FERPA & HIPAA Laws

The Family Educational Rights and Privacy Act (FERPA)

FERPA is a federal law that protects the privacy of student education records. This law applies to all schools receiving funds from the U.S. Department of Education. That means schools typically covered under FERPA are:

• most public schools and school districts; most are private
• most public postsecondary institutions including medical and professional schools

Schools not typically covered under FERPA include any private and religious elementary and secondary level schools who do not receive federal funds.

FERPA requires the written consent of a parent or an eligible student (18 years old OR attends a postsecondary institution at any age) prior to the disclosure of education records, or release of personally identifiable information from the records. Education records are records that are:

• Directly related to a student
• Maintained by an educational agency or institution or by a party acting for the agency or institution
• At the elementary or secondary school level, health records (including immunization records) are considered education records

Information covered under FERPA can be shared without prior consent from the parent or eligible student in some scenarios, including:

• When released to school officials who are determined to have a "legitimate educational interest" in the information. However, the school must have identified who those people are (administrators, teachers, coaches, etc.) and inform the parent of the people who might have access to the information.
• To schools in which the student seeks or intends to enroll
• In connection with financial aid for which the student has applied or which the student has received
• For postsecondary institutions
• For health or safety emergency
• To comply with a judicial order or a lawfully issued subpoena

The Health Insurance Portability and Accountability Act (HIPAA)

HIPAA sets standards for protection and sharing of individually identifiable health information, often referred to as protected health information (PHI). It includes the Privacy and Security Rules, and the Transactions and Code Sets. The Privacy Rule establishes guidance on how health care providers must protect patient information and outlines certain patient rights. The Security Rule identifies protections for protected health information stored electronically.

When HIPAA applies:

• Health care services are provided to students AND you're filing a claim for payment electronically. In this case, the records are still education records and are not covered under the Privacy or Security rules, but the filing of the claim must abide by the rules for Transactions and Code Sets.
• The school is private and not receiving any federal funding AND they bill electronicially to be reimbursed. In this case, all the HIPAA rules apply. HIPAA does not apply if electronic billing does not take place.
• Student receives health services in a hospital affiliated with a university subject to FERPA. The hospital records would fall under HIPAA for protection and access.
  • Exception: If the hospital runs a health clinic for students on behalf of the university, and there's no filing of claims, the records would fall under "education" or "treatment records", both covered by FERPA.
• An institution is a covered entity providing healthcare services to non-students such as staff members, spouses of students, and the public, HIPAA Privacy and Security rules apply to the protection and access of these records