Everything You've Always Wanted To Know About HIPAA And FERPA

-- End Ad Box --->says.
Consider this question. Say the mother of a 22-yearThis was apparently considered unworkable by
old student that you have treated requests to see herCongress, hence the blanket exception that HIPAA
daughter’s medical records. The Bursar’smakes for any kind of student medical records.
office confirms that the student is listed as aHowever, many student health and counseling centers
dependent for tax purposes. There seems to be noalso treat non-students, and this is where it starts to
urgent reason for such a release and the studentget a little bit trickier. To be considered a “covered
does not wish to give her mother access. How wouldentity” (i.e., bound by HIPAA), your health center
you protect the privacy of her information?must electronically transmit health information in
Situations such as this one that require knowledge ofconnection with a “HIPAA transaction”. More
privacy laws to resolve successfully are all toodetailed information on what constitutes a HIPAA
common in the average student health center, yet thetransaction can be found in this primer released by
acronyms HIPAA and FERPA tend to strike fear intoThe American Council on Education, but essentially it is
the hearts of the staunchest of college healthany administrative or financial task carried out in the
professionals. So much has been written anecdotallycourse of health care that transmits PHI. If you
on the subject of how complicated and unspecificdon’t perform electronic transactions, you
these laws are that some may be surprised to finddon’t have to comply with HIPAA.
that according to legal professionals, the intersectionsRULE 5: Student health and counseling centers that do
between the laws are generally clear-cut. This articleperform electronic transactions for non-students only
aims to explain which laws apply to you and what youhave to abide by HIPAA for those transactions.
can do to avoid the headaches that ensue from aUsually, every transaction of “covered entities”
conflict between your principles as a care provider andhas to be bound by HIPAA standards, even if they are
the law.not all electronic transactions. However, because of
Six golden rules of privacy lawthe intersection with FERPA, these health centers are
* FERPA never applies to non-studentsable to be bound by HIPAA just for the non-student
* FERPA only applies when the student’stransactions.
medical records are releasedRULE 6: State laws are applicable whether or not
* HIPAA doesn’t apply to records covered byother federal laws apply
FERPA or to student “treatment records”With all the fuss about HIPAA and FERPA,
* Even if you treat non-students, you’re notdon’t forget about your state’s laws
bound by HIPAA unless you perform electronicconcerning privacy. In some cases, state laws are the
transactions.only ones that will apply to student medical records, but
* Student health and counseling centers that doeven where HIPAA or FERPA apply, state law is still
perform electronic transactions for non-students onlyrelevant. Despite the fact that HIPAA is a federal law,
have to abide by HIPAA for those transactions.it bows to state law in those cases where state law is
* State laws are applicable whether or not othermore stringent. Arent Fox Associate Richard Liner, BA,
federal laws applyJD, MPH, elaborates:
This is how these rules break down.“HIPAA has an enormous pre-emption problem
RULE 1: FERPA never applies to non-studentsbecause it sets a floor and not a ceiling for health care
RULE 2: FERPA only applies when theprivacy. Congress only established a minimum for
student’s medical records are releasedprotecting patient information. If a state’s laws
The Family Educational Rights and Privacy Actor regulations are more stringent than HIPAA in their
(FERPA) is the older of the two federal privacy laws.protection of patient health information, then covered
Enacted in 1974, one aspect of its governance is theentities must follow state requirements.”
privacy of educational records. There is a popularThis may conjure up ideas of conflicting laws, but
myth circulating that student medical records fall underArent Fox counsels that generally, state laws are
the FERPA’s umbrella term “educationalmore specific and will very rarely conflict directly with
records”. In fact, FERPA specifically excludes theHIPAA or FERPA. If more than one law is applicable,
treatment records of students in higher education fromgenerally the more stringent requirements will apply.
its definition of educational records (see USC 20, 1232gWhen in doubt, consult counsel before taking action.
for a complete definition). It also excludes employeesKnowing the theory is one thing, but applying it can be
of an educational institution if they are not students.a lot more complicated. FERPA requires the student to
FERPA does come into play, but only if the recordsgive written, dated permission before his or her student
are released to someone outside the health center,records information is released — even to other
whether that is the student, their parents, theirhealth care providers outside the university, which is a
professors, or another health provider outside thesource of frustration for many. But the same
university, at which point they become “educationalinformation can be released, unauthorized, to school
records” rather than treatment records.officials who have a “legitimate educational
It is important to note that it is not the request for theinterest”. Similarly, FERPA allows unauthorized
release that brings FERPA into effect. Many studentdisclosure in an emergency, if it is “necessary to
health professionals believe that if a request to see theprotect the health or safety of the student or other
records is made that is in accordance with FERPApersons”. Dunne counsels to rely on common sense
guidelines, they have to release them or be in violationto interpret these terms, and to consult counsel early in
of FERPA. Not so, says Kristine Dunne, BA, EdM, JD,the process. No law can specifically cover every
an associate at the Washington, D.C. office of law firmeventuality; the burden of responsibility and
Arent Fox, LLC.interpretation must, through necessity, rest on the care
“It's the release of the records that triggersprovider.
FERPA,” she explains. “There are no rightsThis responsibility weighs all the more heavy because
extended under FERPA to those medical records untilschools are concerned about penalties for breaching
such time as they have been made available toFERPA. If the Family Policy Compliance Office (FPCO)
someone other than the treating health professionals,found a pattern of violations of FERPA with no
at which point the FERPA protections of studentobvious attempts to follow the guidelines, it could result
records kick in.”in a removal of federal funding. However, it is important
Applying this to the example at the beginning of theto know that individuals cannot be prosecuted for a
article, if state law doesn’t require you toFERPA breach and individual students cannot sue for
release the student’s unreleased medicaldamages for such a breach. Schools should carefully
records to her mother, you are under no legaldevelop, implement and maintain compliance oversight
obligation to do so without a court order. Similarly, evenwith regard to these important privacy laws in order to
if you think a professor may have a “legitimateprevent unlawful release of student records. Likewise,
educational interest” in requesting a student’sif your school treats non-students, files electronic
unreleased medical records, you still don’t haveclaims and is bound by HIPAA for those transactions,
to release them.you should make sure that HIPAA protections are
FERPA is just one part of the puzzle, however. Theimplemented, even though a HIPAA violation may not
Health Insurance Portability and Accountability Act— for now — result in a fine being
(HIPAA) of 1996 is another relevant law that seeks toimposed. Liner explains:
be the national privacy standard in health care. It was“In the vast majority of cases where there’s
updated in 2003 to take into account the trend towardfound to be a violation of HIPAA, there is
automation and electronic record-keeping. Thesewhat’s called an ‘administrative
privacy guidelines have been well publicized andresolution’, which generally means the mistake
generally uphold the kind of patient confidentiality thatwasn’t intentional and the organization voluntarily
most health care providers are comfortable with andagrees to take appropriate remedial action.”
there has therefore been a widespread trend in healthNo civil fines for violations of HIPAA have been
centers to apply these standards to student medicalimposed so far, although Liner warns that is likely to
records, even if they are not legally required. It issoon change.
important to realize, however, that while its principles ofAlthough information on the triumvirate of privacy laws
privacy and confidentiality are excellent, in most cases,has always been available to those who know where
compliance is not required by law.to look for it, there is also a wealth of partial and
RULE 3: HIPAA doesn’t apply to recordsincorrect information available on the Internet that has
covered by FERPA or to student medical recordsmuddied the waters for those health professionals
which are made, maintained, or used only in connectionattempting to do a little research on the laws that
with the provision of treatment to the student, and areapply to them. Dunne and Liner counsel that you should
not available to anyone other than persons providingspeak to a professional who knows the law in your
such treatment.state and the ins and outs of FERPA and HIPAA if
RULE 4: Even if you treat non-students, you’reyou are worried about misinterpretation of the law.
not bound by HIPAA unless you transmit health careEven if you know the basics, state laws vary greatly
information in electronic form in connection with theand knowing the details of how the three laws
submission of claims for payment.intersect will allow you the greatest leeway to interpret
HIPAA’s definition of protected healththem in a way that is consistent with your ethics.
information (PHI) specifically excludes education“It is complicated,” sympathizes Liner. “Talk to
records covered by FERPA and the treatmentthe privacy officer within the university, if there is one.
records of students in higher education as definedThere are also a few government Web sites that are
above. Dunne explains that the goal of this exclusion isreally good in terms of user-friendly guidance to help
simplification.people navigate through the more basic pitfalls.” For
“If student medical records were subject to HIPAA,instance, the Office of Civil Rights, the enforcement
there would be two completely different schemesagency for the HIPAA privacy standards, offers
— up until the health center released the record,tremendously helpful information and FAQs on its Web
it would be governed by HIPAA, and when it had beensite.
released it would be governed by FERPA,” she