Please note: The Office of School Health at the New Hampshire Department of Education drafted this document in response to questions from school nurses and other personnel from New Hampshire schools. While most of the information provided here is applicable to all states, certain statements deal specifically with NH. These statements explicitly indicate that they are NH specific. You must refer to your own state laws for guidance in those areas. This document attempts to succinctly answer the most frequently asked questions regarding FERPA and Health Records but cannot be substituted for legal advice.
FERPA, HIPAA, and the confidentiality required by one's nursing license all may contribute to the constraints placed on public school nurses.
The Family Educational Rights and Privacy Act is a federal law that outlines who has access to education records. It applies to all schools that receive federal funds from a program administered by the U.S. Department of Education.
Yes. Student health records maintained by school employees are considered part of the education record with only these two exceptions.
1. The "treatment records" of an "eligible student" are not considered part of the education record.
- "Eligible student" is one who is at least 18 years old or attending a postsecondary institution (34 C.F.R §99.3)
- "Treatment records" are those made, maintained, and used only in connection with the student's treatment and not disclosed to anyone other than individuals providing treatment. (20 USC. §1232g(a)(4)(a))
2. Your school does not receive federal funds as mentioned above.
The Health Insurance Portability and Accountability Act is another federal law that dictates how health records are to be handled. A school is subject to HIPAA only if it provides medical care and electronically transmits health information as part of a "covered transaction" (e.g., billing). See 45 CFR §160.103. For schools that meet that criteria please see this additional guidance .
For most schools, HIPAA will only be an issue when you communicate with a student's medical provider. While you are not regulated by HIPAA, almost all medical practitioners you deal with are covered by HIPAA. They can not disclose protected medical information without authorization except for treatment purposes, payment and operational purposes. Since "treatment purposes" is one of the exceptions, a practitioner may relay or clarify treatment orders to individuals involved in the treatment of that patient (e.g., school nurse) without obtaining authorization.
Some medical offices may not have a thorough understanding of HIPAA. While it is entirely legal for them to clarify treatment plans, etc., without authorization, many offices may still refuse to do so. You might share this response from the U.S. Department of Health on this matter.
Eligible students and parents of minor students have a right to see their records. (Eligible students are those that are at least 18 or those who are attending a postsecondary institution. (34 C.F.R §99.3) In general, parental consent is required for others to access information in students' health records.
Below are some of the circumstances where consent is not required. (See 20 USC. §1232g(b)-(j) and 34 C.F.R §99.31).
- School officials, including teachers, that the school or district has determined to have "legitimate educational interests" (defined below).
- In an emergency "if knowledge of the information is necessary to protect the health or safety of the student or other individuals" (See 34 C.F.R. §99.36(a)).
- Instances of abuse or neglect.
- Mandatory reporting of communicable diseases (please see page 3 of this document for exceptions).
- Information that is required by a school to which the student is transferring.
- Certain legal situations including subpoenas or investigations of criminal offenses.
School officials can have access to only the education records necessary to carry out their job function. "In general, legitimate educational interest refers to the right of certain school officials to access student information and records for the purpose of (a) serving the student; (b) protecting the health, safety, and learning of this student and others; (c) maintaining operations of the school district; (d) obtaining payment for educational programs and services; and (e) other purposes as specified in Federal and state law."
Source: Schwab NC, Rubin M, Maire JA, Gelfman MHB, Bergren MD, Mazyck D, Hine B. (2005), Protecting and Disclosing Student Health Information: How to Develop School District Policies and Procedures. Kent, OH: American School Health Association.
A school-wide health concerns distribution list violates FERPA and is not best practice. If individual staff or faculty members need to be informed of a student's condition, that student requires an ECP (emergency care plan) listing symptoms to be alert for and the required response to those symptoms. It is recommended that parents, as a part of the IHP (individual health plan), participate in deciding who on staff and faculty requires identifiable health information for the child's safety. Staff and faculty who are trusted with personally identifiable health information should receive training regarding their responsibility to safeguard that information.
Nurses can ensure that confidentiality is respected by revealing only necessary health concerns and only to those individuals whose knowledge may affect the student's health. For example, individuals who have no contact with a particular student have no need to know that student's medical or mental health issues. Using functional implications is not only more discrete but has the additional benefit of delivering more practical information to school employees that generally have limited medical knowledge.
The best approach to handling this potential problem is to work with your school administration to draft medical information policies that are consistent with the requirements of both FERPA and the state Board of Nursing.
No, but only if all of the following criteria are met:
- The notes are kept only as a memory aid;
- They remain in the sole possession of the writer;
- They are shared with no one except a temporary substitute RN; and
- They are not used to replace or avoid normal documentation.
In general, personal notes are not recommended. Information related to health office visits should be documented in the student's individual record.
Source: Schwab NC, Rubin M, Maire JA, Gelfman MHB, Bergren MD, Mazyck D, Hine B. (2005), Protecting and Disclosing Student Health Information: How to Develop School District Policies and Procedures, Kent, OH: American School Health Association.
The Family Policy Compliance Office of the U.S. Department of Education responded to this issue in a letter to University of New Mexico.
- Abuse or neglect: School employees are required to report suspected abuse or neglect. FERPA does not override that responsibility.
- Certain reportable diseases: Some communicable diseases require emergent reporting while other diseases represent a less imminent public health threat. For example, the NH Department of Health and Human Services divides reportable disease into two categories: those that require reporting within 24 hours and those that must be reported within 72 hours. If reporting must occur within 24 hours, the Family Policy Compliance Office of the U.S. Department of Education has determined that indicates "imminent danger." As such, those illnesses may be reported without obtaining consent. The diseases on the 72 hour list do not pose imminent danger so school officials must obtain consent before disclosing this information.
- Concern that a student may hurt self or others: if someone is in imminent danger, no consent is required.
- De-identified data: It is permissible to share health related data that does not contain information that makes the student's identity readily traceable.
This issue was discussed by the Family Policy Compliance Office of the U.S. Department of Education in a letter to the Department of Education in Alabama. Based on that response, we offer the following guidance. You can share immunization records with parents or with a school where the student is transferring without obtaining consent. However, before providing immunization records to an outside medical office or state Department of Health, you must get written consent. You can share deidentified data such as total number of students that are up-to-date, that require additional immunizations, and total number that are exempt without obtaining consent. Check the specific laws in your state and consult your school's attorney if clarification is needed.
If the school evaluates the information available at the time and feels that there is an "articulable and significant threat to the health or safety of a student or other individuals, it may disclose information from education records to any person whose knowledge of the information is necessary to protect the health or safety of the student or other individuals."
(34 C.F.R §99.36 (c)) It is not necessary to first collect evidence before contacting those that can intervene to protect the student or others.
Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record to outside parties including providers. However, a school nurse may call a student's health care provider to clarify facts surrounding a student's condition or treatment plan. As stated under "What about HIPAA? How Does That Affect School Health Services?" the physician's office may relay or clarify treatment orders to individuals involved in the treatment of that patient (e.g. school nurse) without obtaining authorization. The medical office may be hesitant to discuss any details without first getting signed authorization. Remember that both you and the health care provider are working in the best interests of the child. Respectful communication should allow both sides to find an acceptable plan so that you can obtain the necessary information.
FERPA does not protect the confidentiality of information in general. FERPA prohibits the improper disclosure of information contained in the education record. FERPA does not apply to one's opinions or observations unless it is entered into the record. However, you must consider the fact that confidentiality of facts learned in the course of your nursing duties may be required by the virtue of your nursing license.
National Forum on Education Statistics (2006). Forum Guide to the Privacy of Student
Information: A Resource for Schools (NFES 2006-805) . U.S. Department of Education, Washington, DC, National Center for Education Statistics.
National Association of School Nurses, Issue Brief - Privacy Standards for Student Health Records, 2004.
Acrobat Reader format. You can download a free reader from Adobe.