- Authorizations (30)
                              - Business Associates (41)
                              - Compliance Dates (2)
                              - Covered Entities (14)
                              - Decedents (9)
                              - Disclosures for Law Enforcement Purposes (5)
                              - Disclosures for Rule Enforcement (1)
                              - Disclosures in Emergency Situations (2)
                              - Disclosures Required by Law (6)
                              - Disclosures to Family and Friends (28)
                              - Disposal of Protected Health Information (6)
                              - Facility Directories (7)
                              - Family Medical History Information (3)
                              - FERPA and HIPAA (10)
                              - Group Health Plans (3)
                              - Incidental Uses and Disclosures (10)
                              - Judicial and Administrative Proceedings (8)
                              - Minimum Necessary (14)
                              - Notice of Privacy Practice (20)
                              - Preemption of State Law (10)
                              - Privacy Rule: General Topics (12)
                              - Protected Health Information (2)
                              - Public Health Uses and Disclosures (13)
                              - Research Uses and Disclosures (20)
                              - Right to an Accounting of Disclosures (8)
                              - Right to File a Complaint (1)
                              - Right to Request a Restriction (4)
                              - Safeguards (13)
                              - Security Rule (24)
                              - Smaller Providers and Businesses (145)
                              - Student Immunizations (8)
                              - Transition Provisions (3)
                              - Treatment, Payment, and Health Care Operations Disclosures (30)
                              - Workers Compensation Disclosures (5)
                              - Limited Data Set (6)
                              - Marketing (17)
                              - Marketing - Refill Reminders (16)
                              - Personal Representatives and Minors (12)
                              - Right to Access and Research (58)
                              - Mental Health (35)
                              - Health Information Technology (41)
                              - Telehealth (11)

                      -   
                      -   
                      -   
                      -   
                      -   

# Does FERPA or HIPAA apply to records on students at health clinics run by postsecondary institutions? 

*FERPA* applies to most public and private postsecondary institutions and, thus, to the records on students at the campus health clinics of such institutions.  These records will be either education records or treatment records under *FERPA*, both of which are excluded from coverage under the *HIPAA* Privacy Rule, even if the school is a *HIPAA* covered entity.  See the exceptions at paragraphs (2)(i) and (2)(ii) to the definition of “protected health information” at 45 *CFR* § 160.103. 

The term “education records” is broadly defined under *FERPA* to mean those records that are:  (1) directly related to a student and (2) maintained by an educational agency or institution or by a party acting for the agency or institution.  See 34 *CFR* § 99.3, “Education records.”

“Treatment records” under *FERPA*, as they are commonly called, are: records on a student who is eighteen years of age or older, or is attending an institution of postsecondary education, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice.

See 20 *U.S.C.* § 1232g(a)(4)(B)(iv); 34 *CFR* § 99.3, “Education records.”  For example, treatment records would include health or medical records that a university psychologist maintains only in connection with the provision of treatment to an eligible student, and health or medical records that the campus health center or clinic maintains only in connection with the provision of treatment to an eligible student.  (Treatment records also would include health or medical records on an eligible student in high school if the records otherwise meet the above definition.)

“Treatment records” are excluded from the definition of “education records” under *FERPA.*  However, it is important to note, that a school may disclose an eligible student’s treatment records for purposes other than the student’s treatment provided that the records are disclosed under one of the exceptions to written consent under 34 *CFR* § 99.31(a) or with the student’s written consent under 34 *CFR* § 99.30.  If a school discloses an eligible student’s treatment records for purposes other than treatment, the treatment records are no longer excluded from the definition of “education records” and are subject to all other *FERPA* requirements, including the right of the eligible student to inspect and review the records. 

While the health records of students at postsecondary institutions may be subject to *FERPA*, if the institution is a *HIPAA* covered entity and provides health care to *non*students, the individually identifiable health information of the clinic’s *non*student patients is subject to the *HIPAA* Privacy Rule.  Thus, for example, postsecondary institutions that are subject to both *HIPAA* and *FERPA* and that operate clinics open to staff, or the public, or both (including family members of students) are required to comply with *FERPA* with respect to the health records of their student patients, and with the *HIPAA* Privacy Rule with respect to the health records of their *non*student patients.

 

Created 11/25/08

Content last reviewed July 26, 2013