LeRoy Rooker: What You Should Know About FERPA & COVID-19

FERPA and COVID-19: What You Should Know

AACRAO Senior Fellow LeRoy Rooker is the nation’s leading authority on FERPA (Family Educational Rights and Privacy Act). Recently, Parchment’s General Manager of Higher Education, Kevin Martin sat down with Rooker (over Zoom) to get his professional opinion about FERPA best practices in the COVID age.

Data Collection: What About Zoom Recordings?

Kevin Martin: There are different things that happen over time that necessitate the collection of new data and change the way that data is collected. In the context of COVID what new data is being collected around students?

LeRoy Rooker: Most of it is not anything new, but issues do come up around the use of student data in the Zoom era. A lot of what would have been in-person interactions are now happening over Zoom-like applications, and if the sessions are being recorded, you may well have an education record subject to FERPA. 

KM: What can you do or not do with those recordings and what makes them education records? 

LR: There are questions around class sessions and what the instructor is doing in the teaching of the course. By definition, education records are directly related to students with something about the record that can identify them, such as the student’s name, photo, Social Security number, and ID number.

The telling factor is whether the focus is on the instructor or the students. If the instructor is featured (without showing students), it wouldn’t be subject to FERPA. On the other hand, if it’s a class where the students are asking questions and commenting on camera, and you’re recording, it’s going to be an education record if it is maintained.

The second part of this is maintenance. Is the recording being maintained by the institution or a party acting for the institution? If so, and if, for example, the instructor posts the recording on the class course site, where only students in the class could access it, such sharing would be permitted under FERPA without the need for student consent. On the other hand, if it is disclosed to others outside the classroom and students are identifiable, it’s generally going to require the student’s consent or need to meet one of the FERPA exceptions to signed consent.

Checking Student Temperatures: Education Record or Not?

KM: What about temperature checks before students enter a classroom?

LR: There would not be a FERPA issue unless the temperatures are recorded and maintained. Also, it should be noted that, if you have a medical treatment provider from the institution’s clinic recording and maintaining the data, those would not be education records at a postsecondary institution so long as they are only shared with other medical providers. Rather, they meet the treatment records exception in FERPA. However, if medical records are shared with any non-treatment provider, including within the institution (for example its accommodations or risk assessment teams), that turns those treatment records into education records. (At the elementary and secondary level, they are education records regardless.)

Sharing a COVID Diagnosis: Yea or Nay?

KM: Tell me a little bit about if a student is found having a high temperature, whether or not he/she/they is diagnosed with COVID. This would lead to an absence from class (where attendance may be required for passing the course). What are the FERPA implications, and can that information be shared?

LR: If you are linking a temperature, absence, and/or diagnosis with a student, these are protected records under FERPA. There is, however, a health and safety emergency exception in FERPA. Under this exception, if an institution determines that a health or safety emergency (i.e., COVID-19) exists, disclosures could be made to appropriate parties for things like contact tracing. But FERPA requires that any disclosure made under this exception be recorded in the student’s record along with the personally identifiable information disclosed and the nature of the emergency.

In addition, it could, depending on the particular circumstances, be appropriate to disclose that a student in the class was diagnosed with COVID, sharing that information with the entire class and/or with specific students if they were in close contact with the infected student. Rule of thumb: It’s always good to start out with the least harmful level of information. 

Biggest Concern: How Do Vendors Handle Data?

KM: What’s your greatest concern around the practices and policies around student data as we enter into this?

LR: If I had to pick one, it would be the importance of ensuring that any contractual agreements in play are being reviewed from a FERPA standpoint. With any contractor, the institution needs to look at the practices of the vendor to ensure that those practices conform to the requirements of FERPA.

While we’ve had online courses for years, they were planned, rather than introduced in response to a pandemic. Today, institutions are trying to understand how they are going to operate if there are some, all, or no students on campus. Thus, there’s a big rush to engage different vendors who are offering services that seem to dovetail with what the institution is trying to accomplish.

It’s important to look at the terms of each contract. How does the vendor protect the institution? What happens with the records the vendor creates? Is it clear they belong to the institution, not the vendor? Is there a way to give the students any requested access through the vendor or institution? What happens to records when the contract ends?

KM: Given all of that, what advice do you have for institutions as they set policies around data collection and introduce new technologies?

LR: As you are setting up your policies going forward, the important thing is to remember to look at vendor contracting through the lens of FERPA. It would be easy for those who are not well versed in FERPA to miss the subtleties of the FERPA requirements and, as a result, enter into vendor contracts which could put the institution at risk of violating FERPA.

COVID and the Census: Too Much Information?

KM: Lack of planning and rush to contract can have consequences. Given that, it could create a situation where many institutions cause problems for themselves. Do you anticipate any federal changes around FERPA with what we’ve discussed, or other things related to the pandemic?

LR: I don’t. However, one thing that’s happened is that the pandemic has created a significant issue for the 2020 Census. Ordinarily, the Census would contact institutions to try and determine which students were attending and living on campus and count them. In all probability, there were no students on campus prior to the April 1 deadline, and the Census Bureau wants to make sure it doesn’t double count, with students being at home. Institutions can be in compliance with FERPA, however, and still assist with the Census by providing directory information.

If institutions have designated them as such, then name, address, and date of birth, can be disclosed in response to the request from the Census. However, the Census had also planned to also ask for student race, gender, and ethnicity information, which is not required, and which needs student consent in order to be disclosed. It is important for institutions to understand that even if asked for this non-directory information by a governmental agency, absent consent from the student, the institution should not provide it. AACRAO, however, worked with the Census Bureau to have the non-directory items deleted from the requested information.

It should be noted that there is language in the recently passed House version of the HEROES stimulus bill, which would permit postsecondary institutions to respond to any Census information requests, including non-directory items, without student consent. AACRAO is working with various other postsecondary associations to communicate to Congress that this would not only set a dangerous precedent, but it would also ask institutions to go against 40 years of consistent guidance from the Department of Education concerning directory information.

Wait There’s More!

Don’t miss our FERPA follow-up webinar. Join us Thursday, July 30th at 12:00 PM ET (9:00 AM PT) for our webinar FERPA in the Time of COVID-19 featuring AACRAO’s LeRoy Rooker as we discuss FERPA compliance in these unique times.

We’ll also be joined by Keri Disch, University Registrar at Washington University in St. Louis and Dr. Kristi Wold-McCormick, University Registrar at the University of Colorado, Boulder.

The panel will further explore how COVID-19 affects current FERPA guidelines, why bringing students back on campus may impact data classification, and how to maximize the security of student data while minimizing risk. Register now!

There’s always more to learn.