From the Joint Guidance on the Application of
the Family Educational Rights and Privacy Act (FERPA) and the
Health Insurance Portability and Accountability Act of 1996
To Student Health Records:
Where FERPA and HIPAA May Intersect
When a school provides health care to students in the normal
course of business, such as through its health clinic, it is also a
“health care provider” as defined by HIPAA. If a school also
conducts any covered transactions electronically in connection with
that health care, it is then a covered entity under HIPAA. As a
covered entity, the school must comply with the HIPAA
Administrative Simplification Rules for Transactions and Code Sets
and Identifiers with respect to its transactions.
However, many schools, even those that are HIPAA covered
entities, are not required to comply with the HIPAA Privacy Rule
because the only health records maintained by the school are
“education records” or “treatment records” of eligible students
under FERPA, both of which are excluded from coverage under the
HIPAA Privacy Rule. See the exception at paragraph (2)(i) and
(2)(ii) to what is considered “protected health information” (PHI)
at 45 CFR § 160.103. In addition, the exception for records covered
by FERPA applies both to the HIPAA Privacy Rule, as well as to the
HIPAA Security Rule, because the Security Rule applies to a subset
of information covered by the Privacy Rule (i.e., electronic PHI).
Information on the HIPAA Privacy Rule is available at: http://www.hhs.gov/ocr/hipaa/.
Information on the other HIPAA Administrative Simplification Rules
is available at: http://www.cms.hhs.gov/HIPAAGenInfo/.
David P. Lawrance, MD
Medical Director, McKinley Health Center
University of Illinois at Urbana-Champaign