By Ada Meloy
In a crisis situation, a flurry of concerns consumes the minds of campus officials. They must ensure the safety of the campus community while paying attention to compliance with the relevant state and federal laws.
These laws can be confusing, and sometimes even appear to work at odds with one another. Understanding how they interact allows institutions both to respond more quickly and appropriately and minimize liability for non-compliance.
Two federal laws, each administered by the U.S. Department of Education, are especially important in these situations: the Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act (commonly known as the Clery Act) and the Family Educational Rights and Privacy Act (FERPA).
Clery and FERPA During Crisis
The Clery Act requires institutions to provide immediate emergency notifications to the campus community upon learning of a dangerous situation, which includes any immediate health or safety threat to students or employees. Bomb threats, a shooter on campus, and natural disasters are examples of events that could trigger an emergency notification.
Clery also requires institutions to issue timely warnings about serious crimes or emergencies on campus that have been reported to campus security or local police, and are determined by the institution to represent a serious or continuing threat. When evaluating a potential threat or considering an emergency notification, it is best to err on the side of caution and issue a warning as soon as possible. The warning should also be accurate and specific enough to help its recipients. While complex, compliance with Clery is vital to campus safety and to avoid disciplinary actions. Failure to comply with Clery can result in fines (up to $27,500 per violation), suspension, and limiting of Title IV funding.
Even as colleges and universities strive to provide fast information in accordance with the Clery Act, they also may feel constrained by concerns over student privacy, which is protected by FERPA and other privacy laws.1 In many circumstances—such as when the threat does not involve a student or knowledge of the identity of the student will not help others respond to the threat—it will not be necessary to disclose personally identifiable information from student education records in order to respond. However, when such knowledge is relevant, the health and safety exception contained in FERPA expressly permits its disclosure without consent.2 Thus, for example, if a student threatens to harm his or her family, the institution may give the police information from the student’s education record about the student’s family that may help them protect the student’s health and safety. If the student’s threats pertain to the campus generally, the institution might disclose relevant information, such as the student’s identity, to the entire community. This exception allows institutions to comply with both Clery and FERPA.3
Under FERPA’s health and safety exception, an institution evaluates the totality of the circumstances to determine whether an “articulable and significant threat” to the health or safety of a student or others exists. The standard for finding such a situation is flexible, and deference is afforded to institutions as long as there is a “rational basis” for their decision. If the institution does find that a health or safety threat exists, administrators may release certain personally identifiable information from a student’s education record. However, the disclosure of information under the exception is permitted only while the threat or emergency is taking place, is limited to information that the institution reasonably determines can help to protect health and safety, and may be made only to those the institution determines can be helpful. Once a disclosure has been made under this exception, the institution must record in the student’s record the threat that formed the basis for the disclosure and the parties to whom information was disclosed.
Limitations on Information Disclosed
Medical and psychological treatment records from services provided by the institution are excluded from the definition of a student’s education record when the disclosure is made for purposes of treatment. However, when disclosure is necessary for purposes other than treatment, the records are no longer excluded from the definition of “education records” and are subject to all FERPA requirements.4 Therefore, should an institution need to disclose information in the student’s treatment record for purposes other than treatment, the disclosure must fall under one of the exceptions to written consent under 34 CFR § 99.31(a).5
Personal Knowledge or Observation
FERPA only applies to a student’s education record, so disclosing personal knowledge or observations about a student is not restricted by FERPA. For example, if a student tells his resident advisor that he or she was diagnosed with a highly contagious illness, the institution could notify the student’s roommate and others who may have been in close contact with the student to urge them to seek the appropriate care. If an employee observes a student engaging in erratic behavior or overhears a student making threatening comments, that employee may disclose the information to a resident or academic advisor, student health service providers, the police, and others as necessary. Institutions that have threat assessment teams will likely want to make them the initial focus of such disclosures, as they typically will be best equipped to assess the situation and determine how to handle it.6 Threat assessment teams may include employees as well as relevant community members, such as police officers. Team members may be given information even before there has been a determination that any kind of threat or emergency actually exists precisely so that they can help determine whether there is a threat to health and safety that would justify invoking that exception.7
Missing Students and Confidential Contact Information
During the course of a missing student investigation, information from the student’s education record, including contact information, may be disclosed to appropriate parties. In addition, the Clery Act allows students to register confidential emergency contact information. However, unlike contact information that is protected by FERPA and subject to disclosure during an emergency, this emergency contact information is protected against disclosure beyond authorized personnel and law enforcement officers. Therefore, during a missing persons investigation, the contact information contained in a student’s record and the confidential contact information provided pursuant to Clery are subject to different disclosure provisions.
Institutions can take comfort knowing that there is no real tension or conflict between FERPA and the Clery Act, and that various exceptions to FERPA specifically allow for compliance with the Clery Act’s requirements during an emergency. Because of the significant deference afforded to campuses, colleges and universities can and should focus their efforts on complying with the emergency notification provision of the Clery Act and taking other actions consistent with state and federal laws to prevent or minimize a crisis.
Ada Meloy is general counsel of ACE. She acknowledges the contributions of Sharone Pasternak, a law student at Washington University in St. Louis, to the preparation of this article.
1 Certain records, such as a student’s treatment record or law enforcement record, do not implicate FERPA, but are protected by other confidentiality laws.
2 The health or safety exception is one of approximately 17 exceptions to FERPA.
3 It should be noted that there may be other reasons besides FERPA not to release personally identifiable information, such as concern over possible libel and defamation claims. This is similar to the police practice of not releasing the name of a suspect in many cases.
4 Most such information will be subject to state medical confidentiality requirements that will preclude its disclosure even if such disclosure would not violate FERPA.
5 Lists conditions where prior consent is not needed, including health or safety emergency.
6 For more information on establishing a threat assessment team, see http://ed.gov/admins/lead/safety/edpicks
7 Institutions may disclose personally identifiable information to threat assessment team members who are not employees provided they qualify as “school officials” with “legitimate education interests” under § 99.31(a)(1)(i)(B) of FERPA.