HIPAA and FERPA

In 1996, the U.S. Congress passed the Health Insurance Portability & Accountability Act (HIPAA).  The purpose of HIPAA is to improve the efficiency and effectiveness of the health care system by standardizing the electronic data interchange of certain administrative and financial transactions.  The U.S. Department of Health and Human Services issued regulations that focus on three areas:

• Privacy Rule – Establishes privacy requirements for oral, written or electronic individually identifiable health care information.  Compliance Date -  April 13th, 2003.  The HIPAA Privacy Rule excludes from its provisions all education records covered by the Family Educational Right and Privacy Act (20USC 1232g), including individually identifiable student health information.
• Security Rule – Establishes security requirements for electronic health care information.  Compliance Date - April 21, 2005
• Transaction Rule – Standardizes formats for electronic health care claims and transactions.  Compliance Date - October 16, 2003.

Since the arrival of HIPAA in April 2003, confusion surrounding changes in health information sharing has hindered health care in schools.  Physicians, hospitals and other HIPAA Covered Entities have over interpreted restrictions on sharing health information required for school entrance and for treatment of students who receive IDEA mandated services.

 
Resources

Confident about Confidentiality? HIPAA/FERPA Made Easy
An NASN Radio broadcast delivered by Martha Bergren
June 2009
     Go to the NASN Radio page and play from the list of archives.

Privacy Standards for Student Health Records 
an NASN Issue Brief 
    Go to the document
 
Protecting and Disclosing Student Health Information
How to Develop School Health Policies and Procedures
ASHA, NASN, & NASSNC: Guidelines that could assist school administrators, health professionals, and educators in developing appropriate policies and procedures that ensure that confidential student health information is appropriately protected. National Task Force on Confidential Student Health Information; a Project of American School Health Association in Collaboration with National Association of School Nurses and National Association of State School Nurse Consultants. 2005 (6" x 9", 67 pages) 
    Go to the NASN Bookstore for more information 
 
Privacy Protections for Medical Records of Non-Covered Entities
A transcript from the National Committee on Vital and Health Statistics (NCVHS) Hearing of the Subcomittee on Privacy and Confidentiality dated September 15, 2007
from the U.S. Department of Health and Human Services
    Go to the document
 
FERPA and the Intersection of FERPA and Public Health
an archived Webinar dated November 12, 2010
hosted by the U.S. Department of Education's Family Policy Compliance Office and the Office of Safe and Drug-Free Schools
    Go to the Webinar
 
Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) And the Health Insurance Portability and Accountability Act of 1996 (HIPAA) To Student Health Records 
from U.S. Department of HHS and U.S. Department of Education
    Download document (Adobe® PDF Format)  
 
Richard Campanelli, Director of the Office of Civil Rights, DHHS - Letter of Response
Attached is a letter from Richard Campanelli, Director of the Office of Civil Rights, from the Department of Health and Human Services, received July 23, 2004, in response to the August 20, 2003 letter from the National Association of School Nurses (NASN), National Association of State School Nurse Consultants (NASSNC) and the National Assembly on School-Based Health Care (NASBHC) requesting guidance on this issue.  This letter clarifies the Department's interpretation of the HIPAA Privacy Rule as it applies to the sharing of child immunization and health assessment data by physicians with schools when the immunizations and examinations are mandated by state law for entry or reentry into school.  As the USDHHS is the federal authority on the HIPAA Privacy Rule, this indicates that states must pass a specific law to require such physician release to schools, for example the law passed in Connecticut (CT Public Act No. 03-211, Sec. 9(b), 2003), or else physicians must obtain parental authorization for such releases, even if it delays student entry into school. 
     Download document (Adobe® PDF Format)  
 
National Conference on the HIPAA Privacy Rule. (2003). NASN Newsletter
This article is a review of information from the national conference on the HIPAA Privacy Rule sponsored by the U.S. Department of Health and Human Services (HHS) in Chicago on March 2, 2003.  The faculty for the conference were senior privacy policy staff at the Office for Civil Rights (OCR) of HHS.  The article describes a summary of the comments related to school nurse issues, including: HIPAA covered entities, exemptions to the Privacy Rules, student health records,  fax machines, business associates, minimum necessary, and disclosure of psychotherapy notes. 
Document courtesy of the NASNewsletter 
    Download document (Adobe® PDF Format)