School district administrators nationwide have had to walk a tightrope when it comes to privacy rights regarding the education records of students. Among the more precarious issues involves student health records because of the interplay between two federal laws and their strict parameters around the sharing of personally identifiable information (“PII”) and protected health information (“PHI”). In 2008, the U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services released joint guidance addressing the application of the Family Educational Rights and Privacy Act (“FERPA”) and the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) to student records. Eleven years later, the two agencies have now released updated joint guidance to address various issues and myths that have arisen since 2008.
One of the more frustrating issues school districts face is the resistance from healthcare professionals to share information necessary to address student health needs in schools. The new guidance makes it clear that HIPAA does not prevent or prohibit a covered health care provider from disclosing PHI about a student to nurses, physicians, or other health care providers employed by a school district. Absent consent by the patient, covered health care providers are permitted to disclose PHI for treatment purposes. For example, a student’s primary care physician may discuss a student’s medication and other health care needs with a school nurse who will administer the student’s medication and/or provide care to the student while the student is at school. Similarly, FERPA permits school officials to verify information that is contained in a record created by a third party with that third party, such as verifying a physician’s excuse note excusing a student’s absence with that physician, as long as other PII from the student’s education records is not disclosed without written consent.
In today’s society, there is increasing discussion and insight into addressing mental health issues as they relate to growing security concerns. The new guidance reminds us of the health and safety emergency exception to FERPA, allowing information from a student’s education records, including student health records, to be shared by a school district with appropriate parties in connection with a health or safety emergency. There are certain conditions attached to this exception: specifically, a school district must be able to provide and document an articulable and significant threat to the health or safety of the student or other individuals. If a situation meets this criteria, school administrators are authorized to share PII from the education records of a student, without consent, during the period of the emergency. For example, if a school counselor has noticed that Student A has exhibited sufficient cumulative warning signs that he or she may harm his or herself or others at any moment, the school counselor would likely be permitted under FERPA to disclose PII to those who will assist in protecting a person from the threat. It is important to note that the school counselor must document in the student’s education records the articulable and significant threat(s) leading to the disclosure.
While there are many scenarios addressed in the updated joint-guidance, FERPA and HIPAA exceptions should always be reviewed on a case-by-case basis. As always, the school law attorneys at Stock and Leader are happy to help you navigate the murky waters of FERPA privacy concerns.