Melissa G. Powers, Associate

Recently, the U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services (HHS) released updates to their joint guidance to address the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to student health records. Although the updated joint guidance does not have the force of law, it clarifies the intersection of FERPA and HIPAA for educational institutions. Additionally, the updated guidance includes frequently asked questions and answers regarding when a student’s health information can be shared without written consent under FERPA, or without written authorization under the HIPAA Privacy Rule, especially in relation to emergency health or safety situations and mental health concerns.

Examples of frequently asked questions regarding students who may present a mental health concern include the following:

• What options do the parents of an eligible student with mental illness have under FERPA if they are concerned about the student’s mental health and the eligible student refuses to provide consent to permit a school subject to FERPA to share personally identifiable information (PII) from education records with the family?
• Under FERPA, may an eligible student’s treatment records be shared with parties other than treating professionals?
• Under HIPAA, when can information be shared about someone who presents a serious danger to self or others?
• Under FERPA, when can PII from a student’s education records be shared, without prior written consent, about someone who presents a serious danger to self or others?
• Under FERPA, can an educational agency or institution disclose, without prior written consent, PII from a student’s education records, including health records, to the educational agency’s or institution’s law enforcement officials?

It is vital for a school to stay up to date and fully informed on the application of FERPA and HIPAA so it can act swiftly and properly, particularly in emergency situations. In releasing the joint guidance, the Director of the Office for Civil Rights stated, “This updated resource empowers school officials, health care providers, and mental health professionals by dispelling the myth that HIPAA prohibits the sharing of health information in emergencies.” Additionally, U. S. Secretary of Education Betsy DeVos noted, “Confusion on when records can be shared should not stand in the way of protecting students while they are in school.” The updated guidance is a useful tool for schools to further combat confusion on sharing records under FERPA and HIPAA, especially when mental health concerns or health and safety threats exist.

If you would like to discuss the updated joint guidance or practical tips for how your institution can proactively address these issues, please contact one of our Education Law attorneys.