The U.S. Department of Education has issued new guidance for schools and postsecondary educational institutions reminding them of their obligations under the Family Educational Rights and Privacy Act (FERPA) to protect student privacy, emphasizing the importance of keeping student health records private. Guidance has also been issued for parents, legal guardians, and students over 18 years of age on their rights under FERPA (Know Your Rights) with respect to student health records.
FERPA was enacted to protect the privacy of student records and give parents rights over their children’s educational records. FERPA applies to educational agencies such as school districts, educational institutions (including public elementary and secondary schools), and postsecondary educational institutions (including colleges or universities) that receive funding under any program administered by the U.S. Department of Education.
The guidance for FERPA-covered educational institutions reminds them that parents and eligible students have the right to exercise some control over the disclosure of personally identifiable information in student educational records and confirms FERPA prohibits disclosures of educational records unless a parent or eligible student provides written consent or the disclosure is covered by an exception to FERPA’s general consent requirements.
The Department of Education has reminded FERPA-covered educational institutions that FERPA’s definition of educational records includes the health records of eligible students that are maintained by FERPA-covered educational institutions or their agents unless the health records qualify as treatment records. Health records qualify as treatment records if they relate to an eligible student (over 18 years of age at a postsecondary educational institution) and are “made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional or paraprofessional capacity or assisting in that capacity; made, maintained, or used only in connection with providing treatment to the eligible student; and disclosed only to the persons providing such treatment, except that the eligible student may have those records reviewed by a physician or other appropriate professional of the student’s choice.”
If an eligible student’s treatment records are disclosed for any purposes other than those described above – providing the eligible student with treatment or for personal review by a physician or appropriate professional of the eligible student’s choice – the records are classed as educational records and are therefore covered by FERPA, and are not classed as protected health information subject to the HIPAA Rules.
The guidance stresses that eligible students’ health-related records that are created, maintained, or used for non-treatment purposes are classed as educational records. For example, when they are used for medical forms and questionnaires to screen for eligibility to participate in school-sponsored athletics. Treatment records are also classed as educational records – and are therefore subject to FERPA’s restrictions on disclosures – if they are used for the treatment of students under 18 years of age who are attending an elementary or secondary school.
The guidance confirms that disclosures of student educational records (including certain health records) are only permitted by FERPA with the prior written consent of an eligible student or the student’s parent/legal guardian (non-eligible student) or if one of the permissive exceptions to the general consent requirement applies. When an exception applies, FERPA permits – but does not require – the disclosure. If the decision is taken to disclose student information the disclosure should be restricted to the minimum necessary amount of information to satisfy the intended purpose of the disclosure.
The guidance also clarifies when health records are covered by FERPA or HIPAA. FERPA applies to student health records that are maintained by campus health clinics and other health care facilities operated by such institutions, as they qualify as educational records or treatment records under FERPA, and as such are excluded from coverage under the HIPAA Privacy Rule. If an institution of postsecondary education is a HIPAA-covered entity that provides healthcare to nonstudents, the nonstudent data is protected health information subject to the HIPAA Privacy Rule and the student health records are educational or treatment records that are subject to FERPA.
The post DoE Issues New Guidance on FERPA and Student Health Records appeared first on HIPAA Journal.