Untitled Texas Attorney General Opinion

OFFICE OF THE ATTORNEY GENERAL . STATE OF TEXAS

JOHN CORNYN

October 11,2002

The Honorable Jane Nelson Opinion No. JC-056 1

Chair, Committee on Nominations

Texas State Senate Re: Whether the Texas Interagency Council on

P.O. Box 12068 Early Childhood Intervention is authorized to

Austin, Texas 78711 require local service providers to collect and

submit to the Council personally identifiable

information regarding children and their families,

and related questions (RQ-0535JC)

Dear Senator Nelson:

You ask whether the Texas Interagency Council on Early Childhood Intervention (the

“Council”) is authorized to require by contract that local service providers collect and submit certain

information to the Council. It is not clear from your request whether the information at issue pertains

only to children and families served by the Council and local service providers or whether you are

also concerned about other kinds of information. Given the complexity of federal law governing the

Council and local service providers, we limit our analysis in this opinion to information about

children and their families. We conclude that the Council is authorized by state and federal law to

require local service providers to submit information about children and their families for the

purpose of evaluating federally and state funded programs, but that the Council may not redisclose

the information except in compliance with federal law.

Subchapter III of the federal Individuals with Disabilities Education Act, 20 U.S .C. $4 1400-

1487 (2000) (“IDEA”), as amended in 1997, see Pub. L. No. 105-17, 11 1 Stat. 37, establishes a

federal program pursuant to which the United States provides financial assistance to states to develop

a statewide system to provide early intervention services to infants and toddlers under three years

of age, see 20 U.S.C. @j 1431-1445 (2000). This portion of the IDEA is commonly referred to as

Part C, see Pub. L. No. 105-17, 111 Stat. 37, and is distinct from Part B, which addresses services

for children three years of age and older. Both Part C of the IDEA and the federal rules promulgated

under Part C, see 34 C.F.R. pt. 303 (2002) (“Early Intervention Program for Infants and Toddlers

with Disabilities”), require each state to have a “lead agency” designated by the governor in order

to be eligible for federal funding. See 20 U.S.C. $4 1434,1435(a)(lO) (2000); 34 C.F.R. 8 303.142

(2002).

Under Texas law, the Council is “the lead agency designated by the governor” under the

IDEA “for the administration, supervision, and monitoring of a statewide comprehensive system of

early intervention services.” TEX. HUM. REs. CODE ANN. 5 73.005 1(a) (Vernon 2001). The purpose

The Honorable Jane Nelson - Page 2 (JC-0561)

of these services is to ensure that infants and toddlers who have developmental needs or who are at

risk for developmental delay “receive services that are provided in partnership with their families

and in the context of their local community.” Id. The Council is responsible for seeking evaluation

of each child referred for services and for referring the child to a program that can meet the child’s

needs. See id. 8 73.009. The Council is authorized to select providers of services, see id. $73.011,

and to enter into, administer, and monitor contracts with providers “for programs and projects

authorized under this chapter,” id. 5 73.005 1(c). We will refer to these providers as “local service

providers,” a term used in the federal rules. See, e.g., 34 C.F.R. 5 303.5(b)(3) (2002).

The Council has recently inserted terms into its contracts with local service providers that

require them to collect and submit to the Council information about the children and families they

serve. You ask what legal authority allows the Council “to contractually demand that” local service

providers “collect and disclose such individually identifiable information to the agency.“’ We

conclude that chapter 73 of the Human Resources Code authorizes the Council to require service

providers to collect and submit information to the Council. In addition, Part C of the IDEA and the

federal rules applicable to the information permit local service providers to transfer information

about children to the Council.

“[A] state administrative agency has only those powers that the Legislature expressly confers

upon it. But an agency may also have implied powers that are reasonably necessary to carry out the

express responsibilities given to it by the Legislature.” Pub. Util. Comm 31 v. City Pub. Sew. Bd.,

53 S.W.3d 310, 315 (Tex. 2001). Although no provision in chapter 73 of the Human Resources

Code expressly authorizes the Council to require local service providers to submit information about

children and families receiving services funded by the Council, this authority may be implied from

the Council’s express statutory duties.

First, as we have noted, the Council is authorized by section 73.005 1(c) of the Human

Resources Code to “enter into, administer, and monitor contracts with providers.” TEX.HUM. RES.

CODE ANN. 5 73.005 1(c) (Vernon 2001). Section 73.011 requires the Council to select providers

that will provide the best value, taking into account such factors as past performance and the quality

and cost of the provider’s services. See id. 8 73.01 l(a), (c). These provisions authorize the Council

to require a local service provider to collect and submit to the Council information that will allow

the Council to monitor the contract and to assess the provider’s performance.

The federal rules under Part C of the IDEA require a statewide system to include a process

for collecting data from agencies and service providers in the state. See 34 C.F.R. 5 303.540 (2002).

Section 73.005 1(k) of the Human Resources Code requires the Council to “select an appropriate

automated system . . . to plan, manage, and maintain records of client services.” TEX. HUM. RES.

CODE ANN. § 73.005 l(k) (Vernon 2001). This provision clearly authorizes the Council to require

local service providers to collect and submit information that will enable the Council to plan,

‘Letter from Honorable Jane Nelson, Chair, Committee on Nominations, Texas Senate, to Honorable John

Cornyn, Texas Attorney General, at 3 (Apr. 12, 2002) (on file with Opinion Committee) [hereinafter Request Letter].

The Honorable Jane Nelson - Page 3 (JC-0561)

manage, and maintain records of client services. The phrase “records of client services” suggests

the legislature intends the Council to maintain records regarding individual clients and the services

they receive. Section 73.005 l(k) impliedly authorizes the Council to require local providers to

submit information about children and families receiving services funded by the Council.

The IDEA does not prohibit but rather expressly contemplates that lead agencies, such as the

Council, may obtain personally identifiable information about the children and families to whom

they provide services. Under Part C of the IDEA, a statewide system must provide certain

procedural safeguards, including “[tlhe right to confidentiality of personally identifiable information,

including the right of parents to written notice of and written consent to the exchange of such

information among agencies consistent with Federal and State law.” 20 USC. 9 1439(a)(2) (2000).

A federal rule adopted under the authority of this provision requires each state to “adopt or develop

polices and procedures that the State will follow in order to ensure the protection of any personally

identifiable information collected, used, or maintained under this part.” 34 C.F.R. § 303.460(a)

(2002) (emphasis added). “Personally identifiable information” is defined by the applicable rules

to mean:

(1) The name of the child, the child’s parent, or other family

member;

(2) The address of the child;

(3) A personal identifier, such as the child’s or parent’s social

security number; or

(4) A list of personal characteristics or other information that

would make it possible to identify the child with reasonable certainty.

Id. 8 303.401(c).

Part C of the IDEA itself is silent with respect to whether local service providers may submit

personally identifiable information about children to lead agencies, but the Part C rules permit a

transfer of information from a local service provider to a lead agency by incorporating the rules for

disclosure of personally identifiable information in student records promulgated under the Family

Educational Rights and Privacy Act of 1974,20 U.S.C. 8 1232g (2000) (FERPA).

Part B of the IDEA expressly requires the United States Secretary of Education in 20 USC.

8 1417 to “take appropriate action” in accordance with FERPA, “to assure the protection of the

confidentiality of any personally identifiable data, information, and records collected or maintained

. . . by State and local educational agencies pursuant to the provisions” of Part B. See id. Q 1417(c).

Thus, Part B records are accorded the same protections as education records under FERPA. The

FERPA framework is an apt one for Part B records as Part B of the IDEA establishes a federal

program to assist states to provide special education and other services to children aged three and

older, generally in the context of public school systems. See id. 5 $ 1411- 14 19.

The Honorable Jane Nelson - Page 4 (JC-0561)

Section 1417 applies to programs authorized by Part C “to the extent not inconsistent with”

Part C. See id. 8 1442. In addition, the United States Department of Education has mandated that

states accord Part C records the same procedural safeguards accorded to Part B records, including

the FERPA protections. See 34 C.F.R. 8 303.460(b) note (2002) (“The part B provisions incorporate

by reference the regulations in 34 C.F.R. part 99 (Family Educational Rights and Privacy); therefore,

those regulations also apply to this part.“). As applied to Part C information, a reference in the Part

B rules to a “[sltate educational agency” means the “lead agency” and a reference to a

“[plarticipating agency” means a “local service provider.” Id. 8 303.5(b)(l), (3); see also 20 USC.

8 1442(l), (2) (2000). Thus, the framework for protecting confidentiality of student information

generally applicable to state educational agencies and schools for school age children has been

extended to lead agencies and local service providers for infants and toddlers.

The FERPA regulations permit a local education agency to disclose personally identifiable

student information to state educational authorities without parental consent subject to the

requirements of section 99.35 of the FERPA rules. See 34 C.F.R. 5 99.31(a)(3) (2002). Section

99.35(a) permits a state educational authority to “have access to education records in connection with

an audit or evaluation of Federal or State supported education programs.” Id. $ 99.35(a). This rule

would appear to authorize a local service provider to transfer personally identifiable information to

a lead agency, such as the Council, without parental consent for the purpose of monitoring contracts

with local service providers, which constitutes an evaluation of a federal or state supported program.

See generally Tex. Att’y Gen. Op. No. JC-0333 (2001) at 4-5 (noting that school districts disclose

personally identifiable student information to the Texas Education Agency without parental consent

for Public Education Information Management System).

In a related question, you ask what “consent must be obtained from which affected

individuals, and how often must the consent be obtained.” Request Letter, supra note 1, at 3. The

consent requirements of the FERPA regulations, 34 C.F.R. part 99, apply to Part C information. See

34 C.F.R. 8 303.404 note 1 (2002); see also id. 8 303.460 note (34 C.F.R. part 99 also applies to Part

C regulations). The Council’s rule on confidentiality and consent also refers to the FERPA rules.

See 25 TEX. ADMIN. CODE 5 621,43(12)(A) (2002).

Generally, under the FERPA rules, personally identifiable student information may not be

disclosed without parental consent. See 34 C.F.R. 5 99.30 (2002). However, as discussed above,

the FERPA regulations permit a local education agency to disclose personally identifiable student

information to state educational authorities without parental consent subject to the requirements of

section 99.35 of the FERPA rules, see id. 8 99.3 1(a)(3), “in connection with an audit or evaluation

of Federal or State supported education programs.” Id. 8 99.35(a). This rule authorizes a local

service provider to transfer personally identifiable information about a child to a lead agency, such

as the Council, without parental consent for the purpose of monitoring contracts with local service

providers, which constitutes an evaluation of a federal or state supported program.

Under section 99.35(b), information that is collected under section 99.35(a) must “[b]e

protected in a manner that does not permit personal identification of individuals by anyone except

the officials referred to in paragraph (a) of this section” and must “[b]e destroyed when no longer

The Honorable Jane Nelson - Page 5 (JC-0561)

needed for the purposes listed in paragraph (a).” Id. 8 99.35(b). These requirements do not apply

if the parent has given written consent for the disclosure or if the collection of personally identifiable

information is “specifically authorized” by federal law. Id. $ 99.35(c). Although the FERPA rules

clearly allow the transfer of personally identifiable information by local service providers to a lead

agency for certain purposes, see id. § 99.35(a), we are not aware of any federal law specifically

authorizing the Council to collect personally identifiable information. Thus, if there is no written

consent for the disclosure, the Council must adhere to the requirements of section 99.35(b) by

protecting the information “in a manner that does not permit personal identification of individuals”

except by Council officials and by destroying the information when it is no longer needed to monitor

contracts. See id. 8 99.35(b).

You also ask “what legal and procedural safeguards must the agency follow to reduce the

likelihood of any improper disclosure of the information.” Request Letter, supra note 1, at 3.

Importantly, any redisclosure of information by the Council must be permitted by FERPA. See 34

C.F.R. 5 99.33 (2002). In addition, Part C of the IDEA, see 20 USC. 5 1439(a)(2) (2000), and the

federal rules under Part C require each state to develop policies and procedures that the state will

follow to “ensure the protection of any personally identifiable information collected, used, or

maintained under this part, including the right of parents to written notice of and written consent to

the exchange of this information among agencies consistent with Federal and State law,” 34 C.F.R.

5 303.460(a) (2002). In addition, the Part C rules provide that such state policies and procedures

must also meet the requirements of rules setting forth procedural safeguards for confidentiality of

information in 34 C.F.R. sections 300.560 through 300.576 of the Part B rules, see id. 8 303.460(b).

The Part B rules applicable to Part C information establish a number of procedures and

protections. For example, they require the Council, as a lead agency, to give notice that is adequate

to fully inform parents about such matters as “the children on whom personally identifiable

information is maintained, the types of information sought, the methods the State intends to use in

gathering the information (including the sources from whom information is gathered), and the uses

to be made of the information”; “the policies and procedures that [local service providers] must

follow regarding storage, disclosure to third parties, retention, and destruction of personally

identifiable information”; and “the rights of parents and children regarding this information,

including the rights under the Family Educational Rights and Privacy Act of 1974 and implementing

regulations in 34 C.F.R. part 99.” Id. $300.561. In addition, the Council must provide “policies and

procedures, including sanctions, that the State uses to ensure that its policies and procedures are

followed and that the requirements of the Act and the regulations in this part are met.” Id. 8

300.575; see aZso 25 TEX. ADMIN. CODE Q 621.43 (2002) (Council’s rule on confidentiality).

You ask whether “any federal or state constitutional provisions or laws prohibit or limit the

scope” of the information that the Council may require local service providers to collect and submit

to the Council. Request Letter, supra note 1, at 3. Again, Part C of the IDEA appears to

contemplate that a lead agency may obtain personally identifiable information about children and

families from local service providers, and the Part C rules, by incorporating the FERPA rules, permit

a local service provider to transfer information to a lead agency without parental consent for the

purpose of auditing or evaluating a federal or state supported program. Under this FERPA

The Honorable Jane Nelson - Page 6 (JC-0561)

exception, the information collected must be information the lead agency will use to audit or evaluate

a program. In addition, we note that section 73.009 of the Human Resources Code provides that

“[slervices under this section shall be provided in a manner that minimizes intrusion into family

privacy.” TEX. HUM. RES. CODE ANN. Q 73.009(c) (Vernon 2001). While this limitation does not

prevent the Council from requiring providers to collect necessary information and from requiring

the submission of such information to the Council, the Council shall tailor its data collection to

minimize intrusion into family privacy. Finally, it has been suggested that the Public Information

Act, chapter 552 of the Texas Government Code, may limit the information the Council may obtain

from local service providers. That Act governs when information in the possession of a

governmental body must be publicly disclosed; it does not govern the scope of information that a

governmental body, such as the Council, may collect from the contractors it pays to provide services.

See TEX. GOV’T CODE ANN. $8 552.001-,353 (Vernon 1994 & Supp. 2002).

You ask what remedies affected individuals would have against the Council for any improper

disclosure of personally identifiable information by the Council. The Council has a procedure for

reviewing a complaint “alleging that a requirement of the [IDEA] or applicable federal and/or state

regulation[] has been violated.” 25 TEX.ADMIN. CODE $62 1.42 (2002). An individual who believes

that the Council has improperly disclosed personally identifiable information about his or her child

in violation of FERPA and the Part C rules could file a complaint with the Council under this

procedure. The Council’s procedure, however, does not provide any specific remedy for improper

disclosure of information. See id.

With respect to other state laws, information made confidential under FERPA is also

confidential under the Public Information Act. See TEX. GOV’T CODE ANN. $8 552.026 (Vernon

1994) (“This chapter does not require the release of information contained in education records of

an educational agency or institution, except in conformity with the Family Educational Rights and

Privacy Act of 1974, Sec. 513, Pub. L. No. 93-380,20 U.S.C. Sec. 1232g.“), ,101 (“Information is

excepted from the requirements of Section 552.02 1 if it is information considered to be confidential

by law, either constitutional, statutory, or by judicial decision.“); Tex. Att’y Gen. ORD-634 (1995)

(information that is protected by FERPA may be withheld as confidential information under section

552.101). The Public Information Act provides that a person commits official misconduct “if the

person distributes information considered confidential under the terms of this chapter,” an offense

punishable by a fine of not more than $1,000, up to six months of confinement, or both. TEX. GOV’T

CODE ANN. 5 552.352 (Vernon 1994).

The Public Information Act does not provide a civil remedy for the release of confidential

information. Although Texas courts recognize some common-law privacy torts,2 the Council, as a

state agency, is immune from suit except to the extent the state has waived its immunity. As a

2See Indus. Found. of the S. v. Tex. Indus. Accident Bd., 540 S.W.2d668,682 (Tex. 1976), cert. denied, 430

U.S. 931 (1977) (recognizing right to “freedom from public disclosure of embarrassing private facts”); Billings v.

Atkinson, 489 S.W.2d 858, 859-61 (Tex. 1973) (recognizing right to be free of intrusion into plaintiffs seclusion); see

also Cain v. Hearst Corp., 878 S.W.2d 577 (Tex. 1994) (declining to recognize the false light invasion of privacy

action).

The Honorable Jane Nelson - Page 7 (JC-0561)

general matter, “the state does not waive its immunity [under the Tort Claims Act] by using or

misusing information.” Axtell v. Univ. of Tex., 69 S.W.3d 261, 267 (Tex. App.-Austin 2002, no

pet.) (holding that student’s claim for harm caused by the disclosure of confidential information did

not state a cause of action under section 101.021(2) of the Tort Claims Act); see also City of

Beaumont v. Bouillion, 896 S.W.2d 143 (Tex. 1995) (holding that Texas recognizes neither an

implied private right of action nor a common-law cause of action for damages for violation of

constitutional rights).

With respect to remedies available under federal law, the Department of Education may deny

funding to a state program that fails to comply with the requirements of Part C of the IDEA. See 20

U.S.C. $5 14 16 (2000) (authorizing Secretary of Education to withhold funding upon a finding “that

there has been a failure by the State to comply substantially with any provision of this subchapter”

or “that there is a failure to comply with any condition of a local educational agency’s or State

agency’s eligibility under this subchapter”), 1434 (to be eligible for Part C grant, state must have “a

statewide system that meets the requirements of section 1435 of this title”), 1435(a)( 13) (requiring

statewide system to have “[plrocedural safeguards with respect to programs under this subchapter,

as required by section 1439 of this title”), 1439(a)(2) (minimum procedural safeguards include “[thee

right to confidentiality of personally identifiable information, including the right of parents to written

notice of and written consent to the exchange of such information among agencies consistent with

Federal and State law”), 1442 (providing that 20 U.S.C. 8 1416 applies to Part C of the IDEA); see

also 34 C.F.R. $9 300.580-,589 (2002) (Part B enforcement procedures); 303,5(a)(3) (specifically

incorporating 34 C.F.R. $5 300.580-,585 into Part C rules).

We have not located any case law addressing disclosure of personally identifiable

information collected under Part C of the IDEA. We have located a 1992 federal district court case

regarding the release of information subject to Part B of the IDEA. See Sean R. v. Bd. of Educ., 794

F. Supp. 467 (D. Conn. 1992). In that case, a local school board released to a newspaper the name

of a child and his parents. Ruling on the school board’s motion to dismiss, the court concluded that

the plaintiffs, the child and his parents, had a reasonable expectation of privacy under the IDEA and

its rules that was protected under the United States Constitution and therefore had a cause of action

under the fourteenth amendment and 42 USC. $1983. See Sean R., 794 F. Supp. at 469. The court

also held that the plaintiffs had a right of action under 42 USC. 8 1983 for violation of the IDEA.

See id. at 469-70. In the intervening years, however, the IDEA has been amended and there is a split

between the federal circuit courts regarding whether 42 U.S.C. Q 1983 may be used to redress

violations of the IDEA and the extent to which the states are immune from suit under the IDEA. See,

e.g., Padilla v. Sch. Dist. No. I, 233 F.3d 1268, 1272-74 (10th Cir. 2000) (describing circuit split

with respect to whether the IDEA may provide a basis for 42 USC. 8 1983 claims); Bradley v. Ark.

Dept. of Educ., 189 F.3d 745,750-52 (8th Cir. 1999) (discussing IDEA and sovereign immunity);

Marie 0. v. Edgar, 13 1 F.3d 610 (7th Cir. 1997) (upholding 42 U.S.C. $ 1983 action for declaratory

and injunctive relief against state for failing to provide services under predecessor to Part C of the

IDEA ); see also Allan G. Osborne, Jr., Ed-D., Can Section 1983 be Used to Redress Violations of

the IDEA?, 161 ED. LAW REP. 21 (March 2002).

The Honorable Jane Nelson - Page 8 (JC-0561)

FERPA provides that federal funding for education will not be made available to an

educational agency or institution that has a policy or practice of releasing “education records (or

personally identifiable information contained therein other than directory information . . . ) of

students without the written consent of their parents to any individual, agency, or organization, other

than” certain specified entities in certain limited circumstances. 20 U.S.C. 8 1232g(b)( 1) (2000);

see also 34 C.F.R. $8 99.63-.67 (2002). A parent may file a written complaint with the Department

of Education’s Family Policy Compliance Office regarding an alleged violation of FERPA and or

the FERPA regulations. See 34 C.F.R. 8 99.63 (2002). While the Fifth Circuit has concluded that

FERPA does not grant a private right of action, it has also held that an action under 42 U.S.C. 8 1983

may be premised on an alleged violation of FERPA rights. See Tarka v. Cunningham, 9 17 F.2d 890

(5th Cir. 1990). However, the United States Supreme Court recently held that FERPA’s

nondisclosure provisions create no personal rights enforceable under 42 U.S.C. § 1983. See

Gonzaga Univ. v. Doe, 122 S. Ct. 2268 (2002). Thus, a private party may not bring a 42 U.S.C. 8

1983 action for the improper release of records subject to Part C of the IDEA based on FERPA’s

nondisclosure provisions.

Finally, you ask what liability local service providers would have for improper disclosures

of personally identifiable information by the Council and what remedies local service providers

would have against the Council for improper disclosures of information. In the event a local service

provider transfers information to the Council about children and their families in accordance with

the Part C rules and the FERPA rules and pursuant to contractual requirements, we do not believe

that the local service provider could have any liability for any subsequent improper disclosure of

information by the Council. The Council, on the other hand, would risk losing its federal funding.

See 20U.S.C. $8 1232g(b)(l), 1416,1434,1435,1439,1442 (2000); 34 C.F.R. $Q 99.63-.67 (2002).

And, as we have noted, the Public Information Act applies to personally identifiable information in

the possession of the Council and provides that a person commits official misconduct “if the person

distributes information considered confidential under the terms of this chapter,” an offense

punishable by a fine of not more than $1,000, up to six months of confinement, or both. TEX. GOV’T

CODE ANN. 8 552.352 (Vernon 1994); see also id. $8 552.026 (“This chapter does not require the

release of information contained in education records of an educational agency or institution, except

in conformity with the Family Educational Rights and Privacy Act of 1974, Sec. 5 13, Pub. L. No.

93-380,20 U.S.C. Sec. 1232g.“), .lOl (“Information is excepted from the requirements of Section

552.021 if it is information considered to be confidential by law, either constitutional, statutory, or

by judicial decision.“).

The Honorable Jane Nelson - Page 9 (JC-0561)

SUMMARY

The Texas Interagency Council on Early Childhood

Intervention is authorized by state and federal law to require local

service providers to submit personally identifiable information about

children and their families for the purpose of evaluating federally and

state funded programs. The Council may not redisclose the

information except in compliance with federal law. In addition, the

Public Information Act applies to such information in the possession

of the Council and provides that a person commits official

misconduct “if the person distributes information considered

confidential under the terms of this chapter,” an offense punishable

by a fine of not more than $1,000, up to six months of confinement,

or both. TEX. GOV’T CODEANN. 8 552.352 (Vernon 1994); see also

id. $8 552.026 (“This chapter does not require the release of

information contained in education records of an educational agency

or institution, except in conformity with the Family Educational

Rights and Privacy Act of 1974, Sec. 5 13, Pub. L. No. 93-380, 20

U.S.C. Sec. 1232g.“), .lOl (“Information is excepted from the

requirements of Section 552.021 if it is information considered to be

confidential by law, either constitutional, statutory, or by judicial

decision.“).

Ve trul you ,

i)&C-

I

JOHN CORNYN

Attorney General of Texas

HOWARD G. BALDWIN, JR.

First Assistant Attorney General

NANCY FULLER

Deputy Attorney General - General Counsel

SUSAN DENMON GUSKY

Chair, Opinion Committee

Mary R. Crouter

Assistant Attorney General, Opinion Committee