When the Board of Education of District 186 met in mid-July in Springfield, Illinois, they weren’t yet debating remote-only versus hybrid instruction, or whether the administration had ordered enough wireless hot spots. Still, Springfield Education Association leaders and members who spoke at the meeting were already convinced that the district’s leadership was mishandling its preparations to return to school in the midst of a pandemic. The controversy that night was over how the district had handled the news that an adult present in a school building had tested positive for the novel coronavirus. Although the start of classes was more than a month away, school buildings were open for limited purposes. The SEA was unhappy that the district relied on contact tracing instead of disclosing the name of the infected individual to those who may have been in the same building. The district’s response was that revealing the name would violate FERPA, HIPAA, and other privacy laws. Who was right?
What is contact tracing?
Contact tracing is a process fueled by information an infected individual provides. A contract tracer interviews the person as soon as possible after a positive test result and asks them to mentally retrace their steps, thinking about the people they came into contact with during the period when they likely were contagious, usually starting two days before symptom onset or a positive test. In particular, the contact tracer is interested in identifying “close contacts”—those individuals who were within six feet of the infected person for more than 15 minutes. The contract tracer then notifies the close contacts that they were potentially exposed and advises them of next steps, but without disclosing the identity of the person who may have exposed them.
This approach, of course, has limitations. When using the interview method described above, it relies entirely on the memory and cooperation of the COVID-
positive individual. (Tech companies have been developing apps to try to get around the memory problem by logging location information and cross-referencing it with self-reported health status, but this in turn has raised serious privacy and data storage concerns.) Even when interviewees remember where they went during the relevant time period, they may not know the names of those with whom they came into close contact—for example, who did they sit next to at a bar or stand in line behind at the grocery store?
Even in a school context, the infected person might not remember and be able to identify everyone they had close contact with over the course of several days. Why not give the name and job title of the positive case to anyone who was in the building during that time period, allowing possible contacts to identify themselves?
One rule for students, another for teachers and staff
In March, the U.S. Department of Education released a question-and-answer document on privacy concerns during COVID-19. It answered the question of whether a district can disclose the name of a student who has contracted COVID-19 with a resounding no. That’s because FERPA—the Family Educational Rights and Privacy Act—applies to students. It allows identifying information on individual students to be disclosed in the event of an emergency but only to “appropriate parties.” These parties may include public health authorities. They definitely do not include other students and their families, the media, or the general public.
Adults who work in or visit school buildings, however, are not protected by FERPA. While the federal FAQ document urges caution, reminds school leaders that states may have stricter laws, and recommends traditional contact tracing as a best practice, it acknowledges that there is no federal law preventing a school from disclosing some non-students’ names to the wider community.
What about HIPAA?
When people talk about the confidentiality of personal health information, they often mention the acronym HIPAA, short for the Health Insurance Portability and Accountability Act of 1996. However, only health care providers and health insurance plans have obligations under HIPAA to keep health information secure and obtain informed consent for any data sharing. HIPAA actually doesn’t apply to schools or school districts (unless they manage their own employee health plans, and then only with respect to information collected while administering those plans).
Confidentiality under the ADA and related guidance
What does apply to schools, as employers, is the Americans with Disabilities Act (ADA) and the rules implementing it. The ADA states that when an employer collects health information about an employee, it must keep that information confidential. This could include records of a staff member’s temperature upon reporting to work, symptoms while at work, disclosures regarding recent travel or exposure, or employees’ test results. As with FERPA, though, the ADA allows for identifying information to be shared with public health authorities in times of emergency.
According to guidance the Equal Employment Opportunity Commission (EEOC) developed, the identity of an employee who has tested positive may be disclosed to certain “officials” of the employer, not including rank and file coworkers. (The EEOC leaves it up to each workplace to designate such officials, but employers “should make every effort to limit the number of people who are informed regarding the employee’s identity.”) CDC guidelines also emphasize that disclosing the name of a COVID-positive employee to the workforce at large is not permitted. The EEOC recommends traditional contact tracing and allows that it is not a violation to share information such as the area of the building the COVID-positive person frequented and on which dates—even if that disclosure tends to identify the specific employee affected.
However, many individuals may be present in a school who are neither students nor school employees. The ADA, in this context, may not apply where the positive case is a parent, outside vendor, volunteer, or visiting community member.
Just because you can, doesn’t mean you should
School districts may disclose the names of teachers (and others not covered by FERPA) to those designated as employer officials. They may give coworkers information about a COVID-positive colleague that essentially identifies the person, as long as they do not refer to them by name. And schools may be able to legally give employees, families, and even the general public the names of non-employees and non-students who have spent time in a school building and subsequently test positive.
But should they?
Doing so may help catch more close contacts. But there are disadvantages. It may induce panic, driving people who weren’t anywhere near the infected person to stay home and/or overwhelm testing capacity unnecessarily. Most crucially, the COVID-positive individual and their family may endure bullying, social avoidance, and even threats. Although COVID is now widespread in the United States, stigma around the disease persists. Combined with the high expectations placed on teachers and the alarming incidence of teacher stress and burnout, the additional worry of public shaming if a teacher tests positive could take a heavy toll on mental health in this critical profession. And it may discourage others from coming forward about their symptoms and cooperating with contact tracers.
Ultimately, cooler heads prevailed in Springfield. District 186 opted for an all-remote fall semester, and the teacher’s union and administration worked together on e-learning strategies and health protocols. Positive cases among individuals in school buildings occasionally led to brief shut-downs of school feeding sites for cleaning purposes; as community spread worsened, few questioned or objected to these measures or the district’s commitment to confidentiality. Early demands for public identification of positive cases proved to have been a knee-jerk response to a frightening scenario, as all parties eventually settled into following the law and common sense.
Katharine Eastvold is a law student at Loyola University Chicago School of Law and wrote this blog post as part of the Education Law Practicum.
