What Do Parents Need to Know?

Last April, a lone student gunman at Virginia Tech killed 33 people (including himself) during a shooting rampage that some say university officials should have seen coming.

A committee convened by Virginia Governor Tim Kaine found that Virginia Tech officials had misunderstood federal student privacy laws as forbidding any release of private student information, a misreading that led them to miss several warning signs. Indeed, a federal report last summer found widespread confusion nationally about the privacy rules, known as the Family Education Rights and Privacy Act (FERPA). As a result, last week the U.S. Department of Education issued a clarification on when it is appropriate for universities to disclose private student information.

What does this mean to Boston University students and their confidential information? BU Today spoke to Erika Geetter, an associate general counsel at BU, who was on a committee of University administrators that studied the Virginia Tech shootings and gave a presentation to BU’s Administrative Council in November with recommendations on “how the University can best prepare to avoid a similar horrific incident.”

BU Today: What privacy rights does this law give students?
Geetter: The basic rule is that before disclosing a college student’s records, or information from those records, an institution such as BU has to get the student’s consent. There are a number of exceptions: one is that we’re allowed to disclose information, such as grade reports, to the parents of dependent students. That’s permissible, not mandatory. Some schools have chosen not to provide any information to parents of dependent students; others don’t routinely disclose grades, but will disclose information about disciplinary action of a certain nature.

Currently, Boston University generally shares information with parents about grades and academic work by the student, and we also share information about academic or other difficulties the student may be having. Basically, the University has chosen to keep families informed.

What sort of information is protected by this privacy law?
The statute talks about “education records,” which is a little bit of a misnomer, because the records don’t necessarily have to do with the student’s education. If we have a record that identifies the student, but doesn’t talk about education, it is still a FERPA record.
But the “education records” don’t include information that is not recorded, such as information you obtain from personal knowledge or observation. What that means is that if you see a student acting in an aberrant manner, or in a way that causes concern, there is nothing in FERPA that in any way prohibits you from sharing that, because it’s not a record in any way.

On the other hand, if someone comes in to talk to an advisor and that advisor learns something about a student, that information is FERPA-protected, because the knowledge came from the advisor acting in an official capacity.

What about the health and safety emergency exception? What qualifies?
It’s up to the institution to decide whether a health or safety emergency exists. This exception has always been in the regulations, but the recently proposed regulations published by the Department of Education give further guidance on how the institution should make that determination. You’re supposed to look at the totality of the circumstances and to determine if you, the school, believe there is a significant and articulable threat. This means that you should be able to not just say, ‘Gee, something feels funny’ — you should be able to articulate a specific concern.

In such a situation, the student information can be given to anybody — parents, police, other students — who would need to know the information to stop the threat from materializing and hurting someone.

Was the privacy rule clarification needed?
I do think it will be helpful. The regulation states that this health and safety emergency situation will be strictly construed, which means very narrowly, and I think in the wake of the Virginia Tech tragedy, a lot of academic administrators felt the bar for this exception was set very high. I think there was a lot of fear that if in the heat of the moment you made a disclosure, you could be legally liable. The perception was that there had to be really imminent danger and you had to get it right, or else you might be acting unlawfully in disclosing.

The clarification basically says that the Department of Education is not going to engage in Monday-morning quarterbacking: if the decision to disclose was rational at that time, then the Department of Education is not going to second-guess the decision of the school. And I think that has been their policy, but I don’t believe it was ever articulated in their regulations. They’re actually putting it right into the regulations, which I think should provide some comfort to administrators who are facing difficult situations where they need to act quickly and decisively.

Will it change BU’s approach to sharing private student information?
The general approach is that we at BU obviously appreciate and follow the privacy protections in FERPA, but the University has always placed a premium on communicating with parents and responding swiftly to a student in crisis. So if, in the judgment of the people near a student, he or she may be in crisis and we need to disclose information to the police or the student’s parents, then we’ve done so.

Who makes the call?
If you’re talking about the health and safety exception, the decision maker will vary depending on the situation. There’s almost always involvement by the Office of the Dean of Students. There could also be involvement by Student Health Services, the department of behavioral medicine, and the Office of Residence Life. And in difficult cases, our office may be called upon to advise. Ultimately, it’s a judgment call based on the circumstances at hand. There has been some guidance from the Department of Education as to circumstances that might be an emergency, such as serious communicable diseases, in which you can disclose information to authorities so that they can take appropriate public health measures.

In terms of aberrant behavior by students, it’s case by case as to whether you believe that statements by the student, coupled with other information you may know, lead you to believe that further disclosure is necessary to prevent the student from harming himself or others. Rather than a specific process, there’s a team of individuals who work together and collaborate in decision making — not just in deciding on a FERPA disclosure, but in managing the situation, with the safety of the students and the community paramount.

To read about the University’s effort to help faculty and staff work with students in distress, click here.

Chris Berdik can be reached at cberdik@bu.edu.