Department of Health & Human Services and Department of Education Revamp Guidance on the Intersection of HIPAA and FERPA on Student Health Records
On December 19, 2019, the United States Department of Health & Human Services (“HHS”) and Department of Education (“DoE”) issued an updated Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) And the Health Insurance Portability and Accountability Act of 1996 (HIPAA) To Student Health Records (“Guidance”). This updated Guidance replaced the original version, issued in November 2008, to address additional privacy concerns pertaining to Student Health Records.
The stated purpose of the Guidance is to explain the relationship between FERPA and its implementing regulations and the HIPAA Privacy Rule to help address potential confusion on how these two regulatory schemes apply to records maintained on students.
The updated Guidance provides an expanded overview of the two laws, as well as additional Frequently Asked Questions (“FAQ”) in a more cohesive manner, to assist school administrators, health care professionals and others in navigating the intricacies of the laws that protect Student Health Records. In addition to adding eleven (11) FAQs, the Guidance expands upon the Overview of the HIPAA Regulations as applicable to eligible student health records, and provides greater insight as to when a postsecondary institution may also qualify as a Covered Entity under HIPAA (i.e., a “hybrid” entity).
The updated Guidance offers a more user-friendly approach to the FAQs, by arranging them first into two categories: Which Rule Applies and What Information Can Be Shared. The first category contains FAQs that were issued in the original Guidance, with additional information regarding HIPAA and FERPA’s application in elementary and secondary schools, as well as records in health clinics and hospitals operated by postsecondary institutions. The second category of FAQs contains the majority of changes pertaining to when the information can be shared without the student’s consent, with a number falling into three buckets:
- Student Health Records for deceased children;
- Student Health Records pertaining to mental health and/or substance abuse; and
- Student Health Records and minors.
For example, with respect to student health records and substance use disorder records, the updated Guidance provides some detail regarding the heightened protection of such record’s under 42 CFR Part 2—Regulations that were not previously addressed in the original Guidance.
The Guidance is a timely reminder to educational institutions that maintain student healthcare records and possibly provide healthcare services to its students to review their current policies and modify as necessary to ensure compliance with these two regulatory schemes.
For assistance in updating your policies or understanding how this guidance affects your institution, you can contact a member of Butzel Long’s Health Care Industry Team and Education Industry Team.
Debra Geroux, CHC, CHPC
248.258.2603
geroux@butzel.com
Mark R. Lezotte
313.225.7058
lezotte@butzel.com
Robert H. Schwartz
248.258.2611
schwartzrh@butzel.com
Carey DeWitt
248.258.2607
dewitt@butzel.com
Dan Tukel
313.225.7047
tukel@butzel.com
