By Michelle Mott, Associate Director of Government Relations and Communications at AACRAO.
Recent accusations leveled against a Harvard University professor alleging predatory behavior toward students stirred up discussions, once again, on the disclosure of student medical treatment records. In particular, what happens to a student’s mental health records during a sexual misconduct investigation or litigation against an institution?
FERPA vs. HIPAA
When students seek medical treatment, including mental health care, on-campus, are those records considered education records under FERPA? It depends.
Under FERPA, medical or treatment records at postsecondary institutions are exempt from the definition of education records so long as they are only shared with other treatment providers. See 34 CFR 99.3 (a)(4). These records are subject to the Health Insurance Portability and Accountability Act (HIPAA). However, once these records are shared with any party other than another treatment provider, they become education records by definition and thereby subject to FERPA.
Thus, sharing these records with the registrar's office, risk assessment team, or in compliance with a judicial order or lawfully issued subpoena, for example, while permitted under FERPA, would turn the treatment records into education records.
Recent Guidance
The U.S. Education Department, along with the Department of Health and Human Services, issued joint updated guidance in December 2019 on the interplay between FERPA and HIPAA. The agency's revised guidance, first issued in November 2008, to clarify for school administrators, health care professionals, families, and others how FERPA and HIPAA apply to education and health records maintained on students. In particular, the guidance addresses when a student’s health information can be shared without the parent or eligible student's written consent under FERPA or without written authorization under the HIPAA Privacy Rule.
New clarifications and examples address:
when, under FERPA, an educational agency or institution can disclose, without prior written consent, PII from a student’s education records, including health records, to the educational agency’s or institution’s law enforcement officials;
when certain disclosures are allowed without the written consent of the parent or eligible student under FERPA or without authorization under the HIPAA Privacy Rule, especially those related to emergency health or safety situations; and
when a school that employs a health care provider and conducts covered transactions electronically is subject to the FERPA privacy standards instead of the HIPAA privacy standards, among other things.
Explore AACRAO's extensive FERPA resources, including guidance in compliance, FERPA training, publications, and more.