U.S. Department of Education Issues New FERPA Guidance on Student Health Records

In an effort to remind school officials of their obligations to protect student privacy, the U.S. Department of Education (ED) has issued guidance on the Family Educational Rights and Privacy Act (FERPA) that focuses on the protection of student health records.

FERPA protects the privacy of student "education records" and applies to educational agencies and institutions that receive funds from programs administered by ED. The term "education records" is defined broadly to include (with some limited exceptions) records that are directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of the agency or institution.

A student's health-related records that are maintained by campus or school health clinics or other healthcare facilities operated by such institutions, under certain circumstances, may meet this definition and qualify as "education records" subject to FERPA rather than qualify as protected health information (PHI) that is subject to the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA).

Updated Student Health Record FERPA Guidance for School Officials

In its new guidance, ED reinforces the critical distinction between "education records" and "treatment records." Records qualify as "treatment records" if they are "records on an eligible student (i.e., a student who is at least 18 years old or who is attending a postsecondary institution at any age) that are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional or paraprofessional capacity or assisting in that capacity; made, maintained, or used only in connection with providing treatment to the eligible student; and disclosed only to the persons providing such treatment." If, however, a school discloses an eligible student's treatment records for any other purpose – including for non-treatment purposes (such as medical forms or questionnaires used to screen for eligibility in school-sponsored athletics) – the records are considered "education records" under FERPA, and school officials would need to comply with FERPA's general limitations on disclosure. This is so even if the educational institution is a HIPAA-covered entity. By contrast, if the institution is a HIPAA-covered entity and provides health-related services to non-students, the PHI of the institution's non-student patients is subject to HIPAA, not FERPA. Similarly, if an educational institution is a HIPAA-covered entity and provides health-related services to students but does not receive funds from ED and thus is not subject to FERPA, that entity may be required to comply with the HIPAA Privacy Rule.

Furthermore, ED provides that FERPA typically does not apply to information that school officials obtain through their own personal knowledge or independent observation, even if that information is also contained in an education record. For example, if a teacher overhears a student making threatening remarks to other students, FERPA would not prohibit the disclosure of what the teacher overheard to appropriate authorities, including local law enforcement officials, school officials and parents. FERPA does apply, on the other hand, to school officials' personal knowledge or independent observation of a student if the school official, in their official capacity, uses the knowledge or observation in a manner that produces an education record. For example, ED notes that if a high school principal sees a student violating a school rule and takes disciplinary action on the basis of this observation and, as a result, the school generates and maintains a disciplinary record about that disciplinary action (i.e., an education record), the principal's personal observations that are directly related to the student would be covered under FERPA.

Generally, education records, including certain health records, may be disclosed only:

1. with the prior written consent of the eligible student or the student's parent (if the student is not an eligible student) or
2. when one of FERPA's permissive exceptions to the general consent requirement applies

Permissive exceptions, which allow but do not require a school to disclose personally identifiable information (PII) from student education records without consent, include the following:

1. disclosure to parents of eligible students if the student is a dependent
2. disclosure to school officials, including teachers, within the school if the school has determined the school official has a "legitimate educational interest" in the PII
3. disclosure to appropriate parties in connection with an emergency, if knowledge of the PII is necessary to protect the health or safety of the student or others
4. disclosure pursuant to judicial order or a lawfully issued subpoena

Ultimately, whenever a school chooses to disclose PII from a student's education records without consent, the school should consider the impact of such disclosure and should disclose only the minimum amount of PII necessary for the intended purpose and adhere to permissible exceptions and required processes (such as, for example, providing prior notice where required under FERPA). When making decisions involving student health records, ED recommends that schools give great weight to each student's reasonable expectation that their health records will not generally be disclosed, or will be disclosed only in the rarest of circumstances and only to further important purposes, such as ensuring campus or school safety.

New Know-Your-Rights Resource: Parents and Eligible Students

ED also has developed a compact know-your-rights resource that provides parents and eligible students with an overview of FERPA rights with an emphasis on student health records.

The new "know-your-rights" resource explains that parents or eligible students have the right to exercise a certain degree of control over a school's disclosure of PII from the student's education records and places a particular emphasis on clarifying that a student's health records are generally not protected by the HIPAA Privacy Rule unless the records do not qualify as either an "education record" or "treatment record" under FERPA.

Takeaway

These guidance documents serve as a reminder to school officials of their obligations under FERPA and the importance of student privacy. School officials must, with certain exceptions, obtain written consent from eligible students or parents before disclosing PII from student educational records, which may include student health information.

For more information about FERPA or student privacy issues at schools, colleges and universities, please contact the authors or other members of Holland & Knight's Education Team.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.