Why some law experts question why UNC won't release more COVID-19 cluster info

Before the first week of classes came to a close, UNC students received a notification from Alert Carolina identifying clusters of COVID-19 cases in Ehringhaus Residence Hall and Granville Towers. By the end of the weekend, a cluster was confirmed at Hinton James Residence Hall and another at the Sigma Nu fraternity house. 

UNC used the N.C. Department of Health and Human Services definition of a cluster, which is five or more cases in a single dwelling or residence hall, but students, faculty and staff were not given any additional information about the number of cases.

Associate Vice Chancellor for University Communications Beth Keith said the University will not disclose the number of cases within each cluster due to the Family Educational Rights and Privacy Act, a federal law that protects the privacy of student education records. Other UNC System schools, however, are releasing specific case counts.

UNC law professor Maxine Eichner said in March that the Student Privacy Policy Office at the U.S. Department of Education released a document containing frequently asked questions about how institutions can deal with the release of COVID-19-related data without violating FERPA. 

One of the questions on the FAQ document asks if an institution can disclose information regarding a student contracting COVID-19 to other students and the school community without the student's consent.

“It depends, but generally yes, but only if that information is in a non-personally identifiable form,” according to the Department of Education's FAQ. 

Eichner said she disagrees with the idea that FERPA prohibits disclosure of the number of COVID-19 cases in a cluster. 

"Their blanket statement, 'We can never, in any circumstance, say how big a COVID cluster is because FERPA prohibits it,'" Eichner said. "I think that is an incorrect statement." 

Northwestern University associate professor of law Matthew Kugler clarified this distinction by giving an example of a scenario that would be classified as a FERPA violation. 

“A covert FERPA violation would be when you started being able to say, 'Okay, there are 10 people who have it, and five of them are male, and they’re all freshmen, they all came in from New York or something," Kugler said. "Suddenly, you might have a FERPA problem because you could identify them." 

Kugler said as long as data is not linkable to specific students, its release is not a FERPA violation. 

The Daily Tar Heel asked UNC Media Relations to share the specific FERPA language that prohibits UNC from sharing non-identifiable information, such as the number of cases in each cluster — but the University pointed out that it's up to each institution to determine what is personally identifiable.

"The University has determined that releasing a specific number of positive cases in a Clery Act required campus alert could lead to the identification of a COVID-positive individual," UNC Media Relations said in a statement. 

university@dailytarheel.com