The Family Educational Rights and Privacy Act (FERPA) and other federal statutes have implications for information sharing in the emergency planning process. There are also more limited circumstances when the Health Insurance Portability and Accountability Act (HIPAA) may apply to impact information sharing in the IHE setting.
While it is critical that IHEs comply with these laws, there is often confusion about their applicability, which results in IHEs sharing less than allowed with law enforcement officers or the appropriate authorities, even when there is appropriate cause for sharing information. If IHEs understand when and how these laws apply, they can both ensure public safety and protect student privacy.
In addition to FERPA and HIPAA, there may be additional federal and state civil rights and other laws that place restrictions on when and with whom IHEs may share information. At the federal level, for instance, postsecondary institutions are subject to federal civil rights laws, including laws that prohibit discrimination based on disability (ADA and Section 504 of the Rehabilitation Act of 1973 ), race, color, and national origin (Titles IV5 and VI of the Civil Rights Act of 1964), sex (Title IX of the Education Amendments of 1972 and Title IV of the Civil Rights Act of 1964); and religion (Title IV of the Civil Rights Act of 1964). For example, Section 504 and Title II of the ADA6 prohibit discrimination on the basis of disability, and generally would prohibit unnecessary disclosures of disability status, or information related to that disability, to third parties.7 Disclosures may be necessary when the student presents a significant, articulable threat to others.8
Postsecondary institutions are strongly urged to take the time to review these laws, as well as others that apply in their jurisdictions, when working with their community partners (e.g., law enforcement agencies, fire departments, emergency management agencies, public and mental health agencies) to ensure that all parties have a strong understanding of applicable laws when deciding whether to disclose information from education records without consent. In particular, it is critical to train the institutions’ employees, including contractors, on applicable laws to ensure that institutions, IHE officials, or employees do not release information inappropriately or make decisions about students or release of records based upon myths, fears, or stereotypes related to race, color, national origin, sex, sexual orientation, gender identity, religion, or disability.9
5Title IV of the Civil Rights Act of 1964 applies to public postsecondary institutions.
6Title II of the ADA prohibits disability based discrimination by public entities, including public institutions of higher education.
7 See 34 CFR § 104.4 available at http://www.ecfr.gov/cgi-bin/retrieveECFR?gp=&SID=ae535d41f8bb03bedfef79634883360f&r=PART&n=34y18.104.22.168.3#34:22.214.171.124.126.96.36.199; 28 CFR § 35.130 available at at http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&SID=fed2599073ee2b61363d831ea8e2b5f1&rgn=div8&view=text&node=28:188.8.131.52.184.108.40.206&idno=28; and “Dear Colleague Letter and Frequently Asked Questions on Report Cards and Transcripts for Students with Disabilities Attending Public Elementary and Secondary Schools,” October 2008, available at http://www2.ed.gov/about/offices/list/ocr/letters/colleague-20081017.pdf.
8 See 28 CFR 35.139 available at http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&SID=263f01c0db63e7266a3711907eab6bd3&rgn=div8&view=text&node=28:220.127.116.11.18.104.22.168&idno=28 to 28 CFR 36.208 available at http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&SID=01903fc38a7bdb19c90e9c2e84fa788e&rgn=div8&view=text&node=28:22.214.171.124.126.96.36.199&idno=28/.
9For more information about applicable civil rights laws, please visit http://www.justice.gov/crt/, http://www.ed.gov/ocr, or http://www.ada.gov. Information about the appropriate training and management of campus public safety may be found at www.cops.usdoj.gov