The University of Alabama is reportedly threatening faculty that any mention of the COVID situation on campus, even "two students in my class tested positive", constitutes a HIPAA violation. I am not an expert at all, but this strikes me as absolute bullshit.... https://twitter.com/emrysdo/status/1299742376022487047

HIPAA regulations pertain only to "covered entities", which have a very precise, narrow definition (shown below). I cannot see how a university would fall under this definition.

I am happy to be corrected by those with more expertise.

https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html

But universities offer student health services, you might object. Wouldn't that put them at risk?

For this sort of thing, it appears not.

https://www.hhs.gov/hipaa/for-professionals/faq/518/does-ferpa-or-hipaa-apply-to-records-on-students-at-health-clinics/index.html

Well is this a FERPA violation then?

Again, I'm not an expert, but I can't see how. FERPA forbids the improper disclosure of personally identifiable information from educational records to a third party.

https://www2.ed.gov/policy/gen/guid/fpco/ferpa/students.html

My non-lawyerly understanding is that I can freely disclose summary statistics about my course, such as the mean grade point average or even the grade point distribution, because these are not personally identifiable information. "Two students tested positive" should be the same.

My read is that if this email is authentic, it's vacuous bullshit designed for public relations effect, based on a groundless premise.

Which of course brings us back to the UA's reopening plan that started all of this.

Finally, I can't see any material difference between a teacher posting "two students in my class tested positive" and an administrator posting "twelve hundred and one students in my college tested positive". Screenshot below from the UA Covid Dashboard. https://www2.ed.gov/policy/gen/guid/fpco/ferpa/students.html