Updated Guidance Addresses the Privacy of Student Records

In an effort to provide further clarity to school administrators, healthcare professionals and families, the U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services recently released updated joint guidance addressing the application of the Family Educational Rights and Privacy Act (FERPA) and the HIPAA Privacy Rule to records maintained on students.

The guidance aims to help answer frequently asked questions regarding sharing a student’s health information without the written consent of the student or parent under FERPA, or without written authorization under the HIPAA Privacy Rule. Some examples include:

• When can protected health information (PHI) or personally identifiable information from an education record (PII) be shared with the parent of an adult student?
• What options do family members of an adult student have under HIPAA if they are concerned about the student’s mental health and the student does not agree to disclosures of his or her PHI?
• Does HIPAA allow a covered healthcare provider to disclose PHI about a minor with a mental health condition or substance use disorder to the minor’s parents?
• When can PHI or PII be shared about a student who presents a danger to self or others?
• Under FERPA, can an educational agency or institution disclose, without prior written consent, PII from a student’s education records, including health records, to the educational agency’s or institution’s law enforcement officials?
• Does FERPA permit an educational agency or institution to disclose, without prior written consent, PII from a student’s education records to the National Instant Criminal Background Check System?

The new document updates guidance that was originally issued in 2008.