The Department of Education and the Office for Civil Rights has released updated guidelines which aims to set in stone when students’ health information can be made available via the Family Educational Rights and Privacy Act and HIPAA.
Guidance which was first published in November 2008 has been brought up to date and refreshed so as to assist school administrators, healthcare professionals, families and others better understand how FERPA and HIPAA apply to education and health records held in relation to students.
The guidance tackles the issue regarding when a student’s health information can be disclosed without the written consent of the parent or eligible student under FERPA, or without written authorization under the HIPAA Privacy Rule. It says: “Without a patient’s authorization or agreement, healthcare providers may disclose a patient’s health information to anyone who is in a position to prevent or lessen the threatened harm, including family, friends, caregivers and law enforcement”.
OCR Director Roger Severino released a statement which said: “This updated resource empowers school officials, healthcare providers and mental health professionals by dispelling the myth that HIPAA prohibits the sharing of health information in emergencies.
Health and Human Services Secretary Alex Azar said: “The Trump Administration has made it a priority to help Americans with substance use disorder or serious mental illness and their families, and this resource takes another meaningful step by clarifying how students’ health information can be shared with those in the best position to help them.”
According to the agencies, sharing information is acceptable in certain situations without the written consent of the parent or eligible student under FERPA or without authorization under the HIPAA Privacy Rule. This is particularly the case in when it is linked to emergency health or safety situations. The guidance says: “Healthcare providers may share (protected health information) with anyone as necessary to prevent or lessen a serious and imminent threat to the health or safety of the individual, another person, or the public—consistent with applicable law (such as state statutes, regulations or case law) and the provider’s standards of ethical conduct”.