You asked what federal rules govern a college sharing a student’s health care records within the college and with parents.

The Family Educational Rights and Privacy Act (FERPA) governs student “education records,” which include health records, according to Dan Brightman, an officer with the U. S. Department of Education’s Family Compliance Office. FERPA applies to all colleges and universities that receive federal funds. Health records at colleges that do not receive federal funds are governed by the Health Insurance Portability and Accountability Act (HIPAA). Since only a few colleges receive no federal funds, this report focuses on FERPA rules (34 CFR 99).

FERPA generally prohibits disclosure without consent, either internally or externally, of personally identifiable information from education records. But it permits (although it does not require) such disclosure without consent in certain situations. These include:

1. to other school officials, including teachers, within the institution who the college determines have legitimate educational interests;

2. to the parents of a student under age 21 concerning the student’s violation of any federal, state, or local law or school policy or rule governing alcohol or drug use or possession; and

3. in connection with a health or safety emergency.

In a health and safety emergency, information can be disclosed only if it is necessary to protect the health and safety of the student or others. But this rule does not prevent a college from including in a student’s educational record information about disciplinary action for conduct that posed a significant risk to the safety or well being of the student, other students, or other members of the college community and from disclosing that information to teachers and officials at the institution who have legitimate educational needs.

FERPA law does not define “legitimate educational needs” or the school officials who may have them. Schools must include this information in the annual notice they must give parents and college students. The notice must also inform parents and students that they can (1) consent to the disclosure of personally identifiable information and (2) inspect and review the student’s education records. But once a student enrolls in a college, FERPA rights vest in him or her, not the parents. It appears that, with the exception of notice for violating a drug or alcohol law or rule, a college can notify parents, and parents can inspect records, only if the student consents to this.

FERPA excludes from its definition of “educational records” those made or maintained by a physician, mental health professional, or other recognized health professional or paraprofessional if they are (1) made, maintained, or used in treatment and (2) disclosed only to people providing treatment. Normally, the Health Insurance Portability and Accountability Act (HIPAA) would apply to disclosure of such records, but the Department of Health and Human Services (HHS) specifically excluded these records from HIPAA rules. HHS contemplated subjecting these records to HIPAA but did not because (1) any use by or disclosure of the record to others or for other purposes would turn the record into an educational record that would be subject to FERPA protections and (2) it would be unduly burdensome to subject providers to two different sets of regulations (Federal Register, 12/28/2000, p. 82483).

SS: dw