Source: http://familypolicy.ed.gov/content/letter-alabama-department-education-re-disclosure-immunization-records
Timestamp: 2017-07-25 02:53:04
Document Index: 38486039

Matched Legal Cases: ['§ 1232', '§ 99', '§ 300', '§ 1232', '§ 99', '§ 1232', '§ 99', '§ 1232', '§ 99', '§ 99', '§ 99', '§ 99', '§ 99', '§ 99', '§ 1232', '§ 99']

Letter to Alabama Department of Education re: Disclosure of Immunization Records | Family Policy Compliance Office
Letter to Alabama Department of Education re: Disclosure of Immunization Records February 25, 2004
FERPA is a federal law that protects privacy interests of parents in their children's "education records," and generally prevents an educational institution from having a policy or practice of disclosing the education records of students, or personally identifiable information contained in education records, without the written consent of the parent. The term "education records" is defined as all records, files, documents and other materials which contain information directly related to a student and are maintained by the educational agency or institution or by a person acting for such agency or institution. 20 U.S.C. § 1232g(a)(4)(A); 34 C.F.R § 99.3 "Education records."
Additionally, the records of a student that pertain to services provided to that student under the Individuals with Disabilities Education Act (IDEA) are "education records" under FERPA and are subject to the confidentiality provisions under IDEA (see 34 C.F.R §§ 300.560-300.576) and to all of the provisions of FERPA. When a student reaches the age of 18 or attends an institution of postsecondary education, the student is considered an "eligible student" under FERPA and all of the rights afforded by FERPA transfer from the parents to the student. 20 U.S.C. § 1232g(d); 34 C.F.R § 99.3 "Eligible student."
Thus, education records, including individually identifiable health information contained in such records, that are subject to FERPA, are specifically exempt from the HIPAA Privacy Rule. The reason for this exemption is that Congress, through FERPA, previously addressed how education records should be protected.
Therefore, student immunization records that are maintained by an educational agency or institution subject to FERPA that directly relate to a student or students are considered to be education records under FERPA and are not subject to the HIPAA Privacy Rule. Accordingly, HIPAA neither authorizes nor permits the disclosure of these records.
Under FERPA, there are a number of several specific statutory exceptions to the general rule against nonconsensual disclosure that are set forth at 20 U.S.C. § 1232g(b)-(j) and 34 C.F.R § 99.31. However, there is no exception to FERPA's prior consent rule that would permit a school subject to FERPA to disclose health or other immunization records to a State health agency such as DPH under the circumstances described in Dr. Williamson's April 22, 2003 memorandum. A very limited exception to FERPA's prior consent rule allows educational agencies and institutions to disclose personally identifiable non-directory information to appropriate officials in connection with a health or safety emergency. Specifically, FERPA provides that education records may be disclosed without consent:
in connection with an emergency [to] appropriate persons if the knowledge of such
information is necessary to protect the health or safety of the student or other persons.
20 U.S.C. § 1232g(b)(1)(I). However, the regulations implementing this provision at 34 C.F.R §§ 99.31(a)(10) and 99.36 indicate that these conditions will be "strictly construed."
The exception to FERPA's prior written consent requirement was created with the first FERPA amendments that were signed into law on December 13, 1974. The legislative history demonstrates that Congress intended to limit application of the "health or safety" exception to exceptional circumstances, as follows:
In summary, educational agencies and institutions subject to FERPA may disclose personally identifiable, non-directory information from education records under the "health or safety emergency" exception only if the agency or institution determines, on a case-by-case basis, that a specific situation presents imminent danger or threat to students or other members of the community, or requires an immediate need for information in order to avert or diffuse serious threats to the safety or health of a student or other individuals. Any release must be narrowly tailored considering the immediacy and magnitude of the emergency and must be made only to parties who can address the specific emergency in question. This exception is temporally limited to the period of the emergency and generally does not allow a blanket release of personally identifiable information from a student's education records to comply with general requirements under State law. Certainly an outbreak of diseases such as measles, rubella, mumps, and polio not only pose threat of permanent disability or death for the individual, but have historically presented themselves as epidemic in nature. Thus, disclosure of personally identifiable information from students' education records to State health officials for such reasons would generally be permitted under FERPA's health or safety emergency provisions.
In disclosing the information to a State health agency, a school should advise the agency that personally identifiable information disclosed by the school may not be redisclosed or shared with any other party outside of the appropriate officials at that agency, unless such disclosure is done with the prior written consent of parents or eligible students or is done on behalf of the school for the same purpose it was disclosed to the agency. See 34 C.F.R § 99.33. Further, FERPA establishes a recordkeeping requirement for educational agencies and institutions in 34 C.F.R § 99.32. Briefly, this section states that an educational agency or institution (1) shall maintain a record of each request for access to and each disclosure of personally identifiable information from the education records of each student and (2) shall maintain the record with the education records of the student as long as the records are maintained. The record of disclosure must also include: (1) the parties who have requested the information from the education records, and (2) the legitimate interests the parties had in requesting or obtaining the information.
Please note, however, that FERPA does not prohibit an educational agency or institution from disclosing "non-personally identifiable information" to State health officials. Rather, FERPA specifically prohibits the disclosure of personally identifiable information from education records without the prior written consent of parents and students under 34 C.F.R § 99.30. The FERPA regulations at 34 C.F.R. § 99.3 define personally identifiable information to include:
34 C.F.R § 99.30(b); see 20 U.S.C. § 1232g(b)(2)(A).
If requested, the agency or institution must provide a parent or student with a copy of the records disclosed. 34 C.F.R § 99.30(c).
I hope that this letter adequately explains the requirements of FERPA as they relate to the disclosure of personally identifiable information to the DPH by educational agencies and institutions subject to FERPA. Should you have any further questions, please do not hesitate to contact this Office at the following address and telephone number:
Document: alhippaa.doc The Privacy Policy of the United States Department of Education is as follows: no personal information about you is collected unless you choose to provide it. The Department of Education does not give, share, sell, or transfer any personal information to a third party. If you want to know more about how non-personal information about your visit is recorded or how the information that you voluntarily submit is used, please click here.