THE U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services released updated joint guidance on Dec. 19 addressing the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to records maintained on students.
The guidance, which was first issued in November 2008, clarifies for school administrators, health care professionals, families, and others how FERPA and HIPAA apply to education and health records maintained about students. The revised guidance includes additional frequently asked questions and answers addressing when a student’s health information can be shared without the written consent of the parent or eligible student under FERPA, or without written authorization under the HIPAA Privacy Rule. New clarifications and examples address:
• When can protected health information (PHI) or personally identifiable information from an education record (PII) be shared with the parent of an adult student?
• What options do family members of an adult student have under HIPAA if they are concerned about the student’s mental health and the student does not agree to disclosures of their PHI?
• Does HIPAA allow a covered health care provider to disclose PHI about a minor with a mental health condition or substance use disorder to the minor’s parents?
When can PHI or PII be shared about a student who presents a danger to self or others?
• Under FERPA, can an educational agency or institution disclose, without prior written consent, PII from a student’s education records, including health records, to the educational agency’s or institution’s law enforcement officials?
• Does FERPA permit an educational agency or institution to disclose, without prior written consent, PII from a student’s education records to the National Instant Criminal Background Check System (NICS)?
“Confusion on when records can be shared should not stand in the way of protecting students while they are in school,” said U.S. Secretary of Education Betsy DeVos. “This update will provide much-needed clarity and help ensure that students get the assistance they need, and school leaders have the information they need to keep students safe.”
“The Trump Administration has made it a priority to help Americans with substance use disorder or serious mental illness, and their families, and this resource takes another meaningful step by clarifying how students’ health information can be shared with those in the best position to help them,” said U.S. Secretary of Health and Human Services Alex Azar. “This updated resource empowers school officials, health care providers, and mental health professionals by dispelling the myth that HIPAA prohibits the sharing of health information in emergencies,” said OCR Director Roger Severino.
The U.S. Departments of Education and Health and Human Services are committed to ensuring the health and safety of our nation’s students, schools, and communities. This comprehensive guidance document contributes to this important effort by improving the public’s understanding of how FERPA and HIPAA apply to students’ health and educational information and when regulated entities can disclose such information, especially in connection with health and safety emergency situations.
The joint guidance may be viewed at: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/index.html and https://studentprivacy.ed.gov/resources/joint-guidance-application-ferpa-and-hipaa-student-health-records.
