HIPAA and FERPA…Did You Know?

In December 2019, the U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services updated their Joint Guidance on the Application of FERPA and HIPAA to Student Health Records. This guide was first issued in 2008 and the purpose of this guide is to clarify how FERPA and HIPAA apply to the maintenance of students’ education and health records. The guide also provides some interesting FAQ’s and scenarios that may occur in relation to personally identifiable information (PII) under FERPA and protected health information (PHI) under HIPAA.

This guide does a great job of explaining the basic rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule and the Family Educational Rights and Privacy Act (FERPA). If, like me, you need a review of these two important Acts, this is a great place to start.

For example, were you aware that FERPA only applies to educational agencies and institutions that receive Federal funds under a program administered by the U.S. Department of Education? Private and religious schools at the elementary and secondary levels generally do not receive funds from the U.S. Department of Education and are, therefore, not subject to FERPA. FERPA’s term “educational agency or institution” refers to public elementary and secondary schools, school districts but also includes postsecondary institutions.

Did you know that “many schools that meet the definition of a HIPAA covered entity do not have to comply with the requirements of the HIPAA Rules because the school’s only health records are considered “education records” or “treatment records” under FERPA.” The guide also states that HIPAA specifically excludes FERPA protected records from the definition of “protected health information” under the HIPAA privacy rule.

FERPA also considers an “eligible student” as a student who has reached 18 years of age or is attending and institution of postsecondary education. By making this distinction, this can limit parent’s access to PII from the student’s educational records. However, did you know that “Schools may release PII from an eligible student’s education records to his or her parents, without the consent of the eligible student, if the student is claimed as a dependent for tax purposes under section 152 of the Internal Revenue Code.”

FERPA also does not prohibit a school official from sharing information with parents that is based on that school official’s personal knowledge or observation and that is not based on information in the student’s education record. In other words, a teacher is not prohibited from sharing a concern about the child to his/her parents based on their personal knowledge or observation of that student.

You can also get general or routine questions about FERPA by emailing the U.S. Department of Education at FERPA@ed.gov. As with all information, this is meant to be an overview of interesting facts about HIPAA and FERPA and their application within a public-school setting. This blog is not meant to be a substitute for or be presented as legal advice.

The full guide can be found at:
Joint Guidance on the Application of FERPA and HIPAA to Student Health Records