Does HIPAA Privacy Rule Apply to Elementary/Secondary Schools Education Records (FERPA/HIPAA)?
The FERPA or Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99) is a federal law that aims to protect the integrity of student records across the United States.
Understand Realm of FERPA
FERPA mandates are applicable to all schools that receive funding through various programs of the U.S. Department of Education. This essentially means that FERPA is applicable to most public schools, nearly every school district and even private schools. Some of the public educational institutions offering post-secondary education too follow FERPA mandates along with professional schools providing employment-oriented skills training. Further, FERPA applies to the fund-receiving entity as whole, i.e. all departments within the institution.
FERPA & HIPAA: Basic Similarity
This makes FERPA similar in terms of being a comprehensive regulation, i.e. just like the HIPAA is applicable to all covered entities handling Protected Health Information or PHI, FERPA comprehensively covers nearly every educational institution with student records. However, FERPA is a bit different from HIPAA and this why HIPAA is usually not applicable to elementary/secondary schools.
Firstly, FERPA uses the term 'education records'. This is a broadly-defined term that includes all records containing personal details about a student maintained by any educational institution or entities acting on behalf of the institution.
This invariably means that the health records of elementary and secondary-level students are also included in FERPA's realm of 'education records'. This includes individual health information like immunization details that are often recorded by entities like the school's nursing staff.
FERPA aims to protect student information in the form of records maintained for special education students also. This includes records about services extended to disabled or special needs students under the provisions of the Individuals with Disabilities Education Act or IDEA.
All such records are covered under FERPA regulations because they fulfill the most basic requirement put forth by FERPA, i.e. they are directly related to the student and are being maintained by educational institutions working for or in coherence with such institutions.
Gain a Better Perspective on the term 'Education Records'
Understanding this term is central to understanding the realm of FERPA. It should be noted that such records are also called "treatment records". These "treatment records" can be disclosed for reasons other than ensuring appropriate treatment of the student in restricted scenarios. Here, the sharing of records should be done in adherence with the exceptions listed under 34 CFR § 99.31(a) or with a written consent from the student under 34 CFR § 99.30 to ensure that they are still compatible with FERPA's standards.
