6.6 Confidentiality, Privacy, and Ethical Communication About Students

Who May Know What

Special educators handle the most sensitive information a school holds: diagnoses, psychological findings, medication, family circumstances, and behavior histories. Two federal frameworks and one state act govern its use — FERPA and IDEA's confidentiality provisions, and the Illinois School Student Records Act — and the working rules reduce to a small set of questions.

Legitimate Educational Interest

School officials may access personally identifiable information without parental consent when they have a legitimate educational interest: they need the information to carry out their responsibilities for that student. The test is functional, not positional.

• The student's general education teacher, case manager, related service providers, paraprofessionals assigned to the student, the nurse, and administrators responsible for the student ordinarily qualify.
• A teacher who does not serve the student, an office staff member, a coach with no assigned responsibility, and a colleague who is simply curious do not.
• Access must also be limited to what the person needs. A bus driver needs the seizure protocol, not the psychological evaluation.

Paraprofessionals are the group most often mishandled in both directions. They are frequently given no information at all, which makes them unable to implement the plan safely, or given the entire file. The correct practice is to provide exactly what implementation requires — the behavior plan, the accommodations, the medical protocol, the communication system — and to train them explicitly on the confidentiality obligation that comes with it.

Consent for Outside Disclosure

Disclosure of personally identifiable information to anyone outside the district generally requires prior written parental consent (or the consent of the adult student once rights have transferred at 18). This has a specific transition consequence the framework tests: before inviting a representative of an outside agency such as the Division of Rehabilitation Services to an IEP meeting where transition services will be discussed, the district must obtain written consent from the parent or the adult student.

Disclosures permitted without consent are narrow and should be treated as exceptions: other school officials with a legitimate educational interest; a school in which the student seeks or intends to enroll; a health or safety emergency; a lawful court order or subpoena; and specified audit or evaluation purposes.

Rights Transfer at 18

When educational rights transfer at the age of majority, the student becomes the person who consents to disclosure. Continuing to share information with parents by habit after that date is a violation unless the student consents, a guardianship or educational power of attorney is in place, or the district has appropriately documented an alternative under state law. Plan for this in advance rather than discovering it at the first meeting after a birthday.

Confidentiality in Daily Practice and Its Limits

Where Breaches Actually Happen

Almost no confidentiality violation involves handing a file to a stranger. They happen in ordinary moments:

• Hallways, staff lounges, and parking lots. Discussing a student where others can hear. The single most common breach.
• Unattended screens and paper. An IEP on a projected screen while the class enters; a data sheet on a clipboard left on a table; a grade portal open at a parent conference.
• Email and messaging. Reply-all threads that add recipients without a legitimate educational interest; student names and diagnoses in unencrypted email; text messages to a personal phone.
• Classroom displays. Charts showing which students go to which service, color-coded reading groups keyed to disability, a posted list of testing accommodations.
• Meetings. Discussing another student to make a point about the student under discussion.
• Social media. Any identifiable reference, including a de-identified anecdote that colleagues or community members can decode.
• Well-meant explanations to peers. "He has autism, so we have to be patient" discloses a diagnosis without consent. Explain the support, not the diagnosis: "Everyone gets what they need to do their best work."

Talking About Disability with Colleagues and the Community

Objective 0010 requires ethical practices for communicating about the characteristics and needs of students with disabilities, and Objective 0011 requires the same for providing information to parents, guardians, surrogates, and community members. Practical standards:

• Use person-first or identity-first language according to the individual's or family's stated preference, and default to person-first in professional documents when preference is unknown.
• Describe function, not labels. A general education teacher needs to know that the student requires directions in no more than two steps with a visual, not that the student has an intellectual disability with a specific IQ.
• Never disclose a diagnosis to a community partner, employer, or job site without written consent, and involve the student in that decision when transition-age. Disclosure at a job site should be the student's choice, framed as a self-advocacy skill, and limited to the accommodation needed.
• Keep evaluative and speculative statements out of writing that will circulate. Record what was observed and what was done.
• Interpreters are bound by confidentiality too, which is one reason a family member or another student must never be used as an interpreter.

When Confidentiality Yields

Confidentiality is a strong default, not an absolute.

• Mandated reporting. Under the Illinois Abused and Neglected Child Reporting Act (325 ILCS 5), school personnel are mandated reporters. A staff member with reasonable cause to believe a child known to them in their professional capacity may be abused or neglected must report immediately to the DCFS hotline. The duty is personal and non-delegable — telling a principal or a social worker does not discharge it — and reporting does not require proof, certainty, or permission. Illinois also requires mandated reporters to complete training and to acknowledge the duty in writing.
• Health or safety emergencies. Disclosure to appropriate parties, including emergency responders, is permitted when the information is necessary to protect the health or safety of the student or others. Document what was disclosed, to whom, and why.
• Threats of harm. Where a student presents a credible threat to self or others, the safety obligation takes priority; follow the district's threat assessment and suicide risk protocols, which include notifying parents and appropriate personnel.
• Court orders and subpoenas. Comply, and notify the parent in advance unless the order forbids it.

Confidentiality Is Also an Instructional Issue

Students watch how adults handle information about them. A student who hears their diagnosis discussed in a hallway learns that their information is not safe, which undermines self-disclosure, self-advocacy, and the willingness to ask for help — the exact skills the transition curriculum is trying to build.