June 2005

In April 2003, the Health Insurance Portability and Accountability Act (HIPAA) became a part of the regulatory fabric of the medical world. Since that time, school nurses and school health officials have been clamoring for guidance on how HIPAA and the Family Education Rights Privacy Act (FERPA) interact in the school environment. School health leaders are often confused about how to interpret the practical implications of these federal privacy laws. With the new protection given to what is termed “personally identifiable health information” in all settings, it is more important than ever for school nurses, school administrators, and school attorneys to reassess policies and procedures for protecting the privacy of student and family health information in schools.

The Summer Series of Education FAQs will address the requirements of FERPA and HIPAA, the two major privacy acts that impact schools and universities. June's FAQ will summarize the requirements of FERPA and its implication for schools. August's FAQ will do the same for the new requirements of HIPAA. Finally, the October Education FAQ will clarify the similarities and differences between these two important, and often confusing, laws.

Our community organizations are confused by the requirements of the Family Education Rights Privacy Act (FERPA) Can you explain the implications of FERPA for schools and agencies?

What is FERPA?:

FERPA is a federal law that protects privacy interests of parents in their children's "education records," and generally prevents an educational institution from having a policy or practice of disclosing the education records of students, or personally identifiable information contained in education records, without the written consent of the parent. The term "education records" is defined as all records, files, documents and other materials which contain information directly related to a student and are maintained by the educational agency or institution or by a person acting for such agency or institution. (20 U.S.C. § 1232g (a)(4)(A); 34 C.F.R § 99.3)

What Rights Does FERPA Grant to Individuals?

Parents of students under 18 who are not attending a postsecondary institution generally have a right to: gain access to their education records (obtain copies) within 45 days of a written request; seek to amend any information therein considered to be in error; control how information in such records is disclosed to other institutions -- in general, such disclosures must be authorized by the student or parent, with some exceptions; and complain to the US Department of Education if these rights appear to have been violated (Atlantic Information Services, 2005).

When a student reaches the age of 18 or attends an institution of postsecondary education, the student is considered an "eligible student" under FERPA and all of the rights afforded by FERPA transfer from the parents to the student. (20 U.S.C. § 1232g (d); 34 C.F.R § 99.3)(Fox & Rothschild, 2005).

How Does FERPA Affect Schools?

FERPA, Section 444 of the General Education Provisions Act, referred to as the “Buckley Amendment,” requires that any school or institution that receives federal funds for education may not release school records or any other personally identifiable information without the prior consent of the student. It also restricts the use of students' personal information and contains provisions for review of information held by the agency.

Failure to adhere to FERPA rules can result in the loss of federal funds, though that rarely happens. Parochial and private schools at the elementary school levels do not generally receive such funding and thus are not subject to these federal protections. In such cases, state education records laws still apply and may provide privacy protections.

Which “Education Records” Does FERPA Cover?

The records of any student receiving services under the Individuals with Disabilities Education Act (IDEA) are “education records” under FERPA and are subject to the confidentiality provisions under IDEA (34 C.F.R §§ 300.560-300.576) and to all of the provisions of FERPA.

A public school student's health records while attending Kindergarten through grade 12, including immunization records that are maintained by an educational agency or institution are also subject to FERPA. These include records maintained by a school nurse, and would be considered “education records” subject to FERPA because they are 1) directly related to a student; 2) maintained by an educational agency or institution, or a party acting for the agency or institution; and 3) not excluded from the definition as treatment or sole possession records, or on some other basis. (20 U.S.C. §1232g (a)(4)(a))

There are several important exclusions from FERPA's definition of an education record, the last of which is important for HIPAA. FERPA excludes:

• Non-transferable Education Records : "records of instructional, supervisory, and administrative personnel and educational personnel ancillary thereto which are in the sole possession of the maker thereof and which are not accessible or revealed to any other person except a substitute";

• Law Enforcement Records : "records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement";

• Employee Records : "in the case of persons who are employed by an educational agency or institution but who are not in attendance at such agency or institution, records made and maintained in the normal course of business which relate exclusively to such person in that person's capacity as an employee and are not available for use for any other purpose"; or

• Adult Student Health and Mental Health Treatment Records: "records on a student who is eighteen years of age or older, or is attending an institution of postsecondary education, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student's choice." (University of Miami, 2005).

Stay tuned for August's FAQ on HIPAA and its requirements and impact on schools and universities!