HIPAA and FERPA Intersection: Understanding Educational Records and Healthcare Privacy

Understand the relationship between HIPAA and FERA

The intersection of healthcare privacy and educational records create a complex regulatory landscape for schools, universities, and healthcare providers. Two major federal laws govern these areas: the health insurance portability and accountability act (HIPAA) and the family educational rights and privacy act (FERA). A common question that arise is whether HIPAA exclude information consider education records under FERA.

The short answer is yes — HIPAA explicitly exclude education records that are cover by FERA from its privacy rule. Yet, understand the nuances of this relationship require deeper exploration of both laws and their specific applications.

What is FERA?

FERA is a federal law enact in 1974 that protect the privacy of student education records. It aappliesto all educational institutions that receive funds from theU.S.. department of education, which include most all public schools and most private schools and universities.

Under FERA, education records are ddefinedas records that:

• Contain information forthwith relate to a student
• Are maintained by an educational agency or institution or by a party act for the agency or institution

FERA grants parent certain rights regard their children’s education records. These rights transfer to the student when they reach the age of 18 or attend a school beyond the high school level. Students to whom the rights have transfer are rreferredto ” ” eligible students. ”

Key rights under FERA

FERA provide parents and eligible students with specific rights:

Source: dremilywhitehorse.com

• The right to inspect and review education records
• The right to request amendments to records they believe are inaccurate or misleading
• The right to consent to disclosures of personally identifiable information, except in certain circumstances
• The right to file a complaint with the U.S. department of education for alleged FERA violations

What’s HIPAA?

HIPAA, enact in 1996, is design to protect sensitive patient health information from being disclosed without consent. TheHIPAAa privacy rule specificallyregulatese the use and disclosure of protected health informatio(( ph)) hold by” cover entities ” nd their business associates.

Covered entities under HIPAA include:

• Healthcare providers who conduct certain healthcare transactions electronically
• Health plans
• Healthcare clearinghouse

Protected health information refer to separately identifiable health information that’s transmit or maintain in any form or medium by a cover entity or its business associates.

The HIPAA exclusion for FERA records

The HIPAA privacy rule explicitly excludes from its coverage those records that aredefinede ” ” education record” under FERA. This exclusion is ffoundin the definition of” protect health information ” n the hiHIPAAegulations at 45 cfCFR60.103, which state that protect health information exclude separately identifiable health information in:

” eEducationrecords cover by the family educational rights and privacy act, as amend, 20 u.s.c. 1232 g ”

This mean that health records maintain by an educational institution that receive federal funding and meet the definition of education records under FERA are not subject to the hHIPAAprivacy rule. Rather, these records are ggovernedbyFERAa’s privacy protections.

When health records are considered education records

Health records maintain by an educational agency or institution are typically considered education records undeFERApa if they:

• Direct relate to a student
• Are maintained by the educational institution or a party act for the institution

This includes records such as:

• Immunization records require for enrollment
• Health records maintain by a school nurse
• Records relate to disabilities and accommodations for students
• Mental health counseling records from a university’s counseling center
• Athletic health records maintain by the school

Treatment records exception under FERA

FERA include a specific exception for ” reatment records, “” ich are:

• Records on a student who’s 18 years or older, or attend a postsecondary institution
• Make or maintain by a physician, psychiatrist, psychologist, or other recognize professional or paraprofessional
• Make, maintain, or use solely in connection with treatment of the student
• Disclose solely to individuals provide the treatment

These treatment records are excluded from the definition of education records underFERAa. Notwithstanding, if these records are disclosed to anyone other than the treat professionals( include the student themselves), they become education records subject to fFERA

Significantly, these treatment records are to exclude from hHIPAAadenine recollective as they remain in this status. Once they’re ddisclosedfor purposes other than treatment, they become education records under FERA preferably than phi under hHIPAA

Campus health clinics: a special case

University health clinics present a peculiarly complex scenario. Whether HIPAA or FERA aapply to dependon several factors:

When FERA typically apply

• The clinic is fund, administer, and operate by the educational institution
• Records are solely available to treatment providers or use for treatment purposes
• Services are provided exclusively to students

When HIPAA may apply

• The clinic is a separate legal entity from the educational institution
• The clinic provide services to non students
• The clinic bills insurance electronically for its services (make it a hHIPAAcover entity )

Some campus health centers may be subject to both HIPAA and FERA for different records or functions. For example, a university hospital might maintain hHIPAAcover records for its general patient population while student treatment records might fall under fFERA

Practical implications of the HIPAA FERA relationship

For educational institutions

Schools and universities need to understand which law governs particular health information:

• Health information in education records is governed bFERApa, notHIPAAa
• Schools should establish clear policies on how health information in education records is protected
• Staff should be trained on the distinction betweeFERApa andHIPAAa
• Institutions with health clinics need peculiarly careful policies to distinguish between FERA and hHIPAArecords

For healthcare providers

Healthcare providers who work with educational institutions should:

• Understand whether they’re created education records underFERAa or medical records under HIPAA
• Know the appropriate consent and disclosure requirements that apply
• Be aware that different standards may apply when treat students versus non students

For parents and students

Understand which law apply affect how individuals can access and control their health information:

• Under FERA, parents have access rights until students reach 18 or enter postsecondary education
• FERA allow students to request amendments to records they believe are inaccurate
• HIPAA provide different access mechanisms and rights regard health information

Common scenarios and which law apply

To advantageously understand the practical application of these principles, consider these common scenarios:

Source: slideserve.com

Scenario 1: school nurse records

A k 12 school nurse maintain health records for students, include information about medications, chronic conditions, and treatment provide during school hours.

Applicable law:

FERA. These records are mmaintainedby the educational institution and now relate to students, make them education records underFERAa. HIPAA does not apply, yet though they contain health information.

Scenario 2: university counseling center

A college student receives mental health counseling at the university’s counseling center, which serve solitary students.

Applicable law:

These records start as” treatment records ” nder feFERA n( education records ). ) they’re exclusively use fusedtreatment purposes, they remain in this category. If disclose to others beyond treatment providers, they become education records subject to ferpFERApaaHIPAAcally does not apply.

Scenario 3: university medical center

A university operate a medical center that serve both students and the public, bills insurance, and functions as a regular healthcare provider.

Applicable law:

HIPAA probably apply to the medical center’s records as it function as a HIPAA cover entity. Notwithstanding, if records are share with the university for educational purposes (such as accommodations ) those share records may become education records subject to feFERA

Scenario 4: student health insurance claims

A university require students to have health insurance and offer a student health plan.

Applicable law:

HIPAA typically apply to the health insurance plan’s records, as health plans are HIPAA cover entities. These records are not maintained by the educational institution for educational purposes.

Disclosures permit under both laws

Both FERA and hHIPAApermit disclosures without consent in certain emergency situations:

• FERA allow disclosure to appropriate parties in connection with a health or safety emergency
• HIPAA permit disclosures to prevent or lessen a serious and imminent threat to health or safety

The U.S. departments of education and health and human services have emphasized that these provisions allow information sharing when necessary to protect the health or safety of a student or others.

Guidance for institutions manage both HIPAA and FERA

Educational institutions that deal with both HIPAA and FERA should consider the follow best practices:

• Develop clear write policies that identify which records are subject to which law
• Train staff on the differences between HIPAA and FERA requirements
• Implement appropriate consent forms that align with the applicable law
• Establish procedures for handle requests for access to records
• Create protocols for situations where information might transition from one law’s coverage to another
• Regularly review and update policies as guidance from federal agencies evolve

Recent developments and clarifications

The departments of education and health and human services sporadically issue joint guidance to clarify the relationship between FERA and hHIPAA These guidance documents help institutions navigate complex scenarios and should be cconsultedfor the virtually current interpretations.

Recent guidance has emphasized the importance of information sharing for student safety while maintain appropriate privacy protections. The agencies haveclarifiedy that neither law present an insurmountable barrier to appropriate information sharing in emergency situations.

Conclusion

The relationship between HIPAA and FERA create a clear division for most health records maintain by educational institutions: if the records qualify as education records under fFERA so hiHIPAAxplicitly exclude them from its coverage. This mean that student health information maintain by schools is typically gogovernedy FERA, not hHIPAA

Nevertheless, this ostensibly straightforward rule become more complex in practice, peculiarly for institutions like universities that may function both as educational institutions and healthcare providers. Understand which law apply to require careful analysis of who maintain the records, for what purpose, and in what capacity.

Both laws share the common goal of protect sensitive information while allow appropriate access and disclosure. By understand the exclusion of FERA education records from hHIPAAcoverage, institutions can develop appropriate policies to comply with both laws and protect student privacy while meet health and safety needs.