Feds issue HIPAA and FERPA FAQs on student records

The U.S. Department of Health and Human Services (HHS) and the U.S. Department of Education (ED) have issued a joint guidance on the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to student health records. The purpose of this guidance is to explain the relationship between FERPA and HIPAA Privacy Rule and to address apparent confusion on the part of school administrators, health care professionals, and others as to how these two laws apply to records maintained on students. The guidance also addresses certain disclosures that are allowed without consent or authorization under both laws, especially those related to health and safety emergency situations. This latest guidance follows the promulgation of new FERPA regulations, the finalization of which is expected soon, and ED’s October 2007 release of guidance intended to address confusion over privacy rules that was a focus of the investigation of the April 2007 shootings at Virginia Tech University. Details on those two measures are at the second links below.

Among other things, the new guidance notes that the HIPAA Privacy Rule generally does not apply to elementary or secondary schools, either because the school is not a “covered entity” under HIPAA or because the only health records maintained by such school are “education records” or “treatment records” of eligible students under FERPA, both of which are excluded from coverage under the HIPAA Privacy Rule. The exception for records covered by FERPA applies both to the HIPAA Privacy Rule, as well as to the HIPAA Security Rule, because the Security Rule applies to a subset of information covered by the Privacy Rule, electronic protected health information. The guidance, in question-and-answer format, also addresses a variety of disclosures of student records by schools and by post-secondary institutions under HIPAA and FERPA.

HHS/ED FERPA-HIPAA joint guidance
NSBA School Law pages on proposed FERPA regulations