The Daily Gamecock

USC can share more COVID-19 cluster information under FERPA, experts say

The University of South Carolina has cited the Family Educational Rights and Privacy Act (FERPA) in order to withhold the location of coronavirus clusters on campus and specific data about the clusters.

According to the CDC, a cluster is an unusually large gathering of "health events" which are in one area. These "health events" are positive COVID-19 cases. 

The university has not released which Greek Village houses are under quarantine, citing student privacy protection under FERPA. It has also not released specific case numbers for each of the houses in Greek Village. 

At a town hall on Sept. 2, President Bob Caslen said two on-campus residence halls were saliva tested after environmental wastewater testing showed possible COVID-19 outbreaks in the dorms. When asked to identify the dorms, university spokesperson Jeff Stensland declined, again citing FERPA.

However, according to Christian Stegmaier, a partner at Collins & Lacy Attorneys at Law, FERPA does not prohibit universities from releasing data of COVID-19 clusters in dorms and Greek Village houses.

"If they wanted to get Women's Quad or Patterson Hall or the fraternity and sorority housing – that's a big enough area, for the purposes of a cluster, that my suggestion is they wouldn't be in violation of FERPA," Stegmaier said.

FERPA is a federal law applying to all educational institutions that receive funding from programs under the U.S. Department of Education. Under FERPA, no identifying information held by an academic institution can be disclosed without the written consent of a parent/guardian or a student that is 18 years old or older.  

Stegmaier said there has been some confusion throughout the nation's universities about FERPA.

"I think there's been a little bit of confusion, probably most likely unintentional, about whether FERPA allows the university to release information about COVID-19 infection. What FERPA prohibits is the university from releasing specific, identifying information about students," Stegmaier said. "But FERPA would allow the university to release general information about students without their consent." 

Universities cannot release information either alone or along with other information that "would allow a reasonable person in the school community to identify the students who are infected," Stegmaier said in an email. 

"For example, if there is one student missing from Dorm Hall A due to a COVID infection and the school releases a statement saying, 'There is one COVID case reported on Dorm Hall A,' this may be a violation since that particular student would be reasonably identifiable as the infected student," Stegmaier said in an email.

Mike Hiestand, senior legal counsel at the Student Press Law Center, said universities couldn't invade someone's privacy if that person is not identified.

"So purely statistical info -- or even a report that a "student in Smith Hall" has tested positive -- is safe to report," Hiestand said in an email. 

Hiestand said if a student were particularly "newsworthy," such as an athlete or a student who engaged in activities that might have exposed others, it would be safe to report this specific student if a credible argument is made that others should be warned.

According to Stegmaier, schools cannot get into any real legal trouble under FERPA for applying it too broadly and not disclosing information. 

"Hypothetically, if a university were to say, 'We can't respond as in particular as it relates to a particular dorm or set of dorms because of FERPA," my response is 'I don't think that's right,'" Stegmaier said. He later said in an email, "Institutions historically hide behind privacy laws to justify not releasing information that it legally could. It is legally safer to err on the side of releasing too little information than too much."

According to the Student Press Law Center's "FERPA Guidance Letter," FERPA only restricts universities from releasing "personally identifiable information," or PII, about students. 

"Information that does not contain PII, including for example statistical reports about campus COVID19 testing, infections, quarantines, etc., is not subject to FERPA and can be released without obtaining prior consent from students or their parents. Moreover, where documents and data containing such information fall under a state open records law — which will almost always be the case at a public school — you may not lawfully cite FERPA as an excuse for denying public access to such information," the FERPA Guidance Letter said.

Before moving online for the semester, the University of North Carolina at Chapel Hill disclosed where clusters of coronavirus cases were on campus but did not give the number of cases within each cluster.

The Daily Tar Heel, UNC's student newspaper, asked its school for individual case numbers within clusters but was told that FERPA forbade it. According to The Daily Tar Heel, the school defined a cluster as five or more cases but said offering additional detail could disclose personally identifiable information about students.

UNC later backtracked and provided the number of students within each cluster, which is accessible via their COVID-19 dashboard