Back to Resources

Health Data Privacy in a School Setting

posted on Wed, Apr 26 2017 10:21 am by The Network for Public Health Law

A physician who participates on an asthma workgroup recently contacted the Network about potential legal issues related to keeping and distributing lists of students with health concerns in a school setting. Specifically, the requestor wanted to know the considerations involved in having schools create lists of students who suffer from asthma to distribute to teachers, coaches, bus drivers and other staff. This list would help staff be prepared to respond in case of an asthma attack.

The potential list the requestor described would be governed by the Family Educational Rights and Privacy Act (FERPA), 20 U.S. Code § 1232g, and implementing regulations 39 CFR Part 199. This federal law protects the privacy of students' education records and gives parents certain rights with regard to these records. The term “education records” is broadly defined to mean those records that are: (1) directly related to a student, and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. Notes made by staff about students with asthma are considered personal “notes” and not “educational records,” and therefore not covered by FERPA. Personal “notes” are records kept in the maker’s possession, used only as a personal memory aid, and not accessible to or shared with anyone except a temporary substitute (34 C.F.R. § 99.3). However, a list of students with asthma that would be shared with various school personnel is subject to other FERPA concerns.

FERPA speaks to a school's responsibilities to safeguard education records and only allows disclosure of:


  • Non-personally identifiable information
  • Personally-identifiable information with a parent’s consent
  • Personally-identifiable information without a parent’s consent when allowed by an exception


Disclosure” means to permit access to or the release, transfer, or other communication of personally identifiable information contained in education records by any means, including oral, written, or electronic means, to any party except the party identified as the party that provided or created the record (34 C.F.R. § 99.3).

To include a child a on a list of students with asthma, the school could obtain permission from the parent. This requires a signed and dated written consent that specifies the information to be disclosed, the purpose of the disclosure, and the party or class of parties to whom the disclosure may be made. The signed and dated written consent can be obtained in electronic form

 (34 C.F.R. § 99.30).

Absent parental consent, FERPA allows school staff to share information from the education record with “school officials” in the same school who have a “legitimate educational interest” in the information (34 C.F.R. § 99.31(a)(1)). The term “school official” includes school staff, such as teachers, counselors, bus drivers, and school nurses. There are instances where a school might be able to also share information with a volunteer, contractor, or others who are providing school functions, subject to certain limitations (34 C.F.R. § 99.31(a)(1)(i)).

A school that allows access to personally identifiable information under the “school official” exception must include, in its annual notification to parents of FERPA rights, a specification of its criteria for determining who constitutes a "school official" and what constitutes "legitimate educational interests" (34 C.F.R. § 99.7). Additionally, a school needs to provide safeguards for identifiable information to prevent access by or communication to unauthorized individuals (§99.31(a)(1)) and satisfy any applicable recordkeeping requirements (§99.32). In other words, a school must use reasonable methods to ensure that school personnel obtain access to only those education records in which they have legitimate educational interests. If a school does not use physical or technological access controls, it must ensure that its administrative policy for controlling access to education records is effective and that it remains in compliance with the legitimate educational interest requirement (34 C.F.R. §99.3  (definition of "disclosure") and 34 C.F.R. §99.31(a)(1)).

Nothing in FERPA prohibits, per se, the use of lists that identify students with specific health concerns. That said, the recipient of the list must have a “legitimate educational interest” in the information. In other words, “who has a need to know the information?” The U.S. Department of Education, which enforces FERPA, explains: “[A] school official generally has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.”

Classroom teachers, bus drivers, coaches, and others might have a legitimate educational interest in knowing the students, with whom they work or have contact, who have asthma. In this regard, personnel who are directly responsible for students must be able to respond to emergencies and report symptoms. However, the problem with lists is that the recipient may not work with each individual student on the list.

For purposes of FERPA, it would be important to articulate not only who has a legitimate educational need for the information but also how information that is provided might serve a legitimate educational purpose. (i.e., if information is useless, then it would not serve such a purpose).

Under the “school official” exception, it would be difficult to provide a confidential paper or electronic list of all students with asthma to teachers, coaches, bus drivers and others who have contact with students, without tailoring the list based on each staff person’s need to know. For the same reason, it would difficult to meet the legal standard to provide a spreadsheet with additional asthma-related information for listed students, without tailoring this for need to know.

Finally, another exception to FERPA permits a school to disclose information from the education record without parent consent to protect the health or safety of a student or other individual in an emergency. However, this exception is very narrow and does not permit routine sharing of health information about students. The emergency must be a specific situation that requires immediate need for disclosure of the information. For this reason, the emergency exception would not support disseminating to school personnel a list of students with asthma.

Network attorneys are available to answer questions on this and other public health topics at no cost to you, and can assist you in using law to advance your public health initiatives. Contact a Network Attorney in your area for more information.

The legal information and assistance provided in this document does not constitute legal advice or legal representation. For legal advice, readers should consult a lawyer in their state.