HIPAA and FERPA Privacy Laws in Schools
HIPAA and FERPA Basics
Learning Bursts
This resource was supported by Cooperative Agreement Number NU38OT000282, funded by the Healthy Schools Branch - Centers for Disease Control and
Prevention. Its contents are solely the responsibility of the American Academy of Pediatrics and do not necessarily represent the official views of the Centers for
Disease Control and Prevention of the Department of Health and Human Services.
Learning Outcomes
By the end of this learning burst, participants will be able to:
•
Explain the purpose and key components of HIPAA and FERPA
•
Identify how these laws apply to health information-sharing in the
school setting
Background
•
Collaboration between community and school health care providers
is critically important
•
Federal and state governments have enacted laws to protect
student/patient privacy and confidentiality
•
The two main federal privacy protections are the Family Educational
Rights and Privacy Act (FERPA) and the Health Insurance Portability
and Accountability Act (HIPAA) Privacy Rule
Note: Health care providers and school staff must also follow state confidentiality and privacy laws as well as other
federal laws that may apply to information-sharing under specific circumstances
FERPA
•
Protects the privacy of educational records and personally
identifiable information (PII) from those records
•
Applies to all educational agencies and institutions that receive
federal funds from the US Department of Education
•
Requires educational institutions to obtain written parent consent to
disclose educational records or PII
FERPA Consent Exceptions
Information (PII) from a student’s education record may be shared
without written consent:
•
Among teachers and other school staff who have “legitimate
educational interests” in the records
•
In an emergency situation if necessary to protect the health or safety
of a student or other individual
HIPAA
•
Protects the privacy and security of individuals’ protected health
information (PHI)
•
Applies to health plans, health care providers, and others that
transmit health information in electronic form
•
Requires covered entities to obtain written authorization before
disclosing PHI
HIPAA Consent Exceptions
Information (PHI) from a patient’s health record may be shared
without written consent:
•
With other health care providers for treatment purposes
•
To treat a patient during an emergency or in the case of an imminent
threat
HIPAA and FERPA in the School Setting
Either FERPA or HIPAA may apply—not both
•
Education records covered under FERPA are specifically excluded
from HIPAA
Typically, community health care providers follow HIPAA, while
school nurses and other health staff working for public schools follow
FERPA
•
Health information maintained by a school is considered to be part of
the education record and is covered by FERPA
Guidelines for Sharing Information
FERPA
Schools
can share PII with outside
health
care providers
:
•
With a signed FERPA-compliant
consent form
•
If the information is de-identified
•
In emergency situations if necessary to
protect the health and safety of the
student or others in the face of a
specific and significant threat
•
School staff may also verify or clarify
information provided by a healthcare
provider.
HIPAA
Community health care providers
can
share PHI with
schools
:
•
With a signed HIPAA-compliant consent
form
•
If the information is de-identified
•
If necessary to prevent or lessen a serious
and imminent threat
•
If necessary to identify, locate, and notify
family members, guardians, or anyone
else responsible for the patient’s care
(e.g., school officials during school hours)
of the patient’s location, general
condition, or death
•
If sharing with a school health provider
for treatment purposes
Guidelines for Sharing Information
Best practice approach: Obtain signed consent whenever possible
•
Both HIPAA and FERPA allow information to be shared with
designated individuals if a HIPAA/FERPA-compliant consent form has
been signed by the parent
•
Obtaining consent ensures that parents are comfortable with
information being shared and avoids any legal questions
•
Consider including a HIPAA and FERPA-compliant consent with the
standard medical forms that families complete each year
Case Example
Arthur has been coming to the
nurse’s office several times a
week during school to use his
rescue inhaler. The nurse feels
Arthur’s asthma is not well-
controlled and would like to
share this information with
Arthur’s pediatrician.
What does the nurse need to
do in order to share this
information?
Case Example
Kylie has been suffering from
panic attacks. Her psychologist
speaks with Kylie’s school
social worker to provide
information about Kylie’s
triggers and develop a
treatment plan to manage
panic attacks at school.
Were any laws broken? Why
or why not?
Resources
•
US Department of Health and Human Services:
Joint Guidance on the Application of FERPA and HIPAA to Student Health
Records
•
US Department of Health and Human Services and US Department of Education:
Joint Guidance on the Application of the
Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
To Student Health Records
•
American Academy of Pediatrics:
Sample Authorization to Use or Share HIPAA-Protected Health Information and FERPA-
Protected Educational Records
•
California School-based Health Alliance:
A California Guide for Sharing Student Health and Education Information
•
Mental Health Technology Transfer Center Network:
HIPAA and FERPA Laws: A School Mental Health Navigation Tool
•
National Center for Youth Law:
HIPAA or FERPA? A Primer on Sharing School Health Information in California, Second Edition
•
National Law Review:
Understanding the Privacy Rights of HIPAA and FERPA in Schools
•
The Network for Public Health Law:
•
Family Educational Rights and Privacy Act
•
Data Privacy in School Nursing: Navigating the Landscape of Data Privacy Laws (Part I)
•
Data Privacy in School Nursing: Navigating the Landscape of Data Privacy Laws (Part II)
•
State of Colorado:
Authorization—Consent to Release Information
Additional Questions
Contact Agency
Contact Person and Title
Contact Email Address
Contact Phone Number
Welcome to this Learning Burst on HIPAA and FERPA Basics. This resource was developed by the American Academy of Pediatrics through a Cooperative Agreement funded by the Centers for Disease Control and Prevention Healthy Schools Branch. Its contents are solely the responsibility of the American Academy of Pediatrics and do not necessarily represent the official views of the Centers for Disease Control and Prevention.
Collaboration between community and school health care providers involves adherence to federal privacy laws such as FERPA and HIPAA. FERPA protects educational records and personally identifiable information (PII), requiring written consent for disclosure. HIPAA safeguards protected health information (PHI) and mandates written authorization for disclosure by covered entities. Understanding these laws is crucial for ensuring privacy and confidentiality in school settings.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
HIPAA and FERPA Basics Learning Bursts This resource was supported by Cooperative Agreement Number NU38OT000282, funded by the Healthy Schools Branch -Centers for Disease Control and Prevention. Its contents are solely the responsibility of the American Academy of Pediatrics and do not necessarily representthe official views of the Centers for Disease Control and Prevention of the Department of Health and Human Services.
Learning Outcomes By the end of this learning burst, participants will be able to: Explain the purpose and key components of HIPAA and FERPA Identify how these laws apply to health information-sharing in the school setting
Background Collaboration between community and school health care providers is critically important Federal and state governments have enacted laws to protect student/patient privacy and confidentiality The two main federal privacy protections are the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Note: Health care providers and school staff must also follow state confidentiality and privacy laws as well as other federal laws that may apply to information-sharing under specific circumstances
FERPA Protects the privacy of educational records and personally identifiable information (PII) from those records Applies to all educational agencies and institutions that receive federal funds from the US Department of Education Requires educational institutions to obtain written parent consent to disclose educational records or PII
FERPA Consent Exceptions Information (PII) from a student s education record may be shared without written consent: Among teachers and other school staff who have legitimate educational interests in the records In an emergency situation if necessary to protect the health or safety of a student or other individual
HIPAA Protects the privacy and security of individuals protected health information (PHI) Applies to health plans, health care providers, and others that transmit health information in electronic form Requires covered entities to obtain written authorization before disclosing PHI
HIPAA Consent Exceptions Information (PHI) from a patient s health record may be shared without written consent: With other health care providers for treatment purposes To treat a patient during an emergency or in the case of an imminent threat
HIPAA and FERPA in the School Setting Either FERPA or HIPAA may apply not both Education records covered under FERPA are specifically excluded from HIPAA Typically, community health care providers follow HIPAA, while school nurses and other health staff working for public schools follow FERPA Health information maintained by a school is considered to be part of the education record and is covered by FERPA
Guidelines for Sharing Information HIPAA Community health care providers can share PHI with schools: With a signed HIPAA-compliant consent form If the information is de-identified If necessary to prevent or lessen a serious and imminent threat If necessary to identify, locate, and notify family members, guardians, or anyone else responsible for the patient s care (e.g., school officials during school hours) of the patient s location, general condition, or death If sharing with a school health provider for treatment purposes FERPA Schools can share PII with outside health care providers: With a signed FERPA-compliant consent form If the information is de-identified In emergency situations if necessary to protect the health and safety of the student or others in the face of a specific and significant threat School staff may also verify or clarify information provided by a healthcare provider.
Guidelines for Sharing Information Best practice approach: Obtain signed consent whenever possible Both HIPAA and FERPA allow information to be shared with designated individuals if a HIPAA/FERPA-compliant consent form has been signed by the parent Obtaining consent ensures that parents are comfortable with information being shared and avoids any legal questions Consider including a HIPAA and FERPA-compliant consent with the standard medical forms that families complete each year
Case Example Arthur has been coming to the nurse s office several times a week during school to use his rescue inhaler. The nurse feels Arthur s asthma is not well- controlled and would like to share this information with Arthur s pediatrician. What does the nurse need to do in order to share this information?
Case Example Kylie has been suffering from panic attacks. Her psychologist speaks with Kylie s school social worker to provide information about Kylie s triggers and develop a treatment plan to manage panic attacks at school. Were any laws broken? Why or why not?
Resources US Department of Health and Human Services: Joint Guidance on the Application of FERPA and HIPAA to Student Health Records US Department of Health and Human Services and US Department of Education: Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) To Student Health Records American Academy of Pediatrics: Sample Authorization to Use or Share HIPAA-Protected Health Information and FERPA- Protected Educational Records California School-based Health Alliance: A California Guide for Sharing Student Health and Education Information Mental Health Technology Transfer Center Network: HIPAA and FERPA Laws: A School Mental Health Navigation Tool National Center for Youth Law: HIPAA or FERPA? A Primer on Sharing School Health Information in California, Second Edition National Law Review: Understanding the Privacy Rights of HIPAA and FERPA in Schools The Network for Public Health Law: Family Educational Rights and Privacy Act Data Privacy in School Nursing: Navigating the Landscape of Data Privacy Laws (Part I) Data Privacy in School Nursing: Navigating the Landscape of Data Privacy Laws (Part II) State of Colorado: Authorization Consent to Release Information
Additional Questions Contact Agency Contact Person and Title Contact Email Address Contact Phone Number
