HIPAA and FERPA Interactions: Does HIPAA Exclude Education Records Under FERPA?

Understanding how HIPAA and FERPA intersect is essential for schools, healthcare providers in educational settings, and families. This article explains how the HIPAA Privacy Rule relates to education records governed by FERPA, including when HIPAA applies, when FERPA controls disclosures, and practical guidance for compliance.

FERPA Basics

FERPA, the Family Educational Rights and Privacy Act, protects the privacy of student education records maintained by schools that receive federal funding. It gives parents and eligible students (those over 18 or in postsecondary education) rights to inspect and consent to the disclosure of education records. Colleges and K-12 schools must implement procedures to protect student information and limit disclosures to authorized parties. Importantly, FERPA allows disclosures without prior consent in specific circumstances, such as health or safety emergencies, or to other school officials with legitimate educational interests.

HIPAA Basics

HIPAA, the Health Insurance Portability and Accountability Act, establishes the Privacy Rule that protects individually identifiable health information held by covered entities, including health plans and healthcare providers who transmit health information electronically. The rule governs how protected health information (PHI) can be used and disclosed. HIPAA also includes the Privacy Rule’s minimum necessary standard and specific disclosures to individuals, family members, and care providers, with patient consent or as otherwise permitted by law.

✓
Quick, confidential phone check
Tell us the basics and we’ll point you to the right next step. No long forms.
Confidential • Fast • Helpful guidance

When HIPAA Applies in Education Settings

In education settings, HIPAA typically applies to the health records held by a covered entity that is not an education agency or school program receiving FERPA funds. Examples include a university clinic’s medical records or a private school’s health services operated by a licensed clinician separate from the school’s student records. However, FERPA often governs education records in schools that receive federal funds, and HIPAA may not apply to those records themselves. The key distinction lies in who holds the records and the purpose of the records. Health records kept by a school nurse within the school’s health office are often FERPA records, while PHI held by a separate family practice clinic serving students would be HIPAA records.

How FERPA and HIPAA Interact

The central question is whether a record is an “education record” under FERPA or PHI under HIPAA. Education records are records that are directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution. If a record is an education record under FERPA, FERPA governs disclosures, with parental or eligible student consent required in many situations, except where FERPA permits disclosure without consent. When a record falls under HIPAA (PHI held by a HIPAA-covered entity), the Privacy Rule applies, allowing disclosures under its own set of circumstances, including for treatment, payment, and health operations, as well as certain required disclosures and patient authorizations.

In practical terms, many schools rely on FERPA to govern most student education records, including immunization records, disciplinary records, and general health information maintained by the school. In contrast, PHI held by a separate healthcare provider, even if that provider treats students, is covered by HIPAA. The intersection occurs when a health record is maintained by a covered entity that is not the school itself or when a school contracts with a health plan or clinic that treats students. In these cases, providers must navigate both FERPA and HIPAA rules, ensuring disclosures comply with the most stringent applicable restrictions and parent/student rights.

Common Scenarios And How They Are Handled

  • School-held health records: If the school maintains health records as part of FERPA records, disclosures follow FERPA rules. Parental consent is usually required for most disclosures, unless a FERPA exception applies (e.g., health and safety emergency).
  • Clinics operated by schools: If a licensed clinic within a school collects PHI and operates under HIPAA, those records may be PHI. The clinic’s disclosures follow HIPAA rules, potentially differing from FERPA protections for the same student.
  • Independent healthcare providers serving students off-campus or separate from the school’s record system: These records are generally PHI under HIPAA and subject to HIPAA disclosures, with appropriate authorizations.
  • Emergency disclosures: FERPA permits disclosures to protect the health or safety of a student or others without prior consent, and HIPAA includes similar permissive disclosures for emergencies, though the applicable entity matters.
  • Directory information: FERPA allows schools to designate directory information that can be disclosed without consent unless parents opt out; HIPAA does not apply to directory disclosures, which are governed by FERPA rules.

Practical Guidance For Compliance

To minimize confusion and ensure compliant handling of records, institutions should implement clear policies that distinguish FERPA education records from HIPAA PHI, document data flows, and train staff. Key steps include:

  • Identify record types Acknowledge which records are FERPA education records and which are HIPAA PHI. Maintain separate files or clearly labeled systems where possible.
  • Clarify disclosures For FERPA records, obtain parental consent unless a FERPA exception applies. For PHI, follow HIPAA authorization or permissible disclosures.
  • Coordinate with health offices If a school contracts with a health clinic, ensure a written agreement defines data handling, privacy protections, and applicable law precedence.
  • Emergency protocols Establish procedures that respond to health or safety emergencies consistently under both FERPA and HIPAA, with documentation of the rationale for disclosures.
  • Access rights Provide parents or eligible students with access to FERPA education records, and allow individuals to request amendments where appropriate. PHI rights under HIPAA include access, amendment, and accounting of disclosures, where applicable.

Key Takeaways

FERPA governs education records held by schools receiving federal funds, with limited disclosures without consent. HIPAA governs PHI held by covered entities and business associates, including health clinics and private providers. In many cases, FERPA controls education records, while PHI remains outside FERPA. When records overlap, institutions should apply the stricter protections and ensure proper authorization and disclosures under the applicable law.

What Families Should Know

Families should understand their rights under FERPA to inspect and request amendments to education records and to consent to disclosures in many situations. If a student receives health care through a clinic separate from the school, the PHI protections of HIPAA apply to those health records, with different disclosure rules. When in doubt, request a written policy statement from the school or healthcare provider outlining whether a specific record is FERPA education data or HIPAA PHI, and how disclosures will be handled.

✓
Quick, confidential phone check
Tell us the basics and we’ll point you to the right next step. No long forms.
Confidential • Fast • Helpful guidance

Additional Resources

For authoritative guidance, consult the U.S. Department of Education’s FERPA resources and the U.S. Department of Health and Human Services’ HIPAA Privacy Rule materials. These sources provide definitive explanations of rights, disclosures, and exceptions relevant to education records and health information in school settings.

Similar Posts