Is it an invasion of privacy to publish a photograph of a student giving blood at a school-sponsored blood drive?

FERPA is a federal law that protects the privacy of student education records and medical records. It’s the reason why any random person can’t call a school and ask, "Is Billy up to date on his vaccinations? Ito make sure my daughter isn't going to school with someone unvaccinated," “Does Billy have algebra today?” or even “Does Billy go to school here?” and get an answer. It was specifically created to: (1) give parents and students the right to access student records and (2) to protect student privacy from unauthorized third parties. FERPA applies to all educational agencies. This includes everything from kindergarten to graduate school. It also applies regardless of whether a school is public OR private. 

As members of their school newspaper, student journalists are NOT agents of their school. As groundbreaking as the stories may be, the duties students journalists have don’t rise to the level of state action. This means student journalists are not bound by the privacy rules of FERPA because they have never had the duty to keep this information private. And let’s be real, it’s not like they are getting the information from school records—chances are they either (a) asked the student for their name or (b) they already knew it. School is only SO big, y’know? 

Okay but what if FERPA does Apply? What then? 

Alright, we get it, you want to be cautious. We love a good hypothetical around here, so we’ll bite. So, we’ve established that FERPA protects educational records. Educational records are files, documents, and other things that contain information directly related to a student and are maintained by an educational agency or institution (i.e., your school). FERPA specifically prohibits the disclosure of educational records with “personally identifiable information.” So the question you’re really wondering is whether these photos count as documents “directly related” to students and whether the photos are personally identifiable information. 

Let’s break things down. Personally identifiable information includes a student’s name, the name of their family members or parents, addresses, social security number, birthdays, faces (as opposed to just an arm), and other information that can be linked to a student. 

Here is where photos can fall under FERPA’s protection. If the photos qualify as personally identifiable information, they may qualify as information directly related to a student and can therefore be an educational record (in this case, a medical record retained by the school). 

BUT WAIT. All hope is not lost yet. We mentioned before that educational records must be maintained by an educational agency or institution. Now “maintained” doesn’t have any special, sneaky legal meaning. It means what you think it does: “preserve” or “retain.” Essentially, FERPA records need to be kept in a secure cabinet or database. So if photos of students participating in school activities, like a blood drive, are kept private and stored in a secure cabinet or database by the school, THEN they would be educational records under FERPA. If they are not maintained this way, then there’s a good chance they do not constitute educational records under FERPA. 

Okay, what about HIPAA? And does that apply here? 

Don’t worry too much about HIPAA in this situation. HIPAA, or the Health Insurance Portability and Accountability Act, is there to prevent the privacy of medical information, among other things. The Privacy Rule, which is the specific rule within HIPAA that deals with the protection of medical information, states that any medical record that would be exempt from FERPA’s educational record status is also exempt from HIPAA’s coverage. Either way, HIPAA’s standards and requirements only apply to (1) health plans, (2) health clearinghouses, and (3) health care providers that transmit health information in electronic form. Guess what it doesn’t apply to by those standards? You’re right—a photograph of a student giving blood at a school-sponsored blood drive.  

The Best Policy: Asking

For the purposes of privacy law, asking someone for their consent to take a photo of them for an article is an absolute defense against an invasion of privacy claim. If the student is 18 or older, their consent is fine. If the student is not yet 18, ask their parents or guardians. This consent is “A positive” way of making sure you, your publication, and the student are protected under the law!