Guidance to help K-12 School Administrators and Educators Protect Student Privacy during the COVID-19 Pandemic

Schools, including both educators and administrators, are facing tough privacy questions as COVID-19 continues to spread across the world. In particular, schools are grappling with how to inform communities and public health officials of health incidents among students and how to respond to those cases, while still respecting students’ privacy.

Israel’s Basic Law: Human Dignity and Liberty (5752 – 1992) provides constitutional protection to all persons, including students, from any arbitrary or Illegal injury to the privacy of their self,  family or home. Under this law, schools are required to uphold and protect each individual student’s right to privacy in the physical school environment as well as outside it. Specifically, the Pupils Rights Law defines all student information received or accessible to persons associated with the education system as confidential. Specifically, section 14 of this law prohibits the disclosure of such student information, unless such disclosure is necessary to fulfill one’s job or duty. 

These student privacy protections extend online as well. Relevant obligations and responsibilities are placed on schools to protect their students’ private information in the context of any school-operated website. Consent from a student and their parent or legal guardian is required for the disclosure of certain types of personal information, such as a student’s name or email, while other types of personal student information are explicitly prohibited from being posted on a school’s website whatsoever. Additional online privacy protections are also afforded under Israel’s broad Privacy Protection Law, 5741-1981. 

Finally, according to the Patient Rights Act of 1996 (Sec. 20), the disclosure of students’ health information (by either caregiver or medical institution), in the context of the present public health crisis, would be permitted only if: the student (or her legal representative) has provided consent to such disclosure; the caregiver or medical institution are obligated to do so by force of law; or where the Ethics Committee, after giving the student (or her legal representative) the opportunity to be heard, determined that such disclosure is essential for the protection of the health of others or the public and that the need for disclosure outweighs the student’s privacy interests. The disclosure of the student’s health information shall be done only to the extent necessary for the purpose of maintaining public health, and with the utmost avoidance of disclosing her identity.

However, the constitutional right to privacy and the additional specific protections afforded under these laws are not absolute. The right to privacy in Israel should not be applied to an extent greater than required. As well, disclosures of personal information may be ordered by a court, for example, when such disclosure is required to protect lives. In the face of the current public health emergency presented by COVID-19, schools face unique challenges when deciding how to best protect students’ privacy in a balanced way. Therefore, the following offers a framework of guiding principles and best practices to help schools navigate questions and dilemmas which may arise regarding the adequate protection of students’ private information.

The Underlying Framework

Consent has always been, and should remain, the core requirement for any disclosure of student information from school records. However, exceptions may be made to this basic rule if disclosures are needed to protect the health or safety of others in an emergency. Therefore, if a school determines they must disclose a student’s personal information without receiving their consent due to such a threat, they should perform a case by case analysis considering all of the circumstances related to the threat.

In doing so, they should determine whether the following criteria are met: 

1. Significant and articulable threat: Is there an articulable and significant threat related to a student or other student’s health or safety?

2. Necessity: Is the disclosure of student PII needed to protect against such health or safety threat?

3. Data Minimization: What is the minimum amount of student information needed to address the issue at hand? Who are the relevant parties who need to receive this information?

4. Document Disclosures: In the event such a disclosure was made, the school should record the specifics, including the significant and articulable threat, the information disclosed, and the parties who received the information.

As well, schools should consider the below best practices surrounding such communications if they choose to share student information:

1. Provide useful facts not rumours: Schools should be mindful to consider information that they share to be tailored towards effective threat prevention rather than simply spreading rumours. For example, if a school learns indirectly that a student may be infected, they should verify this information before deciding if and what should be shared with the community or with health-care professionals.

2, Weigh potential harms against intended benefits: School administrators and educators should consider potential harms that could occur if they identify a student, and should use alternative approaches to effectively advocate precautionary measures. Sharing information that a particular student may be infected could cause harm to the student, including bullying and/or shaming them. As well, sharing that a student has symptoms before they have been tested or ruled out other possible conditions like the flu may simply cause fear. Instead perhaps just continue to encourage social distancing.

3. Consider additional school policies that may apply: Schools may be subject to additional policies, covering social media or other forms of communication or interaction. School staff should be cognizant of any such applicable policies, which may impose disciplinary action for posting or sharing this type of information.

4. Consider alternatives to personally identifiable information: If and when possible, schools should opt to provide non-identifiable information in lieu of personally identifying information. This may mean providing generalized information that does not directly or indirectly identify an individual student. It could also mean providing aggregated or de-identified information to various agencies to assist in their response to the pandemic.

The following are a number of concrete examples to illustrate how schools can share information about students while protecting their privacy during a public health emergency:

Can a school share with the community if they know or suspect a student has COVID-19?

To start, it is worth emphasizing that in many situations, in order to receive sufficient notification of risks to their children, parents do not need to know which student specifically was or may be infected (even if they would like to know). Therefore, schools should determine whether they can disclose that a student may have COVID-19 without directly or indirectly identifying the particular student. 

For example, let’s say that Eli on the school soccer team has tested positive for COVID-19, or the school suspects he has been infected. Eli is the only boy on the soccer team. Administrators will want to proactively notify the relevant community including the parents of other students on the team, that COVID-19 may be in the school community to facilitate prevention efforts and ensure that people have the information necessary to address a potential outbreak. Given COVID-19’s high degree of infectiousness, it may be wise for schools to err on the side of caution and notify the entire school when suspected but unconfirmed cases exist. 

Whether or not a school knows or merely suspects infection, it may not be necessary to identify Eli as the symptomatic individual. Schools should avoid identifying Eli either directly or indirectly. Therefore, because it is widely known that Eli is the only boy on the team, schools should not share that a boy on the soccer team has, or may have, COVID-19. Rather, they should generalize this announcement sharing only that a student on the team who attended the most recent soccer match is, or may be, infected.

Of course, the school may want to specifically notify parents of other students who had close contact with Eli when he was potentially contagious so that they can take measures to self-quarantine. In this case, the school should contact Eli’s parents and obtain consent to release this information. However, if they determine that an exception to obtaining this consent is required, they should consider the aforementioned criteria in determining whether to disclose, and if so, what information specifically may be shared and with whom.

Articulable and significant threat of a health or safety emergency:

Is the school able to explain, based on all the information available at the time, what the threat is and why it is significant? If a local public health authorities determine that a public health emergency, such as COVID-19, is a significant threat to students or other individuals in the community, it is reasonable that an educational agency or institution in that community will likewise determine that an emergency exists. Sharing this information may be particularly necessary in the early stages of a pandemic to facilitate prevention efforts and ensure that people have the information necessary to address a potential outbreak.

The disclosure is necessary to protect the health or safety of the student or other individuals:

Schools should decide whether Eli’s teacher, classmates and their parents, or students with whom Eli spent significant time need to know that Eli has COVID-19 in order to protect their health. 

Only disclose the minimum amount of information required to address the issue at hand to the relevant parties:

Disclosures do not have to be “all or nothing”. Rather, the school should consider carefully how much information is actually necessary in order to address the issue at hand given the particular circumstances. Would it be sufficient, for example, to just say that “someone on the soccer team” has COVID-19, without identifying Eli as the infected student to his classmates? If the school does believe they need to identify Eli, they should make sure they provide the minimum information needed—that he has COVID-19 and perhaps a window of time when he may have been infectious, if known—and not additional information such as any other specifics regarding his health history. Likewise, disclosures should be limited to the parties to whom this information is pertinent.  For example, if administrators know that Eli is exhibiting symptoms of COVID-19 but hasn’t yet been diagnosed, they could choose to tell only immunocompromised or at-risk students and faculty that a student may have the virus, before communicating with the larger school community.  Schools can also combine communication approaches, for example by identifying Eli as necessary to classmates and their parents but sharing only de-identified information, such as “a sixth-grade student likely has contracted COVID-19,” with the broader school community.

Can a school share with health officials, for example a student’s primary care physician, if they suspect a student may have COVID-19?

If a school cannot reach a student or their parents, and suspects that student might have COVID-19, they may want to reach out to the student’s primary care physician to ask if the physician can confirm that the student has COVID-19 so the school can notify the community. If so, they should follow the above framework and best practices to determine the best course of action. Specifically, they should be aware that the physician may not be able to disclose health information back to the school due to medical confidentiality protected under the Patient Rights Act of 1996 (Sec. 10a), according to which a physician is obligated to maintain the dignity and privacy of her patient, as well as due to physicians’ ethical fiduciary duty towards their patients. However, if a school suspects a positive case, administrators could recommend that other parents take their children to get tested.

Can a school share student information in response to a voluntary request from a researcher, newspaper, or government agency in order to assist in responding to the COVID-19 outbreak?

As noted above, schools should feel free to share de-identified or aggregated information to help in the public response to the COVID-19 pandemic. However, if and when doing so, schools should keep in mind the widely accepted standard for properly de-identified information: whether a reasonable person who does not have personal knowledge of the relevant circumstances, could identify the student with reasonable certainty based on both the information the school discloses at that time and other information in the recipient’s possession that could be combined with the information disclosed. 

For example, let’s say an agency wants to learn about visits to the school nurse in late February involving typical COVID-19 symptoms. Utilizing the above framework and best practices, schools could provide an aggregated percentage of student visits. This should be provided rather than for example, other information that is more than the minimum required to address the issue at hand, for example  i. more granular data that breaks down visits by class-year, gender and ethnicity, that could allow  individual students to be identified; ii. Specific health records of individual students.

In Conclusion

The COVID-19 pandemic represents a public health crisis and there may be significant public interest in sharing student data due to the circumstances. Nevertheless, it remains vital that decisions to share such information could have a significant impact on student privacy and as outlined above there may be effective alternatives that do minimize the potential harms while still addressing the serious health risks at hand. Schools should keep these principles and guidelines in mind as they navigate the myriad situations they may be facing in order to best safeguard their students and student privacy.

This resource is intended for informational purposes only and should not be considered as legal advice. You should contact your attorney to obtain advice with respect to any particular issue or problem.