Event:Campus Technology Distance Learning Summit
Date:On Demand
Location:Online
Information:Launch Webinar

Event:Network Security 2020
Date:September 20-25, 2020
Location:Las Vegas, NV or Online
Information:Course List

Event:Higher education Title IX decision-maker training
Date:October 1, 2020
Location:Online
Information:Details

Event:WCET Annual Meeting
Date:October 6-November 12, 2020
Location:Online
Information:Details

Event:EDUCAUSE Annual Conference
Date:October 27-29, 2020
Location:Boston, MA or Online
Information:Details

Event: 2020 FSA Training Conference for Financial Aid Professionals
Date:December 1-4, 2020
Location:Online
Information:Details

Compliance During the Pandemic

Institutions of higher education, particularly small private colleges, should take extra care to ensure they are compliant with applicable regulations during this national emergency. Compliance and processes should be documented.

Some regulations have been temporarily waived or modified to afford relief during the pandemic. For example, the federal government has suspended enforcement of HIPAA penalties in certain instances. However, the federal government is actively enforcing other regulations. For example, the Department of Education was unwilling to postpone implementing a Title IX rule that was likely to prove burdensome for smaller institutions.

The privacy of citizens is protected through a patchwork of laws regulating the disclosure of personally identifiable information (PII) including, state laws, the Family Educational Rights and Privacy Act (FERPA), the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), and the Payment Card Industry’s Data Security Standard (PCI DSS). To varying degrees, these laws are applicable to colleges and universities. The following is a brief look at some of them.

FERPA

The Family Educational Rights and Privacy Act (FERPA) protects the privacy rights of students. Under normal circumstances, an institution is prohibited from disclosing a student's PII. However, if an institution determines that there is a critical need to disclose a student’s PII to protect health and safety, it may proceed under the Health or Safety Emergency Exception. This allows disclosure on a need to know basis without prior consent from the student or the student’s parents. The exception must be applied on a case by case basis. The disclosure should be limited in scope to the minimum amount of information necessary to mitigate the problem. It is the institution's responsibility to determine if the need is valid, how much information is needed, and to whom that information should be disclosed.

Protecting student privacy while using online educational services (ed tech) is difficult. Institutions must determine if the data they collect is considered PII. If it is, steps must be taken to ensure the data is transmitted and stored securely.

Protecting student privacy while answering health inquiries is another concern exacerbated by the pandemic. FERPA does not prohibit institutions from disclosing that “students” have tested positive for COVID or may have COVID. However, FERPA restricts institutions from directly or indirectly disclosing the identities and other PII of any student. The institution may inform the public and alert those who were in contact with the student but must do so without naming that student. In the event that a foreign public agency requests PII, disclosure is permissible if necessity is proven. Institutions are required to document whenever they release PII under the Health or Saftey emergency exception. They must document what they have disclosed, why they have disclosed it, and to whom it was disclosed.

As outbreaks occur on campus, care must be taken to protect students' PII when dealing with the media. Photos or videos that show a student having a health emergency or display PII, such as a student ID, are part of a student's education record. As such, they are protected under FERPA. Nonconsensual disclosure to the media is not allowed.

HIPAA

Generally speaking, the Health Insurance Portability and Accountability Act (HIPAA) governs the privacy rights of administrators, faculty, staff and other non students. It does not apply to students as in most cases, even if a student is treated in the university's clinic, his health record would be considered part of his education record and thus fall under FERPA.

Under HIPAA institutions can disclose protected health information (PHI) without patient authorization to those at risk of contracting or spreading a disease. A response to a foreign request for PHI is permissible with written authorization and provided it is directed by a US public health authority.

GLBA

The Gramm-Leach-Bliley Act (GLBA) governs how institutions handle student financial records and associated PII. There are two components to the GLBA: the Privacy Rule and the Safeguards Rule. The provisions of the privacy rule are similar to FERPA. If an institution is found compliant with FERPA, they are deemed to be in compliance with GLBA’s Privacy Rule as well.

  The Safeguards Rule holds institutions responsible for implementing sound measures to keep student data secure from cyberattack. It also makes institutions responsible for ensuring that their affiliates and service providers have the necessary safeguards in place to protect student data. GBLA requires institutions to:

• Have a written information security policy
• Designate the employee or employees responsible for coordinating and implanting the program
• Perform a risk assessment
• Design and implement information safeguards to mitigate the risks
• Select service providers that are capable of maintaining appropriate safeguards
• Periodically evaluate and update its security program

Federal Student Aid (FSA) requires compliance with GLBA be audited as part of the mandated annual audit. For more information consult the FSA cybersecurity compliance webpage.

PCI DSS

The Payment Card Industry’s Data Security Standard (PCI DSS) requires colleges and universities to encrypt cardholder data and protect networks from costly data breaches. When the pandemic caused students and employees work from home, under potentially less secure conditions, the Security Standards Council took steps to help institutions. The council publishes a reference guide and maintains a webpage for pandemic related updates online.

Other Privacy Laws

  All 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have data breach notification laws making it mandatory that entities notify individuals whose PII has been compromised. California's privacy law (CCPA) is perhaps the strictest and although most institutions are probably exempt, they may still be required to comply if their ed tech vendors are required to comply.

In fact institutions may be required to comply with the laws of several states as well as the European Union's General Data Protection Regulation (GDPR). As data breaches have escalated at colleges and universities, the maze of regulations has grown more complex. While compliance cannot guarantee a breach won't occur, it can protect an institution from fines and penalties.

More information on compliance with privacy laws can be found online. The following resources may be helpful.

• EDUCAUSE: The Post-Pandemic Evolution of Student Data Privacy
• DOE: FAQs on Photos and Videos under FERPA
• DOE: When is a photo or video of a student an education record under FERPA?
• DOE: FERPA and Virtual Learning Related Resource
• DOE: FERPA and COVID-19
• PCI SSC: Coronavirus Updates
• Chronicle of Higher Education: Sarbanes-Oxley Could Save Colleges From Themselves
• Chronicle of Higher Education: Sarbanes-Oxley and College Accountability
• EDUCAUSE: Webinar | How to Prepare for and Ace Your GLBA Audit
• EDUCAUSE: Higher Education Community Vendor Assessment Toolkit
• University Business: Securing Transactions and Managing PCI Compliance in a COVID-19 World
• University Business: Understanding and Complying With EMV Payment Card Standards
• University Business: Cyber insurance checklist: 4 ways to avoid missteps in purchasing
• University Business: Digital payments from the provider perspective
• CFO: The CFO’s Role in Cyber Security