Henry Thiele's Library tagged HIPAA →  View Popular, Search in Google

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.
FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students."

FERPA googleapps records electronic legal privacy education hipaa

Does the HIPAA Privacy Rule apply to an elementary or secondary school?
Answer:
Generally, no.  In most cases, the HIPAA Privacy Rule does not apply to an elementary or secondary school because the school either: (1) is not a HIPAA covered entity or (2) is a HIPAA covered entity but maintains health information only on students in records that are by definition “education records” under FERPA and, therefore, is not subject to the HIPAA Privacy Rule. 

hipaa privacy law legal ferpa

The Health Insurance Portability and Accountability Act ("HIPAA") provides protection for personal health information held by covered entities. A covered entity under HIPAA is either: (1) a health plan, (2) a healthcare clearinghouse, or a (3) healthcare provider that transmits health information electronically in connection with certain administrative and financial transactions.

Schools are obviously not a covered entity health plan or healthcare clearinghouse. However, many school districts employ nurses, physicians, psychologists, or other healthcare providers who serve students and staff. Would the employment of these healthcare providers qualify a school district as a covered entity "healthcare provider" under HIPAA? The answer to this question depends on whether the school district: (1) furnishes, bills or receives payment for healthcare in the normal course of its business, and (2) transmits these covered transactions electronically.

Thus, if a healthcare provider serves students under contract with or otherwise under the direct control of a public school covered by FERPA, any student health records created or maintained by this person are considered education records under FERPA, and not personal health information under HIPAA. This is the case regardless of whether the healthcare is provided to students on school grounds or offsite. Therefore, the school district in the above example would be required to comply with FERPA's privacy requirements with respect to this student's health information, including the requirements to obtain parental or student consent (if 18) in order to disclose Medicaid billing information about a service provided to this student.

HIPAA FERPA privacy rights law schools