Understanding the HIPAA Privacy Rule: Exclusions for Education Records under FERPA

Understanding the HIPAA Privacy Rule: Exclusions for Education Records under FERPA

The Health Insurance Portability and Accountability Act (HIPAA) is a set of federal laws that aim to protect individuals’ privacy and security of their medical information. The HIPAA Privacy Rule sets national standards for the use and disclosure of protected health information (PHI) by covered entities, such as healthcare providers, health plans, and healthcare clearinghouses. However, the HIPAA Privacy Rule is not the only federal law that regulates the privacy of personal information collected by educational institutions. In some cases, the Family Educational Rights and Privacy Act (FERPA) may also apply.

FERPA is a federal law that gives parents or eligible students (those over 18 years old) the right to access, inspect, and request corrections to their education records. Education records are defined broadly under FERPA as any records, files, documents, and other materials that contain information directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution.

While FERPA and HIPAA have differences in scope and applicability, there are circumstances where FERPA may provide an exclusion from the HIPAA Privacy Rule. Specifically, FERPA allows educational institutions to withhold consent for the disclosure of PHI to covered entities for treatment, payment, or healthcare operations purposes when such information is contained in education records. In other words, if a student’s medical information is part of their education record, such information is protected under FERPA and not subject to HIPAA.

For example, if a school nurse collects medical information about a student as part of their school health services, such information is considered an education record under FERPA. Consequently, the information falls outside of the definition of PHI under HIPAA, and the school nurse may not disclose the information to other healthcare providers without consent.

Another example where FERPA may provide an exclusion from HIPAA is when school-based clinics or health centers are operated by an educational agency or institution. These centers typically provide healthcare services to students, but the healthcare providers are employed by the educational agency or institution and not a covered entity. As a result, the healthcare providers may not be subject to the HIPAA Privacy Rule when treating students if the information is part of education records covered by FERPA.

In conclusion, while the HIPAA Privacy Rule sets national standards for the use and disclosure of PHI by covered entities, educational institutions must also comply with FERPA regulations that regulate access and disclosure of education records. The interaction between these two laws can be complex, but understanding the FERPA exclusions for education records under HIPAA is critical for educational institutions to ensure compliance with both laws while protecting students’ privacy and security.