It is no secret that institutions of higher education (IHEs) are currently busy addressing their policies to reflect recent major changes in the law (read: Title IX!), but it is also important to give some time and attention during the quieter summer months to reviewing and assessing other policies and practices to ensure compliance with the more familiar laws that are not frequently revised, but are equally applicable to IHEs, their student body, and other campus community members. When it comes to protecting student or employee health-related information, IHEs need to ensure their policies and practices comply with two major federal laws: the Family Educational Right to Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as applicable. IHE administrators must have a clear understanding of how and when those statutory obligations control and interact.
All IHE administrators are well acquainted with FERPA and its definition of "directory information" versus "education records." But IHE staff and administrators are increasingly presented with health-related information in the course of interacting with students, especially as it relates to student mental health disclosures. Questions may arise about how and what information is subject to protection. For example, if a student confides mental health issues and treatment to an administrator and the administrator takes notes of the meeting, or if a student shares documentation from a treatment provider for mental health issues with their on-campus job supervisor to substantiate absences from work, the IHE should have a clear idea of what its obligations are for protecting such information from disclosure.
IHEs first need to be familiar with how to determine what type of health information they are presented with. If the IHE is a HIPAA-protected entity, is the information protected health information under HIPAA, or is it an education record under FERPA, or is it subject to FERPA's treatment record exception? Student medical records at IHEs are generally considered education records under FERPA, unless they meet the criteria for "treatment record," which is an exception to FERPA. The treatment record criteria require that the record (i) directly relates to a student 18 years or older attending postsecondary education; (ii) is maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity, or assisting in a paraprofessional capacity; and (iii) is made, maintained, or used only in connection with the provision of treatment to the student, and is not available to anyone (including the student) other than persons providing such treatment. However, if the record is disclosed to anyone, including the student, other than as outlined in subsection (iii), the record becomes a protected education record under FERPA.
It is important for IHE administrators to know these distinctions, as they relate to student, employee, and other community member records, because HIPAA and FERPA have different notice, consent, disclosure, and record retention requirements. Additionally, IHEs' policies need to be clear on the distinction between education records and treatment records. The Department of Education's Office of Civil Rights (OCR) has had its eye on IHEs' handling of student health-related information for years, particularly with regard to ensuring FERPA compliance, which OCR discussed in its August 2016 Dear Colleague Letter: Protecting Student Medical Records; which the U.S. Department of Health and Human Services and Department of Education discussed in a December 2019 Update to the Joint Guidance on FERPA and HIPAA; and which was recently reiterated again by the Student Privacy Policy Office in an April 12, 2023 Guidance for School Officials on Student Health Records publication.
