DoE Points New Steering on FERPA and Pupil Well being Data

Posted By HIPAA Journal on Apr 27, 2023

The U.S. Division of Training has issued new guidance for faculties and postsecondary academic establishments reminding them of their obligations beneath the Household Academic Rights and Privateness Act (FERPA) to guard pupil privateness, emphasizing the significance of retaining pupil well being data non-public. Steering has additionally been issued for fogeys, authorized guardians, and college students over 18 years of age on their rights beneath FERPA (Know Your Rights) with respect to pupil well being data.

FERPA was enacted to guard the privateness of pupil data and provides dad and mom rights over their youngsters’s academic data. FERPA applies to academic companies equivalent to college districts, academic establishments (together with public elementary and secondary faculties), and postsecondary academic establishments (together with schools or universities) that obtain funding beneath any program administered by the U.S. Division of Training.

The steering for FERPA-covered academic establishments reminds them that oldsters and eligible college students have the proper to train some management over the disclosure of personally identifiable info in pupil academic data and confirms FERPA prohibits disclosures of academic data except a mother or father or eligible pupil supplies written consent or the disclosure is roofed by an exception to FERPA’s normal consent necessities.

The Division of Training has reminded FERPA-covered academic establishments that FERPA’s definition of academic data contains the well being data of eligible college students which can be maintained by FERPA-covered academic establishments or their brokers except the well being data qualify as therapy data. Well being data qualify as therapy data in the event that they relate to an eligible pupil (over 18 years of age at a postsecondary academic establishment) and are “made or maintained by a doctor, psychiatrist, psychologist, or different acknowledged skilled or paraprofessional appearing in his or her skilled or paraprofessional capability or helping in that capability; made, maintained, or used solely in reference to offering therapy to the eligible pupil; and disclosed solely to the individuals offering such therapy, besides that the eligible pupil could have these data reviewed by a doctor or different acceptable skilled of the scholar’s alternative.”

If an eligible pupil’s therapy data are disclosed for any functions aside from these described above – offering the eligible pupil with therapy or for private overview by a doctor or acceptable skilled of the eligible pupil’s alternative – the data are classed as academic data and are due to this fact lined by FERPA, and will not be classed as protected well being info topic to the HIPAA Guidelines.

The steering stresses that eligible college students’ health-related data which can be created, maintained, or used for non-treatment functions are classed as academic data. For instance, when they’re used for medical types and questionnaires to display screen for eligibility to take part in school-sponsored athletics. Therapy data are additionally classed as academic data – and are due to this fact topic to FERPA’s restrictions on disclosures – if they’re used for the therapy of scholars beneath 18 years of age who’re attending an elementary or secondary college.

The steering confirms that disclosures of pupil academic data (together with sure well being data) are solely permitted by FERPA with the prior written consent of an eligible pupil or the scholar’s mother or father/authorized guardian (non-eligible pupil) or if one of many permissive exceptions to the final consent requirement applies. When an exception applies, FERPA permits – however doesn’t require – the disclosure. If the choice is taken to reveal pupil info the disclosure ought to be restricted to the minimal needed quantity of data to fulfill the supposed function of the disclosure.

The steering additionally clarifies when well being data are lined by FERPA or HIPAA. FERPA applies to pupil well being data which can be maintained by campus well being clinics and different well being care services operated by such establishments, as they qualify as academic data or therapy data beneath FERPA, and as such are excluded from protection beneath the HIPAA Privateness Rule. If an establishment of postsecondary schooling is a HIPAA-covered entity that gives healthcare to nonstudents, the nonstudent knowledge is protected well being info topic to the HIPAA Privateness Rule and the scholar well being data are academic or therapy data which can be topic to FERPA.