הגנת פרטיות תלמידים במהלך נגיף הקורונה: הנחיות והמלצות להתנהלות של צוותי חינוך

כחלק מהניסיון למנוע ולצמצם המשך התפשטותו של נגיף הקורונה, צוותי חינוך בבתי ספרנו עומדים בפני מציאות חדשה ומורכבות. בין היתר, מציאות זו מציפה מגוון שאלות בעלות השלכות על פרטיותם של תלמידים, ובפרט: האם וכיצד נכון ליידע את הקהילה, לרבות הורים, רופאים, וגורמים נוספים על אירועי בריאות בקרב תלמידים וכיצד יש להגיב לאותם מקרים, תוך הגנה מירבית על פרטיות התלמידים.

סעיף 7 לחוק יסוד: כבוד האדם וחירותו (התשנ״ב - 1992) מורה שכל אדם זכאי לפרטיות וצנעת חייו. בפרט, כל תלמיד זכאי לכבוד ופרטיות, ובתי הספר נדרשים להגן על זכות זו בסביבת בית הספר ומחוצה לה, לרבות בסביבה הוירטואלית. חוק זכויות התלמיד מחיל על המוסד החינוכי חובת סודיות לגבי ענייניו ופרטיו האישיים של התלמיד. סעיף 14 לחוק זה אוסר על מי שהגיע אליו מידע על תלמיד עקב מילוי תפקיד שהוטל עליו לפי חוק זה, לחשוף מידע זה אלא אם כן הגילוי נחוץ לצורך מילוי תפקידו. 

חובות פרטיות אלה קיימות גם באינטרנט, והאחריות להתנהלות אתר האינטרנט מוטלת על מנהל המוסד. חובה לקבל את הסכמת התלמיד, הורה או אפוטרופוס כדי לפרסם סוגים שונים של מידע אישי של התלמיד באתר בית הספר, לדוגמה שמו או כתובת המייל (דוא"ל) של התלמיד. סוגים אחרים של מידע אישי רגיש אסורים לפרסום באופן גורף. הגנות נוספות הנוגעות לפרטיות באינטרנט ניתנות גם במסגרת חוק הגנת הפרטיות (התשמ"א -1981). 

בנוסף, על פי חוק זכויות החולה (התשנ״ו - 1996), חשיפת מידע בריאותי של תלמידים על ידי מטפל או מוסד רפואי, במסגרת משבר בריאות הציבור הנוכחי, תהיה מותרת רק אם: התלמיד (או הנציג המשפטי שלו) נתן הסכמה לחשיפה כזו; המטפל או המוסד הרפואי מחויבים לעשות כן מכוח החוק; או כאשר ועדת האתיקה, לאחר שהעניקה לתלמיד (או הנציג המשפטי שלו) את האפשרות להישמע, קבעה כי גילוי זה הוא חיוני לשמירה על בריאותם של אחרים או של הציבור, וכי הצורך בחשיפה עולה על האינטרסים של התלמיד. חשיפת המידע הבריאותי של התלמיד תיעשה רק במידה הנחוצה לצורך שמירה על בריאות הציבור, ובהימנעות מירבית מחשיפת זהותו של התלמידו.

עם זאת, הזכות החוקתית לפרטיות וההגנות הספציפיות הנוספות הניתנות במסגרת חוקים אלה, אינה מוחלטת. יש לבחון פגיעה בפרטיות, כמו פגיעה בזכויות האחרות הקבועות בחוק היסוד, על פי הוראות פסקת ההגבלה (סעיף 8 לחוק), שבוחנת האם הפגיעה היא לפי חוק, ההולם את ערכיה של מדינת ישראל, שנועד לתכלית ראויה ובמידה שאינה עולה על הנדרש. חשיפה של מידע אישי של תלמיד עשויה להתקיים בהוראת בית משפט, למשל כאשר גילוי כזה נדרש כדי להגן על חייהם.

The Underlying Framework

לנוכח מגיפת הקורונה ומשבר בריאות הציבור הנוכחי, בתי ספר מתמודדים עם אתגרים ייחודיים ונדרשים לאזן את זכותם של תלמידיהם לפרטיות אל מול אינטרס בריאות הציבור. לפיכך, מטרת המסמך להציע עקרונות מנחים והמלצות להתנהלות נכונה של צוותי חינוך כדי לסייע להם להגן על הפרטיות והמידע האישי של תלמידים.

עקרונות מנחים והמלצות להתנהלות נכונה בהקשר חשיפת מידע אישי ו/או פרטים מזהים של תלמיד: 

1. Significant and articulable threat: Is there an articulable and significant threat related to a student or other student’s health or safety?

2. Necessity: Is the disclosure of student PII needed to protect against such health or safety threat?

3. Data Minimization: What is the minimum amount of student information needed to address the issue at hand? Who are the relevant parties who need to receive this information?

4. Document Disclosures: In the event such a disclosure was made, the school should record the specifics, including the significant and articulable threat, the information disclosed, and the parties who received the information.

As well, schools should consider the below best practices surrounding such communications if they choose to share student information:

1. Provide useful facts not rumours: Schools should be mindful to consider information that they share to be tailored towards effective threat prevention rather than simply spreading rumours. For example, if a school learns indirectly that a student may be infected, they should verify this information before deciding if and what should be shared with the community or with health-care professionals.

2, Weigh potential harms against intended benefits: School administrators and educators should consider potential harms that could occur if they identify a student, and should use alternative approaches to effectively advocate precautionary measures. Sharing information that a particular student may be infected could cause harm to the student, including bullying and/or shaming them. As well, sharing that a student has symptoms before they have been tested or ruled out other possible conditions like the flu may simply cause fear. Instead perhaps just continue to encourage social distancing.

3. Consider additional school policies that may apply: Schools may be subject to additional policies, covering social media or other forms of communication or interaction. School staff should be cognizant of any such applicable policies, which may impose disciplinary action for posting or sharing this type of information.

4. Consider alternatives to personally identifiable information: If and when possible, schools should opt to provide non-identifiable information in lieu of personally identifying information. This may mean providing generalized information that does not directly or indirectly identify an individual student. It could also mean providing aggregated or de-identified information to various agencies to assist in their response to the pandemic.

The following are a number of concrete examples to illustrate how schools can share information about students while protecting their privacy during a public health emergency:

Can a school share with the community if they know or suspect a student has COVID-19?

To start, it is worth emphasizing that in many situations, in order to receive sufficient notification of risks to their children, parents do not need to know which student specifically was or may be infected (even if they would like to know). Therefore, schools should determine whether they can disclose that a student may have COVID-19 without directly or indirectly identifying the particular student. 

For example, let’s say that Eli on the school soccer team has tested positive for COVID-19, or the school suspects he has been infected. Eli is the only boy on the soccer team. Administrators will want to proactively notify the relevant community including the parents of other students on the team, that COVID-19 may be in the school community to facilitate prevention efforts and ensure that people have the information necessary to address a potential outbreak. Given COVID-19’s high degree of infectiousness, it may be wise for schools to err on the side of caution and notify the entire school when suspected but unconfirmed cases exist. 

Whether or not a school knows or merely suspects infection, it may not be necessary to identify Eli as the symptomatic individual. Schools should avoid identifying Eli either directly or indirectly. Therefore, because it is widely known that Eli is the only boy on the team, schools should not share that a boy on the soccer team has, or may have, COVID-19. Rather, they should generalize this announcement sharing only that a student on the team who attended the most recent soccer match is, or may be, infected.

Of course, the school may want to specifically notify parents of other students who had close contact with Eli when he was potentially contagious so that they can take measures to self-quarantine. In this case, the school should contact Eli’s parents and obtain consent to release this information. However, if they determine that an exception to obtaining this consent is required, they should consider the aforementioned criteria in determining whether to disclose, and if so, what information specifically may be shared and with whom.

Articulable and significant threat of a health or safety emergency:

Is the school able to explain, based on all the information available at the time, what the threat is and why it is significant? If a local public health authorities determine that a public health emergency, such as COVID-19, is a significant threat to students or other individuals in the community, it is reasonable that an educational agency or institution in that community will likewise determine that an emergency exists. Sharing this information may be particularly necessary in the early stages of a pandemic to facilitate prevention efforts and ensure that people have the information necessary to address a potential outbreak.

The disclosure is necessary to protect the health or safety of the student or other individuals:

Schools should decide whether Eli’s teacher, classmates and their parents, or students with whom Eli spent significant time need to know that Eli has COVID-19 in order to protect their health. 

Only disclose the minimum amount of information required to address the issue at hand to the relevant parties:

Disclosures do not have to be “all or nothing”. Rather, the school should consider carefully how much information is actually necessary in order to address the issue at hand given the particular circumstances. Would it be sufficient, for example, to just say that “someone on the soccer team” has COVID-19, without identifying Eli as the infected student to his classmates? If the school does believe they need to identify Eli, they should make sure they provide the minimum information needed—that he has COVID-19 and perhaps a window of time when he may have been infectious, if known—and not additional information such as any other specifics regarding his health history. Likewise, disclosures should be limited to the parties to whom this information is pertinent.  For example, if administrators know that Eli is exhibiting symptoms of COVID-19 but hasn’t yet been diagnosed, they could choose to tell only immunocompromised or at-risk students and faculty that a student may have the virus, before communicating with the larger school community.  Schools can also combine communication approaches, for example by identifying Eli as necessary to classmates and their parents but sharing only de-identified information, such as “a sixth-grade student likely has contracted COVID-19,” with the broader school community.

Can a school share with health officials, for example a student’s primary care physician, if they suspect a student may have COVID-19?

If a school cannot reach a student or their parents, and suspects that student might have COVID-19, they may want to reach out to the student’s primary care physician to ask if the physician can confirm that the student has COVID-19 so the school can notify the community. If so, they should follow the above framework and best practices to determine the best course of action. Specifically, they should be aware that the physician may not be able to disclose health information back to the school due to medical confidentiality protected under the Patient Rights Act of 1996 (Sec. 10a), according to which a physician is obligated to maintain the dignity and privacy of her patient, as well as due to physicians’ ethical fiduciary duty towards their patients. However, if a school suspects a positive case, administrators could recommend that other parents take their children to get tested.

Can a school share student information in response to a voluntary request from a researcher, newspaper, or government agency in order to assist in responding to the COVID-19 outbreak?

As noted above, schools should feel free to share de-identified or aggregated information to help in the public response to the COVID-19 pandemic. However, if and when doing so, schools should keep in mind the widely accepted standard for properly de-identified information: whether a reasonable person who does not have personal knowledge of the relevant circumstances, could identify the student with reasonable certainty based on both the information the school discloses at that time and other information in the recipient’s possession that could be combined with the information disclosed. 

For example, let’s say an agency wants to learn about visits to the school nurse in late February involving typical COVID-19 symptoms. Utilizing the above framework and best practices, schools could provide an aggregated percentage of student visits. This should be provided rather than for example, other information that is more than the minimum required to address the issue at hand, for example  i. more granular data that breaks down visits by class-year, gender and ethnicity, that could allow  individual students to be identified; ii. Specific health records of individual students.

In Conclusion

The COVID-19 pandemic represents a public health crisis and there may be significant public interest in sharing student data due to the circumstances. Nevertheless, it remains vital that decisions to share such information could have a significant impact on student privacy and as outlined above there may be effective alternatives that do minimize the potential harms while still addressing the serious health risks at hand. Schools should keep these principles and guidelines in mind as they navigate the myriad situations they may be facing in order to best safeguard their students and student privacy.

This resource is intended for informational purposes only and should not be considered as legal advice. You should contact your attorney to obtain advice with respect to any particular issue or problem.