Information Sharing

The Family Educational Rights and Privacy Act (FERPA) and other federal statutes have implications for information sharing in the emergency planning process. There are also more limited circumstances when the Health Insurance Portability and Accountability Act (HIPAA) may apply to impact information sharing in the IHE setting.

While it is critical that IHEs comply with these laws, there is often confusion about their applicability, which results in IHEs sharing less than allowed with law enforcement officers or the appropriate authorities, even when there is appropriate cause for sharing information. If IHEs understand when and how these laws apply, they can both ensure public safety and protect student privacy.

In addition to FERPA and HIPAA, there may be additional federal and state civil rights and other laws that place restrictions on when and with whom IHEs may share information. At the federal level, for instance, postsecondary institutions are subject to federal civil rights laws, including laws that prohibit discrimination based on disability (ADA and Section 504 of the Rehabilitation Act of 1973 ), race, color, and national origin (Titles IV⁵ and VI of the Civil Rights Act of 1964), sex (Title IX of the Education Amendments of 1972 and Title IV of the Civil Rights Act of 1964); and religion (Title IV of the Civil Rights Act of 1964). For example, Section 504 and Title II of the ADA⁶ prohibit discrimination on the basis of disability, and generally would prohibit unnecessary disclosures of disability status, or information related to that disability, to third parties.7 Disclosures may be necessary when the student presents a significant, articulable threat to others.⁸

Postsecondary institutions are strongly urged to take the time to review these laws, as well as others that apply in their jurisdictions, when working with their community partners (e.g., law enforcement agencies, fire departments, emergency management agencies, public and mental health agencies) to ensure that all parties have a strong understanding of applicable laws when deciding whether to disclose information from education records without consent. In particular, it is critical to train the institutions’ employees, including contractors, on applicable laws to ensure that institutions, IHE officials, or employees do not release information inappropriately or make decisions about students or release of records based upon myths, fears, or stereotypes related to race, color, national origin, sex, sexual orientation, gender identity, religion, or disability.⁹