Dear FERPA Professor:
I always thought that any records in our student health center were subject to HIPAA and not FERPA, but I recently heard that HIPAA’s privacy rule doesn’t apply to treatment records at institutions of higher education –
that they are an education record under FERPA instead. Did I hear correctly? Can you refer me to a resource that gives details on that so I can share with others?
Thank you!
Lernan D. Grow
_____________________________________________________________________________
Dear Lernan:
At a postsecondary institution, FERPA excludes health or treatment records from the definition of education records so long as the specific conditions listed at §99.3(b)(4) "Education Records" are met. While treatment records are still
subject to FERPA, they would only become education records if they are shared with a party other than another treatment provider. Thus, sharing these records with the registrar's office, your accommodations office, or risk assessment team,
for example, while permitted under FERPA, would turn the treatment records into education records.
However, records that are subject to FERPA are not subject to HIPAA's privacy rule. Thus, any sharing of treatment records by the institution would need to be done in compliance with FERPA rather than HIPAA.
For more details, check out "Appendix I, HIPAA/FERPA Guidance," starting on page 341 of the 2012 AACRAO FERPA Guide.
In particular, see the section titled: "Does FERPA or HIPAA apply to records on students at health clinics run by postsecondary institutions?" on page 345 of the Guide. You can find the above cited regulation on page 154 of the Guide.
I hope this is helpful.
The FERPA Professor