Ahhh, August. The month filled with back-to-school happenings, county fairs, and the glorious return of Husker football. As you prepare your staff for the upcoming school year, we recommend a review of the Family Educational Rights and Privacy Act (FERPA). In April 2023, the U.S. Department of Education’s Student Privacy Policy Office produced two new guidance documents to educate schools on the privacy of student health records. The guidance is available here and here. While none of this guidance is new, the Department of Education noticed many schools were grappling with the nuances of student health records and also the confusion with HIPAA.
As a quick overview, FERPA is a federal law that protects the privacy of students’ educational records and applies to school districts which receive any type of federal funding. (Hint, this law applies to all K-12 public schools in Nebraska and South Dakota.) Under this law, personally identifiable information from a student’s education record may not be disclosed without prior written consent from a parent unless an exception applies. Parents are also given the opportunity to inspect and review educational records and amend educational records if information relating to the student is inaccurate. Schools must notify parents of these rights annually. If you are a KSB policy subscriber, this notice is provided in our student handbook. To note, FERPA rights transfer to a student when the student turns 18.
One important distinction made by FERPA is the definition of “education records.” Education records are defined as “records that are: (1) [d]irectly related to a student; and (2) [m]aintained by an educational agency or institution or by a party acting for the agency or institution.” 34 CFR 99.3. Student health records, in some circumstances, may qualify as education records under FERPA. For example, a health record created and maintained by a school nurse would be subject to FERPA. However, information obtained through personal knowledge or observation is not an education record unless the school official uses the information to produce an education record.
Additionally, FERPA and HIPAA are distinguishable. Student health records that are considered education records under FERPA are excluded from the definition of protected health records under HIPAA. In general, school districts are not HIPAA covered entities. For more guidance on the application of HIPAA and FERPA to student records, the U.S. Department of Health and Human Services and U.S. Department of Education released a Q&A here. We have experienced situations where school nurses are hesitant to share student health information due to HIPAA concerns. As HIPAA is not applicable when records are kept for educational purposes, school nurses should consider FERPA exceptions which allow transmission of education records without parental consent in situations such as: disclosure to school officials who have a “legitimate educational interest” in the information, disclosure involving a health or safety emergency, and disclosure to comply with a subpoena.
Please reach out to any of us at ksb@ksbschoollaw.com or give us a call at 402-804-8000 to discuss any questions you may have about FERPA compliance.
KSB Webinar Series
As we gear up for school, the KSB crew has developed an exciting slate of webinars for this upcoming year. For Nebraska clients, click here and South Dakota clients click here to review the options and topics for 2023-2024.