HIPAA Blog

[ Wednesday, December 03, 2008 ]

HIPAA and FERPA: One of the interesting boundaries of HIPAA is FERPA, the Family Educational Rights and Privacy Act. HIPAA obviously restricts the use and disclosure of Protected Health Information or PHI, which is broadly described as any information about past, present or future health or medical conditions or the payment therefor. A few limits are built into the definition of HIPAA, though. One is for employment records held by a party as an employer. Your employer has a right to use information in your employee physical, a trucking company can keep medically unfit drivers out of the cabs, etc. But another exception to the definition of PHI that's been a source of some confusion is the exception of "education records covered by the Family Educational Rights and Privacy Act."

This has always been understood to allow school nurses to keep infected kids out of classrooms, and college health clinics to operate with minimal HIPAA headaches. But after the Virginia Tech shootings, where the gunman was discovered to have been a psychotic student whose mental issues were known to school officials, the issue of the boundary between FERPA and HIPAA became much more of an issue.

Well, HHS and the US Department of Education have provided a useful joint paper on just this subject, including some background, a discussion of the intersection and interaction of the two statutes, as well as a handful of FAQs.

UPDATE: Supremacy.claus points out that the link to the joint paper is bad, and he's right (it worked with I put it up originally). Here's a good link.

Jeff [4:04 PM]

Comments:

Please, redo the link to the report.

# posted by

David Behar, M.D., E.J.D. : 9:33 AM