 

immediate safety concerns and coordination between IHEs and DHS to resolve immigration 

status issues. One of three victims killed in the Boston Marathon bombing was a Chinese 

graduate student, requiring notification to SEVP and the U.S. Department of State. Each 

situation required action by an IHE and coordination with local, state, and federal authorities. 
73

4. Campus Public Safety 

The characteristics of security and police services on the nation's college and university 

campuses vary considerably. However, the following four primary types of campus public safety 

services are most common: 

1. Campus police department: An integral part of the IHE that provides law enforcement 

and other services (e.g., traffic control, building security) to the IHE. All the members of 

the department are employed by the IHE, and the sworn law enforcement officers of the 

department also have authority to enforce federal, state, local, and tribal laws, as 

authorized.

2. Security department or operation: An agency whose members are employed by the 

IHE, but whose members are not sworn officers. Because the members do not have sworn 

authority, the IHE relies on federal, state, local, and tribal law enforcement for support in 

criminal matters. 

3. Contract security personnel: A private firm contracted to provide security services to 

the IHE. The IHE relies on federal, state, local, and tribal law enforcement for support in 

criminal matters. 

4. Local, state, or tribal police: A local, state, or tribal police agency that provides law 

enforcement services to the IHE by contract or agreement. 

On some campuses, police and security operations may be provided by a combination of the 

above services, with some services contracted to private vendors while others are maintained as 

the responsibility of the campus public safety agency (which can include a fire department or 

emergency medical services unit). 

Regardless of the type of public safety model utilized by the IHE, the planning team must take 

into consideration the authority granted to federal, state, local, and tribal first responders to act 

on campus as permitted by law for each agency (e.g., law enforcement agency, fire department, 

and public health office). 

The type of police or security operation may vary within the same system or campus. Among 

major state university systems the police or security operations may differ from campus to 

campus. Individual campuses may have separate police or security departments for different 

components of the campus, such as the hospital, graduate school, or athletic facility. These 

different departments may have their own uniforms, insignia, training operations, and policies. 

The type of security operation also may vary between on- and off-campus facilities. Many IHEs 

are decentralized, with remote centers and facilities located away from the main campus. Offcampus sites may house important research and data records. Off-campus residences may house 

thousands of students. Some campus public safety agencies are responsible for patrolling areas 

that surround campuses pursuant to legislation or through formal agreement with the federal, 

state, local, or tribal law enforcement authority. At some IHEs, students are not required to live 

on campus, and off-campus housing sites may not fall within the IHEs policing or security 
74

jurisdiction. This may create legal, jurisdictional, and operational conflicts in preventing and 

responding to crimes and managing emergencies. 

Regardless of these variations, campus public safety officials should be intricately involved in 

the creation of the higher ed EOP, as they have critical responsibilities before, during, and after 

an emergency. To effectively develop and implement a high-quality EOP, the planning team 

should work with the campus public safety agency to 













Inform federal, state, local, and tribal agencies about the characteristics, strengths, 

vulnerabilities, and needs of the campus; 

Develop mutual-aid agreements and memoranda of understanding with other public 

safety partners (e.g., those adjoining the IHE’s public safety entities, nearby fire 

departments);

Participate in federal, state, local, and tribal activities, including exercises, that address 

the range of campus public safety needs; 

Meet with other IHEs to foster information sharing, common prevention and response 

strategies, and consistency in working with federal, state, local, and tribal public safety 

partners; 

Improve interagency coordination, create coalitions, and develop partnerships with 

federal, state, local, and tribal emergency management agencies; and 

Adopt common incident response strategies, policies, and procedures for use across 

multiple campuses and sites, as recommended by the National Incident Management 

System (NIMS). 
75

5. Active Shooter Situations

Police officers, firefighters, and emergency medical services (EMS) personnel (first responders) 

who come to an IHE because of a 911 call involving gunfire face a daunting task. Though the 

objective remains the same – protect students and staff – the threat of an active shooter incident 

is different than responding to a natural disaster or many other emergencies. 

Emergency calls can involve actual or future threats of physical violence. This violence might be 

directed not only in or at IHE buildings, students, staff, and areas on campus but also at nearby 

buildings off campus. 

“Active shooter situations” are defined25 as those where an individual is “actively engaged in 

killing or attempting to kill people in a confined and populated area.”26 Unfortunately, IHEs face 

active shooter situations as well. 

The better first responders and IHE personnel are able to discern these threats and react swiftly, 

the more lives can be saved. This is particularly true in an active shooter situation where law 

enforcement responds to a 911 call of shots fired. Many innocent lives are at risk in concentrated 

areas. This is why it is critical that IHEs work with their community partners (e.g., first 

responders, emergency managers) to identify, prepare, prevent, and effectively respond to an 

active shooter situation in a coordinated fashion. 

Active shooter situations are unpredictable and evolve quickly. Because of this, individuals must 

be prepared to deal with an active shooter situation before law enforcement personnel arrive on 

the scene. 

While this “A Closer Look” section addresses how IHEs should plan for active shooter 

situations, IHEs should also plan for other gun-related incidents (e.g., a single shot fired, 

possession of a weapon on campus). 

Preparing for an Active Shooter Situation 

Planning 

As with any threat or hazard that is included in an IHE’s EOP, the planning team will establish 

goals, objectives, and courses of action for an Active Shooter Annex. These plans will be 

impacted by the assessments conducted at the outset of the planning process and updated as 

ongoing assessments occur. As courses of action are developed, the planning team should 

consider a number of issues, including, but not limited to 

 How to evacuate or lock down students, staff, and visitors. (Personnel involved in such 

planning should pay attention to disability-related accessibility concerns when advising 

on shelter sites and evacuation routes.) 

 

25 Other gun-related incidents that may occur in a school environment are not defined as active shooter incidents 

because they do not meet this definition. Instead, they may involve a single shot fired, accidental discharge of a 

weapon, or incidents that are not ongoing. 

26 U.S. Department of Homeland Security, Active Shooter, How to Respond. Washington, DC: Author, October 

2008. Available at http://www.dhs.gov/xlibrary/assets/active_shooter_booklet.pdf. 
76









How to evacuate when the primary evacuation routes are unusable. 

How to select effective shelter-in-place locations (optimal locations have thick walls, 

solid doors with locks, minimal interior windows, first-aid emergency kits, 

communication devices, and duress alarms). 

How the IHE community will be notified that there is an active shooter on campus as 

required by the Clery Act.27 This could be done through the use of familiar terms, sounds, 

lights, and electronic communications, such as text messages or e-mails. Include in the 

courses of action how to communicate with those who have language barriers or need 

other accommodations, such as visual signals or alarms to advise deaf students, staff, and 

parents about what is occurring. IHE-wide “reverse 911-style” text messages sent to predetermined group distribution lists can be very helpful in this regard. Planners should 

make sure this protocol is readily available and understood by those who may be 

responsible for sending out or broadcasting an all-IHE announcement. Rapid notification 

of a threat can save lives by keeping people out of harm’s way. 

How students and staff will know when buildings and campus grounds are safe. 

The planning team may want to include functions in the Active Shooter annex that are also 

addressed in other functional annexes. For example, evacuation will be different during an active 

shooter situation than it would be for a fire. 

Additional considerations are included in the “Responding to an Active Shooter” and “After an 

Active Shooter Situation” sections below. 

Sharing Information with First Responders 

The planning process is not complete until the higher ed EOP is shared with first responders. The 

planning process must include preparing and making available to first responders an up-to-date 

and well-documented site assessment, as well as any other information that would assist them. 

These materials should include building schematics and photos of both the inside and outside of 

the buildings, and include information about door and window locations, and locks and access 

controls. Emergency responders should also have advance information on where students and 

staff with disabilities as well as others with access and functional needs are likely to be sheltering 

or escaping, generally in physically accessible locations, along accessible routes, or in specific 

classrooms. Building strong partnerships with law enforcement, fire, and EMS officials includes 

ensuring they also know the location of available public-address systems, two-way 

communications systems, security cameras, and alarm controls. Equally important is information 

on access to utility controls, medical supplies, and fire extinguishers. 

Providing the detailed information listed above to first responders allows them to rapidly move 

through an IHE during an emergency, to ensure areas are safe, and to tend to people in need. It is 

critically important to share this information with law enforcement and other first responders 

before an emergency occurs. Law enforcement agencies have secure websites where this 

 

27 See in this guide “A Closer Look: The Jeanne Clery Disclosure of Campus Security Policy and Campus Crime 

Statistics Act.”
77

Each person carries a three-fold responsibility.







First: Learn the signs of a potentially volatile situation and ways to prevent an incident.

Second: Learn the best steps for survival when faced with an active shooter situation.

Third: Be prepared to work with law enforcement during the response. 

information is stored for many IHEs, businesses, public venues, and other locations. All of these 

can be provided to first responders and viewed in drills, exercises, and walk-throughs. 

Technology and tools with the same information (e.g., a portable USB drive that is compatible 

with computers used by first responders) should be maintained in secured locations around 

campus from which IHE officials can immediately provide it to responding officials or from 

which first responders can directly access it. The locations of these materials at the IHE should 

be known by and accessible to a number of individuals to ensure ready access in an emergency. 

Every IHE should have more than one individual charged with meeting first responders to 

provide them with the IHE site assessment, the IHE EOP, and any other details about IHE safety 

and the facility.28 All parties should know who these key contacts are. 

Exercises 

Most IHEs practice evacuation drills for fires and protective measures for tornadoes, but far 

fewer IHEs practice for active shooter situations. To be prepared for an active shooter incident, 

IHEs should train their staff, students, and families, as appropriate, in what to expect and how to 

react. In a study of 84 active shooter events which occurred between 2000 and 2010, 34 percent 

involved schools or IHEs.29

Good planning includes conducting drills that must include first responders and campus public 

safety. Exercises with these valuable partners are one of the most effective and efficient ways to 

ensure that everyone knows not only her or his role(s) but also the role(s) of others at the scene. 

These exercises should include walks through IHE buildings to allow law enforcement officials 

to provide input on shelter sites as well as familiarize first responders with the campus, including 

accessible shelter locations and evacuation routes for people with disabilities and others with 

access and functional needs. 

 

28 See also http://www.ready.gov/. 

29 J. Pete Blair and M. Hunter Martaindale, United States Active Shooters Events from 2000 to 2010: Training and 

Equipment Implications. San Marcos, Texas: Texas State University, 2013. Available at

http://policeforum.org/library/critical-issues-in-policing-series/BlairUnitedStatesActiveShooterEventsfrom2000to2010Report-Final.pdf.
78

Preventing an Active Shooter Situation 

Warning Signs30

No profile exists for an active shooter; however, research indicates there may be signs or 

indicators. IHEs should learn the signs of a potentially volatile situation that may develop into an 

active shooter situation and proactively seek ways to prevent an incident with internal resources, 

or additional external assistance. 

By highlighting common pre-attack behaviors displayed by past offenders, federal researchers 

have sought to enhance the detection and prevention of tragic attacks of violence, including 

active shooting situations. Several agencies within the federal government continue to explore 

incidents of targeted violence in the effort to identify these potential “warning signs.” In 2002, 

the Federal Bureau of Investigation (FBI) published a monograph on workplace violence, 

including problematic behaviors of concern that may telegraph violent ideations and plans.31 In 

2007, the U.S. Secret Service, U.S. Department of Education, and the FBI collaborated to 

produce the report Campus Attacks, Targeted Violence Affecting Institutions of Higher Learning, 

which examined lethal or attempted lethal attacks at U.S. universities and colleges from 1900 to 

2008.32 The report was published in 2010, and featured several key observations related to preattack behaviors, including the following: 







In only 13 percent of the cases did subjects make verbal and/or written threats to cause 

harm to the target. These threats were both veiled and direct, and were conveyed to the 

target or to a third party about the target. 

In 19 percent of the cases stalking or harassing behavior was reported prior to the attack. 

These behaviors occurred within the context of a current or former romantic relationship, 

or in academic and other non-romantic settings. They took on various forms, including 

written communications (conventional and electronic), telephonic contact, and 

harassment of the target and/or the target’s friends and/or family. Subjects also followed, 

visited, or damaged property belonging to target(s) or their families prior to the attack. 

In only 10 percent of the cases did the subject engage in physically aggressive acts 

toward the targets. These behaviors took the form of physical assaults, menacing actions 

with weapons, or repeated physical violence to intimate partners. 

 

30 For information on warning signs of violence at schools, see The Final Report and Findings of the Safe School 

Initiative: Implications for the Prevention of School Attacks in the United States (Washington, DC: U.S. Department 

of Education and U.S. Secret Service, 2002) available at

http://www2.ed.gov/admins/lead/safety/preventingattacksreport.pdf. See also, U.S. Secret Service and the U.S. 

Department of Education, “Threat Assessment in Schools: A Guide to Managing Threatening Situations and to 

Creating Safe School Climates”, May 2002, available at

http://www2.ed.gov/admins/lead/safety/threatassessmentguide.pdf.

31 U.S. Department of Justice FBI Academy, Workplace Violence: Issues in Response. Quantico, Va.: Author, 2002. 

Available at http://www.fbi.gov/stats-services/publications/workplace-violence. 

32 U.S. Secret Service, U.S. Department of Education, and Federal Bureau of Investigation, Campus Attacks: 

Targeted Violence Affecting Institutions of Higher Education. Washington, DC: Author, 2010. Available at 

http://rems.ed.gov/docs/CampusAttacks_201004.pdf. A second phase of the project focuses exclusively on 

grievance-based attacks that occurred from 1985 to 2010.
79

 Concerning behaviors were observed by friends, family, associates, professors, or law 

enforcement in 31 percent of the cases. These behaviors included, but were not limited to, 

paranoid ideas, delusional statements, changes in personality or performance, disciplinary 

problems on campus, depressed mood, suicidal ideation, non-specific threats of violence, 

increased isolation, “odd” or “bizarre” behavior, and interest in or acquisition of 

weapons. 

Specialized units in the federal government (such as the FBI’s Behavioral Analysis Unit) 

continue to support behaviorally based operational assessments of persons of concern in a variety 

of settings (e.g., IHEs, workplaces, places of worship) who appear be on a trajectory toward a 

violent act. A review of current research, threat assessment literature, and active shooting 

incidents, combined with the extensive case experience of the Behavioral Analysis Unit, suggest 

that there are observable pre-attack behaviors that, if recognized, could lead to the disruption of a 

planned attack.33 While checklists of various warning signs are often of limited use in isolation, 

the FBI has identified some behavioral indicators that should prompt further exploration and 

attention from law enforcement and/or campus safety stakeholders. These behaviors often 

include: 















Development of a personal grievance; 

Contextually inappropriate and recent acquisitions of multiple weapons; 

Contextually inappropriate and recent escalation in target practice and weapons training; 

Contextually inappropriate and recent interest in explosives; 

Contextually inappropriate and intense interest or fascination with previous shootings or 

mass attacks; and 

Experience of a significant real or perceived personal loss in the weeks and/or months 

leading up to the attack, such as a death, breakup, divorce or loss of a job. 

Few offenders had previous arrests for violent crimes. 

 

33 See, Frederick Calhoun and Stephen Weston, Contemporary Threat Management: A Practical Guide for 

Identifying, Assessing, and Managing Individuals of Violent Intent (San Diego, CA: Specialized Training Services, 

2003); Gene Deisinger, Marisa Randazzo, Daniel O’Neill, and Jenna Savage, The Handbook for Campus Threat 

Assessment and Management Teams (Stoneham, MA: Applied Risk Management, 2008); Robert Fein, Bryan 

Vossekuil, and Gwen Holden, Threat Assessment: An Approach to Prevent Targeted Violence (Washington, DC: 

U.S. Department of Justice, Office of Justice Programs, National Institute of Justice, 1995); John Monahan, Henry 

Steadman, Eric Silver, Paul Appelbaum, Pamela Robbins, Edward Mulvey, Loren Roth, Thomas Grisso, and Steven 

Banks, Rethinking Risk Assessment: The MacArthur Study of Mental Disorder and Violence (New York, NY: 

Oxford University Press, 2001); Bryan Vossekuil, Robert Fein, Marisa Reddy, Randy Borum, and William 

Modzeleski., The Final Report and Findings of the Safe School Initiative: Implications for the Prevention of School 

Attacks in the United States. (Washington D.C.: U.S. Department of Education and U.S. Secret Service, 2004).
80

Threat Assessment Teams 

As described in the previous section, research shows that perpetrators of targeted acts of violence 

engage in both covert and overt behaviors preceding their attacks. They consider, plan, prepare, 

share, and, in some cases, move on to action.34 One of the most useful tools an IHE can develop 

to identify, evaluate, and address these troubling signs is a multidisciplinary IHE TAT. A TAT 

with diverse representation often will operate more efficiently and effectively. TAT members 

should include IHE administrators, counselors, current employees, medical and mental health 

professionals, and residential life, public safety, and law enforcement personnel. 

The TAT serves as a central convening body that ensures that warning signs observed by 

multiple people are not considered isolated incidents and do not slip through the cracks as they 

actually may represent escalating behavior that is a serious concern. IHEs should keep in mind, 

however, the importance of relying on factual information (including observed behavior) and 

avoid unfair labeling or stereotyping, to remain in compliance with civil rights and other 

applicable federal and state laws.

For the purposes of consistency and efficiency, a TAT should be developed and implemented in 

coordination with IHE policy and practice. In addition, staff already working to identify student 

and staff needs can be a critical source of information on troubling behavior for a TAT. 

The TAT reviews troubling or threatening behavior of current or former students, staff, and 

parents, or other persons brought to the attention of the TAT. The TAT contemplates a holistic 

assessment and management strategy that considers the many aspects of the potentially 

threatening person’s life—academic, residential, work, and social. More than focusing on 

warning signs or threats alone, the TAT assessment involves a unique overall analysis of 

changing and relevant behaviors. The TAT takes into consideration, as appropriate, information 

about behaviors, various kinds of communications, not-yet substantiated information, any threats 

made, security concerns, family issues, or relationship problems that might involve a troubled 

individual. The TAT may also identify any potential victims with whom the individual may 

interact. Once the TAT identifies an individual who may pose a threat, the team will identify a 

course of action for addressing the situation. The appropriate course of action— whether law 

enforcement intervention, counseling, or other actions—will depend on the specifics of the 

situation. 

The TAT may also identify any potential victims with whom the individual may interact. TATs 

are increasingly common in IHE settings, pushed to the forefront of concern following the 2007 

shooting at Virginia Polytechnic Institute and State University in Blacksburg, Va., where 32 

individuals were killed. In some cases, state funding mandates that IHEs create threat assessment 

teams.35

Law enforcement can help assess reported threats or troubling behavior and reach out to 

available federal resources as part of the TAT process or separately. The FBI’s behavioral 

 

34 See Threat Assessment Teams: Workplace and School Violence Prevention. http://www.fbi.gov/statsservices/publications/law-enforcement-bulletin/february-2010/threat-assessment-teams/. 

35 See Recommended Practices for Virginia Colleges Threat Assessments, available at

http://www.threatassessment.vt.edu/resources/tat_info/VArecommended_practices.pdf.
81

experts in its National Center for the Analysis of Violent Crimes at Quantico, Va., are available 

on a 24/7 basis to join in any threat assessment analysis and develop threat mitigation strategies 

for persons of concern. The law enforcement member of the IHE TAT should contact the local 

FBI office for this behavioral analysis assistance. 

Each FBI field office has a NCAVC representative available to work with IHE TATs and 

coordinate access to the FBI’s Behavioral Analysis Unit, home to the National Center for the 

Analysis of Violent Crimes. It focuses not on how to respond tactically to an active shooter 

situation but rather on how to prevent one. Early intervention can prevent a situation from 

escalating by identifying, assessing, and managing the threat. The TAT should consult with its

IHE administration and develop a process to seek these additional resources. 

Generally, active shooter situations are not motivated by other criminal-related concerns such as 

monetary gain or gang affiliation. Oftentimes situations may be prevented by identifying, 

assessing, and managing potential threats. Recognizing these pre-attack warning signs and 

indicators could help disrupt a potentially tragic event. 

Responding to an Active Shooter Situation

Higher ed EOPs should include courses of action that will describe how students and staff can 

most effectively respond to an active shooter situation to minimize the loss of life, and teach and 

train on these practices, as deemed appropriate by the IHE. 

Law enforcement officers may not be present when a shooting begins. Providing information on 

how staff and students can respond to the incident can help prevent and reduce the loss of life. 

No single response fits all active shooter situations; however, making sure each individual 

knows his or her options for response and can react decisively will save valuable time. Depicting 

scenarios and considering response options in advance will assist individuals and groups in 

quickly selecting their best course of action. 

Understandably, this is a sensitive topic. There is no single answer for what to do, but a survival 

mindset can increase the odds of surviving. As appropriate for your community, it may be 

valuable to schedule a time for an open conversation regarding this topic. Though some students, 

parents, or personnel may find the conversation uncomfortable, they may also find it reassuring 

to know that, as a whole, their IHE is thinking about how best to deal with this situation. 

During an active shooter situation, the natural human reaction, even if you are highly trained, is 

to be startled, feel fear and anxiety, and even experience initial disbelief and denial. You can 

expect to hear noise from alarms, gunfire, and explosions, and people shouting and screaming. 

Training provides the means to regain your composure, recall at least some of what you have 

learned and commit to action. There are three basic options: run, hide, or fight. You can run 
82

away from the shooter, seek a secure place where you can hide and/or deny the shooter access, or 

incapacitate the shooter in order to survive and protect others from harm.36

As the situation develops, it is possible that you will need to use more than one option. During an 

active shooter situation, individuals will rarely have all of the information they need to make a 

fully informed decision about which option is best. While they should follow the plan and any 

instructions given during an incident, they will often have to rely on their own judgment to 

decide which option will best protect lives. 

Respond Immediately 

It is not uncommon for people confronted with a threat to first deny the possible danger rather 

than respond. An investigation by the National Institute of Standards and Technology (2005) into 

the collapse of the World Trade Center towers on September 11, 2011, found that people close to 

the floors impacted waited longer to start evacuating than those on unaffected floors.37 Similarly, 

during the Virginia Tech shooting, individuals on campus responded to the shooting with varying 

degrees of urgency.38 These studies highlight this delayed response or denial. For example, some 

people report hearing firecrackers, when in fact they heard gunfire. 

Train staff and students to overcome denial and to respond immediately. For example, train 

students and staff to recognize the sounds of danger, act, and forcefully communicate the danger 

and necessary action (e.g., “Gun! Get out!”). In addition, those closest to the public-address or 

other communications system, or otherwise able to alert others, should communicate the danger 

and necessary action. Repetition in training and preparedness shortens the time it takes to orient, 

observe, and act. 

Upon recognizing the danger, as soon as it is safe to do so, staff or others must alert responders 

by contacting 911 with as clear and accurate information as possible. 

Run 

If it is safe to do so, the first course of action that should be taken is to run out of the building 

and move far away until you are in a safe location. 

 

36 As part of its preparedness mission, Ready Houston produces “Run, Hide, Fight” videos, handouts, and trainings 

to promote preparedness among residents of the Houston region. These materials may or may not be relevant to 

IHEs, as they are not for an IHE setting. These videos are not recommended for viewing by minors. All of these 

items are available free-of-charge and many are available at http://www.readyhoustontx.gov/videos.html. 

37 Occupants of both towers delayed initiating their evacuation after World Trade Center 1 was hit. In World Trade 

Center 1, the median time to initiate evacuation was 3 minutes for occupants from the ground floor to floor 76, and 5 

minutes for occupants near the impact region (floors 77 to 91). See National Institute of Standards and Technology,

Federal Building and Fire Safety Investigation of the World Trade Center Disaster Occupant Behavior, Egress, and 

Emergency Communications. Washington, DC: Author, 2005. Available at 

http://www.mingerfoundation.org/downloads/mobility/nist%20world%20trade%20center.pdf.

38 Report of the Virginia Tech Review Team, available at 

http://www.governor.virginia.gov/tempContent/techPanelReport-docs/FullReport.pdf and 

http://www.governor.virginia.gov/tempContent/techPanelReportdocs/12%20CHAPTER%20VIII%20MASS%20MURDER%20AT%20NORRIS%20HALL.pdf.
83

Students and staff should be trained to 













Leave personal belongings behind; 

Visualize possible escape routes, including physically accessible routes for students and 

staff with disabilities and others with access and functional needs; 

Avoid escalators and elevators; 

Take others with them but not to stay behind because others will not go; 

Call 911 when safe to do so; and 

Let a responsible adult know where they are. 

Hide 

If running is not a safe option, hide in as safe a place as possible. 

Students and staff should be trained to hide in a location where the walls might be thicker and 

have fewer windows. In addition 



















Lock the doors; 

Barricade the doors with heavy furniture; 

Close and lock windows, and close blinds or cover windows; 

Turn off lights; 

Silence all electronic devices; 

Remain silent; 

Use strategies to silently communicate with first responders if possible, (e.g., in rooms 

with exterior windows make signs to silently signal law enforcement and emergency 

responders to indicate the status of the room’s occupants);

Hide along the wall closest to the exit but out of the view from the hallway (allowing for 

an ambush of the shooter and for possible escape if the shooter enters the room); and 

Remain in place until given an all clear by identifiable law enforcement. 

Fight 

If neither running nor hiding is a safe option, as a last resort when confronted by the shooter, 

adults in immediate danger should consider trying to disrupt or incapacitate the shooter by using 

aggressive force and items in their environment, such as fire extinguishers, chairs, etc. In a study 

of 41 active shooter events that ended before law enforcement arrived, the potential victims 
84

stopped the attacker themselves in 16 instances. In 13 of those cases, they physically subdued the 

attacker.39

While talking to staff about confronting a shooter may be daunting and upsetting for some staff, 

they should know that they may be able to successfully take action to save lives. To be clear, 

confronting an active shooter should never be a requirement of any IHE employee’s job; how 

each individual chooses to respond if directly confronted by an active shooter is up to him or her. 

Further, the possibility of an active shooter situation is not justification for the presence of 

firearms on campus in the hands of any personnel other than law enforcement. 

Interacting with First Responders 

Staff should be trained to understand and expect that law enforcement’s first priority must be to 

locate and stop the person or persons believed to be the shooter(s); all other actions are 

secondary. One comprehensive study found that in more than half (57 percent) of active shooter

incidents where a solo officer arrived on the scene, shooting was still underway when the officer 

arrived. In 75 percent of those instances, that solo officer had to confront the perpetrator to end 

the threat. In those cases, the officer was shot one-third of the time.40

Students and staff should be trained to cooperate and not to interfere with first responders. When 

law enforcement arrives, students and staff must display empty hands with open palms. Law 

enforcement may instruct everyone to place their hands on their heads, or they may search 

individuals. 

After an Active Shooter Incident41 

Once the scene is secured, first responders will work with IHE officials and victims on a variety 

of matters. This will include transporting the injured, interviewing witnesses, and initiating the 

investigation. 

The higher ed EOP should identify trained personnel who will provide assistance to victims and 

their families. This should include establishing an incident response team (including first 

responders) that is trained to appropriately assess and triage an active shooter situation (as well 

as other emergencies), and provide emergency intervention services and victim assistance 

beginning immediately after the incident and throughout the recovery efforts. This team will 

integrate with state and federal resources when an emergency occurs. 

Within an on-going and/or evolving emergency, where the immediate reunification of loved 

ones is not possible, providing family members with timely, accurate and relevant information is 

paramount. Having family members wait for long periods of time for information about their 

loved ones not only adds to their stress and frustration, but can also escalate the emotions of the 

entire group. When families are reunited, it is critical that there are child release processes in 

 

39 J. Pete Blair with M. Hunter Martaindale, United States Active Shooter Events from 2000 to 2010: Training and 

Equipment Implications. San Marcos, TX: Texas State University, 2013. Available at 

http://alerrt.org/files/research/ActiveShooterEvents.pdf.

40 Ibid. 

41 Also see the section of the Guide on Considerations for the Recovery Annex.
85

place where minors might be involved (e.g., childcare) to assure that no child is released to an 

unauthorized person, even if that person well-meaning. 

Essential steps to help establish trust and provide family members with a sense of control can be 

accomplished by: 









Identifying a safe location separate from distractions and/or media and the general public, 

but close enough to allow family members to feel connected in proximity to their 

children/loved ones; 

Scheduling periodic updates even if no additional information is available; 

Being prepared to speak with family members about what to expect when reunified with 

their child/loved ones; and 

Ensuring effective communication with those that have language barriers or need other 

accommodations, such as sign language interpreters for deaf family members. 

When reunification is not possible because an individual is missing, injured or killed, how and 

when this information is provided to families is critical. Before an emergency, the planning team 

must determine how, when, and by whom loved ones will be informed if their loved one is 

missing or has been injured or killed. Law enforcement typically takes the lead on death 

notifications, but all parties must understand their roles and responsibilities. This will ensure that 

families and loved ones receive accurate and timely information in a compassionate way. 

While law enforcement and medical examiner procedures must be followed, families should 

receive accurate information as soon as possible. Having trained personnel to talk to loved ones 

about death and injury on-hand or immediately available can ensure the notification is provided 

to family members with clarity and compassion. Counselors should be on hand to immediately 

assist family members. 

The higher ed EOP should include pre-identified points of contact to work with and support 

family members (e.g., counselors, police officers). These points of contact should be connected 

to families as early in the process as possible, including while an individual is still missing but 

before any victims have been positively identified. After an incident, it is critical to confirm that 

each family is getting the support it needs, including over the long-term. 

The higher ed EOP should consider printed and age-appropriate resources to help families 

recognize and seek help in regard to a variety of reactions that they or their loved ones can 

experience during and after an emergency. For example, a family that has lost a child may have 

other family members in the area or at the IHE. It is critical that these families and loved ones are 

supported as they both grieve their loss and support their surviving family members. 

The higher ed EOP also should explicitly address how impacted families will be supported if 

they prefer not to engage with the media. This includes strategies for keeping the media separate 

from families and students while the emergency is ongoing and support for families that may 

experience unwanted media attention at their homes. 
86

6. Psychological First Aid (PFA) 

PFA is an evidence-informed modular approach used by mental health and disaster response 

workers to help individuals of all ages in the immediate aftermath of disaster and terrorism. PFA 

is designed to reduce the initial distress caused by traumatic events and to foster short- and longterm adaptive functioning and coping. 

PFA does not assume that all survivors will develop mental health problems or long-term 

difficulties in recovery. Instead, it is based on an understanding that disaster survivors and others 

affected by such events will experience a broad range of early reactions (e.g., physical, 

psychological, behavioral, spiritual). Some of these reactions will cause enough distress to 

interfere with adaptive coping and recovery may be helped by support from compassionate and 

caring disaster responders. 

PFA is designed for delivery by mental health and other disaster response workers who provide 

early assistance to affected children, families, and adults as part of an organized disaster response 

effort. These providers may be embedded in a variety of response units, including first responder 

teams, the ICS, primary and emergency health care, incident crisis response teams, faith-based 

organizations, Community Emergency Response Teams (CERT), Medical Reserve Corps, the 

Citizens Corps, and other disaster relief organizations. 

Basic objectives of PFA are: 

















Establish a human connection in a non-intrusive, compassionate manner. 

Enhance immediate and ongoing safety and provide physical and emotional comfort. 

Calm and orient emotionally overwhelmed or distraught survivors. 

Help survivors tell you specifically what their immediate needs and concerns are, and 

gather additional information as appropriate. Offer practical assistance and information to 

help survivors address their immediate needs and concerns. 

Connect survivors as soon as possible to social support networks, including family 

members, friends, and neighbors. 

Support adaptive coping, acknowledge coping efforts and strengths, and empower 

survivors; encourage adults, children, and families to take an active role in their recovery. 

Provide information that may help survivors cope effectively with the psychological 

impact of disasters. 

When appropriate, link the survivor to another member of a disaster response team or to 

local recovery systems, mental health services, public-sector services, and organizations. 

PFA is designed for delivery in diverse settings. Mental health and other disaster response 

workers may be called upon to provide PFA in: 
87



























General population shelters 

Special need shelters 

Field hospitals and medical triage areas 

Acute care facilities (e.g., emergency departments) 

Staging areas or respite centers for first responders or relief workers 

Emergency operations centers 

Crisis hotlines or phone banks 

Mobile dining facilities 

Disaster assistance service centers

Family reception and assistance centers 

Homes 

Businesses 

Other community settings 

Content taken from Psychological First Aid Field Operations Guide

http://www.nctsn.org/sites/default/files/pfa/english/1-psyfirstaid_final_complete_manual.pdf. 

Training on Psychological First Aid 

PFA Training can be provided face-to-face or online. The online version (http://learn.nctsn.org/) 

is vastly utilized and is a 6-hour interactive course that puts the participant in the role of a 

provider in a post-disaster scene. This professionally narrated course is for individuals new to 

disaster responses who want to learn the core goals of PFA, as well as for seasoned practitioners 

who want a review. It features innovative activities, video demonstrations, and mentor tips from 

the nation’s trauma experts and survivors. PFA online also offers a Learning Community where 

participants can share about experiences using PFA in the field, receive guidance during times of 

disaster, and obtain additional resources and training. 

The Psychological First Aid: Field Operations Guide provides information for adults, families, 

first responders, disaster relief workers, crisis counselors, and volunteers to help survivors 

immediately in the aftermath of a traumatic event. Available online at 

http://www.nctsn.org/content/psychological-first-aid, the guide describes key steps for providing 

PFA including how to approach someone in need, how to talk to them, how to help stabilize 

someone, and how to gather information. Appendices include resources about service delivery 

sites and settings, provider care, and worksheets and handouts. 

Following disasters or emergencies, the PFA Mobile app can assist responders who provide 

PFA) to adults, families, and children. Materials in PFA Mobile are adapted from the 
88

Psychological First Aid Field Operations Guide (2nd Edition). 

(http://www.nctsn.org/content/pfa.mobile) 

(http://www.ptsd.va.gov/professional/pages/pfa_mobile_app.asp) 

The app allows responders to: 











Read summaries of the 8 core PFA actions. 

Match PFA interventions to specific stress reactions of survivors. 

Get mentor tips for applying PFA in the field. 

Self-assess to determine their own readiness to conduct PFA. 

Assess and track survivors’ needs to simplify data collection and referrals. 

Psychological First Aid – Field Operations Guide 

http://www.nctsn.org/content/psychological-first-aid