Gag Order or Privacy Concern?

Numerous institutions are telling professors not to talk about when students in their face-to-face classes contract COVID-19, or saying that professors won’t be notified when their students test positive, or both. In so doing, these institutions generally cite privacy laws. But professors say they’re reading between the lines on that guidance, and they suspect that it’s more about public relations than student privacy concerns.

Some faculty members say they have no interest in sharing students’ medical information but believe that they -- and their other students -- have a right to know if someone with whom they’ve shared classroom air is sick. They also say that discussing student health without naming names is covered by academic freedom, since it relates to how well or how poorly campuses are handling outbreaks.

“We are very concerned. There’s so much secrecy,” said Michael Innis-Jiménez, professor of American studies at the University of Alabama at Tuscaloosa, which has repeatedly warned professors not to talk about students testing positive with other students, with colleagues or on social media.

Why not? “The university’s answer is HIPAA, that’s what their lawyers say,” Innis-Jiménez continued, referring to the Health Insurance Portability and Accountability Act of 1996, which restricts the sharing of personally identifiable health-care information. Yet “the lawyers are working in the best interest of the university. And that’s a pretty solid method to shut up the faculty.”

In a recent email to the faculty, James T. Dalton, Alabama’s provost, wrote that if the “established rules for masks and physical distancing are followed in the classroom, then the risk of transmission from the positive student is minimal, and it is not necessary to inform the rest of the class they may have been in the same room as a positive classmate. For privacy reasons, the instructor should not announce to the class that a student in the class tested positive, even anonymously.”

Another email to members of the Faculty Senate from Rona Donahue, the group's president and professor of geological sciences, says that instructors “will not be notified if a student in their class tests positive for COVID-19, unless they have been in close contact with the student (< 6 feet for at least 15 minutes without a mask). Class attendance requires masks and social distancing, so this does not meet [Centers for Disease Control and Prevention] criteria for close contact.”

Donahue added, “Please refrain from posting my messages to social media or sending them to the press. I would like to retain the trust of the administrators who have provided this information so they will continue to share.”

Yet another email to department chairs from Tricia McElroy, associate dean of arts and sciences, says that instructors “should NEVER, EVER refer to, mention or discuss student health. In particular, I'm referring to social media, about which we are hearing alarming reports.” That includes “what some might consider an anonymized statement like, ‘Two students in my class tested positive.’ Even if this seems like an innocuous statement, it is not. In the current environment, people can make deductions, making ANY reference to student health a potential HIPAA violation.”

A HIPAA violation “has serious consequences for the faculty member,” McElroy said.

Innis-Jiménez works with Safe Return UA, a faculty, staff and student group that advocates universal COVID-19 testing and other health and employment protections at Alabama during the pandemic. The group has urged caution with respect to reopening the Tuscaloosa campus, which on Friday revealed that more than 1,000 students had tested positive for COVID-19 since classes resumed on Aug. 19.

In a statement about the statistic, the university said that it appears no cases were contracted as a result of face-to-face instruction. The university is “satisfied” that mitigation efforts including masking, distancing and mixing remote learning with face-to-face instruction are working.

Innis-Jiménez said that even if the university is satisfied, many professors aren’t. He said the science as to how COVID-19 is spread indoors is still in dispute, and that contract tracing efforts rely on students disclosing if and when they’ve been without a mask or not practiced social distancing. The university requires both, except in limited circumstances, so this means students would have to admit they’d broken the rules.

At Boston University, non-tenure-track instructors who are affiliated with Service Employees International Union organized a petition opposing their administration’s notification decisions. The university has said it will only tell professors and graduate student instructors when a close contact is infected.

The petition lists other faculty complaints about the university’s response to the pandemic: rejected requests for “workplace adjustments outside of narrowly defined criteria,” “changed room capacities without explanation” and having “declined to offer even the simplest gestures -- like providing a single cloth face mask -- that might have generated goodwill.”

Taking all that into account, the union continued, “we find it impossible to believe this decision is truly guided by science or by best practices in public health, especially given the growing evidence for aerosol transmission.”

College of Arts & Sciences faculty members also “strong advocated” more stringent notification, Eileen O'Keefe, chair of Boston’s faculty and clinical professor of health sciences, has also said.

Boston, however, determined that protecting student privacy was most important, not necessarily because of HIPAA, but because it believes students will be more forthcoming with respect to contact tracing.

“The efficacy of contact tracing is entirely dependent on the accuracy of the data shared by the individual who has tested positive,” Jean Morrison, the provost, wrote in a memo to the faculty. “If students do not feel their privacy is protected, they may be less likely to fully and honestly participate in contact tracing, putting us all at higher risk.”

The American Association of University Professors chapter at Vanderbilt University also has spoken out against similar guidance from that institution regarding students who test positive for COVID-19.

According to Vanderbilt, only the COVID-19 Command Center is responsible for contract tracing and notification. “Faculty and staff should not send notifications to other faculty members, staff or students; the Command Center will handle all notifications,” reads the university’s guidance.

Vanderbilt said it will notify professors when a student enrolled in an in-person class tests positive, without naming the student. But instructors “will not need to take any further action unless directed to do so by the Command Center. Only those deemed close contacts through contact tracing will be notified.”

The Vanderbilt AAUP chapter has described this as a “no-faculty-communication” policy that conflicts with some of the emerging science on aerosol spread and professors’ ability to manage their classrooms and student safety.

HIPAA Doesn't Apply

Experts have mixed opinions as to whether professors should discuss student health in anonymized terms, but they agree that HIPAA has little to nothing to do with it. All also agreed that there are major potential conflicts between how universities handle notification and how professors see fit to handle it.

Michael F. Arrigo, an expert witness in various HIPAA-related court cases, said that educational institutions are not generally considered HIPAA-covered entities, as such entities are health plans, health care clearinghouses and health care providers who electronically transmit health data. Even so, he said, HIPAA may be a useful “framework” for thinking about student privacy concerning the coronavirus, as misinformation about people’s health can wreak havoc in their lives. In one case in which he was involved, for example, someone in the U.S. suffered grave personal consequences under the suspicion that they were infected with the Ebola virus when they were not infected at all.

“It’s a tough situation,” Arrigo said, again emphasizing that schools, colleges, and universities are not HIPAA-covered entities. “But let’s just assume HIPAA standards cover the school. You can’t disclose a student’s name, age, date of birth, gender, anything geographically about them more specific than the state of residence. If someone’s diagnosis is shared, this can cause real harm to the individual. There are unintended consequences of such disclosures.” 

He added, “It is important to protect the privacy of the individual and balance the safety of the students, faculty and the public. As much as you can rationalize wanting to know, no, I don’t think [professors or institutions ] should disclose that.” 

Brett Sokolow, chair of the campus risk management firm TNG Consulting, also agreed that HIPAA isn’t relevant to COVID-19 student-related notifications. The Family Educational Rights and Privacy Act, or FERPA, which protects the privacy of student education records, probably does apply, though, he added. 

While he understands why faculty members might want to know if and which students tested positive for COVID-19, Sokolow said that FERPA means colleges and universities may share personal record information about students with faculty members if there is a “legitimate educational interest” in doing so. 

Deference is typically afforded to institutions in determining what is legitimate information and what is not, he said. So where the university has a reasonable safety protocol in place -- even if faculty members disagree with the the level of “triage” in that protocol -- it’s probably not legitimate to share the identities of students who test positive.

Sokolow said FERPA would not permit faculty members to talk about students testing positive as part of academic freedom, if doing so could lead to the identification of specific students who are notable for their absence from class. Professors do have rights as private citizens outside of their employment capacity to speak out generally on issues of public concern under the First Amendment, however, he said.

Amelia Vance, director of youth and education privacy at the Future of Privacy Forum, also said FERPA, not HIPAA, "is almost always the law that would govern COVID-19 campus notifications, and neither law forbids disclosing aggregated information.” The personal and legal risks associated with talking about students who test positive are in many cases overblown, as well, she added.

Vance cautioned against telling a class of, say, 10 students that someone in their midst had coronavirus, as the student’s mere absence could give them away. But that is very different from saying on social media that five or 10 students across a professor’s entire teaching load tested positive, or telling a large lecture class that someone tested positive, she said.

Vance also suggested that professors might work together as departments or units to offer additional, or layered, notification systems, on top of colleges’ and universities’. Making announcements about students in a program or building testing positive might help protect student privacy better than individual professors making announcements, and offer more transparency than a single, universitywide system.

Either way, institutions that cite federal privacy in telling professors not to discuss cases online or with other students “are on fairly rock legal ground,” Vance said, “particularly for tenured faculty who have a broad right to academic freedom, because you do have a really compelling public interest case. I really do think faculty should be able to discuss this, as long as they’re not saying, you know, ‘Jane Smith in my 12-person seminar class tested positive,’ or mentioning other information that can be traced back to the student.”

Alabama said in a statement it is "committed to providing students, faculty and staff the resources and information they need in this time of change and challenge. The university must, however, balance this against its commitment to protecting the private health information of our campus community."

"Robust" response procedures have been put in place "to strike this balance while complying with federal privacy laws, primarily FERPA," the university said.