On 2 January 2019, the Marjory Stoneman Douglas High School Public Safety Commission (MSDHSPSC) released its initial report. The commission report addressed many critical issues and lesson learned within its 15 chapters. The chapter on information sharing discussed the actual or perceived restrictions from privacy laws such as the Family Educational Rights and Privacy Act (FERPA). The discussion addressed several areas where there is significant confusion and dispute that continues until today, and directly impacts safety and security planning, preparedness, and collaboration.
FERPA, codified under 20 USC 1232g and 34 CFR 99, is a federal law that addresses the privacy of student education records for any school that receives federal funds from an applicable U.S. Department of Education (US DOE) program. The implementation of FERPA can vary from organization to organization, especially with critical subjects such as school resource officers and law enforcement agencies accessing campus security video surveillance systems during daily operations and emergencies.
Without clear definitions and common guidance regarding information sharing, there shall continue to be confusion and conflict that will only hinder coordination, cooperation, and collaboration with all interested parties involved in safety and security in the educational environment.
FERPA is the privacy law most referenced by school districts for the retention and release of education records. FERPA often influences the development and implementation of state and local laws, rules, and regulations for the retention and sharing of information. FERPA provides certain rights to parents and students to include the right to inspect and review education records the school district maintains and correct any misleading or inaccurate information.
According to FERPA, school districts must have written permission from the parent or eligible student to release information from an education record without consent unless it meets one of the following conditions:
- School officials with legitimate educational interest;
- Other schools to which a student is transferring;
- Specified officials for audit or evaluation purposes;
- Appropriate parties in connection with financial aid to a student;
- Organizations conducting certain studies for or on behalf of the school;
- Accrediting organizations;
- To comply with a judicial order or lawfully issued subpoena;
- Appropriate officials in cases of health and safety emergencies; and
- State and local authorities, within a juvenile justice system, pursuant to specific State law.
However, there is a necessity to share information with law enforcement as well as medical and mental health partners within and beyond the FERPA limitations. In a world of fast-evolving critical incidents and threats of violence, there is an immediate need for emergency information sharing for health and safety issues that FERPA may not clearly define or address.
Health, Safety & Law Enforcement
According to 20 USC 1232g, the term education record does not include “records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement.” Since many schools districts may not have internal law enforcement units, this exemption may not be relevant or very beneficial for information sharing. However, FERPA does address a release of education records for an emergency health or safety exception through “subject to regulations of the Secretary, in connection with an emergency, appropriate persons if the knowledge of such information is necessary to protect the health or safety of the student or other persons.”
According to the US DOE, it is permissible to utilize FERPA’s health and safety emergency exception when:
In some situations, school administrators may determine that it is necessary to disclose personally identifiable information (PII) from a student’s education records to appropriate parties in order to address a health or safety emergency. FERPA’s health or safety emergency provision permits such disclosures when the disclosure is necessary to protect the health or safety of the student or other individuals. See 34 CFR §§ 99.31(a) (10) and 99.36. This exception to FERPA’s general consent requirement is limited to the period of the emergency and generally does not allow for a blanket release of PII from a student’s education records. Rather, these disclosures must be related to an actual, impending, or imminent emergency, such as a natural disaster, a terrorist attack, a campus shooting, or the outbreak of an epidemic disease.
The challenge remains with the interpretation of FERPA for an emergency to protect health and safety. The perspective of the educational community can be vastly different than the law enforcement community and general public.
Federal Commission on School Safety
On 18 December 2018, the Federal Commission of School Safety released the Final Report of the Federal Commission on School Safety. The federal commission discussed FERPA and other regulatory privacy protections in Chapter 17 of the report, identifying that “a delicate balance exists between privacy and security in schools.”
The federal report indicates that schools have flexibility to disclose information under FERPA in the context of school safety. According to the federal report:
Especially relevant to potential violence at school is FERPA’s health or safety emergency exception which permits the disclosure of students’ education records, or the PII [personally identifiable information] contained therein, to appropriate parties if knowledge of such information is necessary to protect the health or safety of students or other persons in connection with an emergency.
FERPA’s health or safety emergency exception specifically permits schools or districts themselves to disclose PII [personally identifiable information] from students’ education records in the context of emergencies. However, there are certain circumstances when it may not be practical or expedient for schools or districts themselves to make the determinations and disclosures necessary to address the emergency. These situations might include natural disasters that impact multiple districts across the state, emergencies that disrupt a district’s data systems, or emergencies that occur when district personnel are not available. In these limited situations, it is often advantageous for the state education agency to make the disclosure directly, on the school’s or district’s behalf.
The challenge may be the definition and perception of an emergency impacting a school district as compared to an evolving threat or public safety concern. A student making verbal or social media threats may not be perceived an as emergency under FERPA, but rather as an investigative matter until it escalates to a higher level. However, it is critical to obtain the necessary information immediately prior to the escalation of the threat or concern. The delay in information sharing could result in the loss of an opportunity to mitigate or interdict an act of violence.
MSDHSPSC Initial Report
According to the MSDHSPSC initial report, the determination if a record or document is an education record under FERPA depends on how and for what purpose the school district creates and maintains the record or document. The school district may create policies and procedures to define an education record for its purposes.
A school district may err on the side of over-restricting the sharing of education records to adhere to its interpretation of FERPA to evade possible financial penalties. The loss of access to federal funding is a significant concern for the violation of FERPA, but as the commission found:
FERPA does not create a private right of action to compel compliance by educational institutions. Instead, FERPA ties institutional compliance to its privacy requirements through federal funding. The ultimate threat for non-compliance by educational institutions is that the U.S. Department of Education may respond by withholding federal funding. To date, the Department of Education has never withheld funding for FERPA violations.
The commission also addressed the restrictions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and State of Florida privacy laws. The initial report indicated that it was unlikely that a school district that provided protected health information to a law enforcement agency would be affected by HIPAA requirements, especially if acting in good faith. Florida state law provides additional capabilities and guidance for the sharing of educational information.
In Florida, FERPA has been codified into state law in Florida Statute Chapter 1002. Sections 1002.22(2) and 1002.221 restrict the release of education records according to FERPA and Florida law. To adhere to state and federal laws, school districts can develop interagency agreements with various partners to share information for the purpose of identifying and delivering services to a juvenile (student).
Unfortunately, there can be great confusion regarding the information that school districts will release through these interagency agreements. Law enforcement often anticipates information sharing for a broad array of threats and public safety concerns regarding the security of all students and staff. Law enforcement requires immediate, but limited, information around the clock to identify and assess threats and suspects to mitigate possible concerns. This is especially true with social media threats and postings since the majority seem to occur at night and on weekends when students have expanded access to their technology.
School districts often interpret information sharing between the school district and criminal justice system to only provide services for the student post-arrest and pre-adjudication as identified in the interagency agreements. However, this defined period and limited information sharing does not support the critical period before the violence or arrest – the opportunity to mitigate the threat and possibly the arrest.
The interagency agreements do not necessary address other critical information that requires immediate sharing or access to include video surveillance systems on school campuses. Video surveillance may not be relevant for pre-adjudication services, but is critical for safety, security, and responses to interdict a threat.
Access to Video Surveillance
Regrettably, there can be continued disagreement between school districts and law enforcement agencies if video surveillance systems are classified as education records under FERPA or safety and security resources. One perspective is that video surveillance systems are site safety or security systems that enhance the ability to observe and protect students and staff by expanding observation capabilities. Another perspective is that video surveillance systems are education records that may not be openly shared with law enforcement for it could be used in the possible profiling of students to document alleged criminal activity. In addition, there is disagreement if a distinction exists between accessing and viewing live video as compared to recorded video.
According to the federal report:
Police departments often seek access to school surveillance footage to help ensure school safety – only to have schools claim it is an education record protected by FERPA and therefore deny the request. However, FERPA’s definition of “education records” excludes those created and maintained by a school’s law enforcement unit for a law enforcement purpose. If a school’s security department or campus police maintains the school’s surveillance video system and, as a result, creates surveillance footage for a law enforcement purpose, FERPA would not prevent sharing the surveillance footage with local law enforcement. Smaller schools without an existing law enforcement unit or security department can still utilize this exclusion by designating a school official, such as the vice-principal, as the school’s law enforcement unit for this purpose.
These divergent perspectives have resulted in delays for outside law enforcement agencies gaining daily and emergency access to video surveillance systems. If video surveillance systems were identified as law enforcement records or another classification as a policy decision, they would be exempt from FERPA restrictions.
Beyond Video Surveillance
Other issues beyond access to video surveillance for consideration include confirmation that a student is on a school campus for law enforcement purposes. There appears to be disagreement, at times, if the mere presence of a student on campus is an education record and cannot be shared with law enforcement for the location and arrest of the student:
- Does it matter if the law enforcement agency has an arrest warrant or probable cause for the arrest?
- Does it matter if it is a felony or misdemeanor violation?
- Should access be provided to the student for simply questioning regarding a serious felony investigation during school hours not involving child abuse with the student as a victim or witness?
Perspectives also disagree if these are actually FERPA or privacy issues that legally restrict school districts from sharing this information with law enforcement or it is an intentional method of hindering law enforcement from executing a lawful arrest or action at the school.
A US DOE opinion through a letter to a community college in Alabama in or about 1997 examined FERPA and subpoena service. The rather dated opinion focused on the nondisclosure of information from education records and guidance relating to subpoena or court order service. During the interpretation, US DOE provided guidance to include the following information:
FERPA does not prohibit the institution from locating a student for a law enforcement officer or anyone else if a staff member happens to know where the student is and, therefore, does not have to release or retrieve the information from an education record, such as the student's recorded class schedule, in order to do so. Otherwise, there is nothing in FERPA that would prevent law enforcement officials or other persons from serving subpoenas on students at school.
This guidance addresses class schedules as education records and does not directly speak to arrest warrants and probable cause for arrests. However, it does provide valuable information in a nebulous area. The complexity of the issue would benefit from additional research and consideration along with uniform guidance on a state and national level.
The federal report identified the three following privacy and information sharing recommendations for the federal government:
- The U.S. Department of Education (ED), should provide technical assistance to clarify that FERPA’s “school official” exception may permit disclosures of disciplinary information about students to the appropriate teachers and staff within the school.
- ED should work with Congress to modernize FERPA to account for changes in technology since its enactment.
- ED should clarify that limited disclosures of PII [personally identifiable information] from students’ education records by state education agencies (SEA) under the health or safety emergency exception are permitted, when done on behalf of the school(s) or district(s), and in compliance with other FERPA requirements when the SEA is best positioned to respond to the emergency.
The federal report also identified two recommendations for state and local communities to include reviewing their state privacy laws regarding information sharing in the context of emergency situations to promote school safety.
The initial report identified three significant findings regarding privacy laws affecting information sharing:
- Based on the testimony before the Commission and discussion among Commission members, it is evident that there is significant misunderstanding and overapplication of several privacy laws, including FERPA and HIPAA. The misunderstanding and overapplication of privacy laws is a barrier to necessary and successful information sharing.
- Many aspects of educational privacy laws fail to consider appropriate exceptions for an incident such as where full public disclosure of prior conduct, especially misconduct, is beneficial and necessary. The inability for public disclosure of probative information and the attendant information void leads to misinformation and distrust that erodes public confidence in the system and it officials. If there is to be an erosion of public trust, it must be based on fact and not speculation because information is hidden from the public eye.
- It is unclear what actually constitutes an educational record under FERPA, including whether recorded video surveillance is an educational record.
Lessons Learned (or Not)
It now remains to be seen how the governor and legislature in Florida will respond to the findings from the MSDHSPSC initial report, especially the three findings above regarding information sharing. It also remains to be seen how Congress and the nation will respond to the federal report. There are lessons to be learned and questions to be answered for a common operating picture and proper coordination.
In the meantime, official guidance and assistance from US DOE would provide much needed clarity regarding FERPA pending any future case law or statute modifications on state and federal levels. The current stalemate in the interpretation and application of FERPA is having negative consequences for all involved parties and not enhancing safety and security in certain preventative areas.