Privacy & Cybersecurity Law Blog

The U.S. Department of Education and the U.S. Department of Health and Human Services released joint guidance on the application of the Family Educational Rights and Privacy Act (“FERPA”) and the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule to student records. This is the first update to the agencies’ guidance since it was issued in 2008. The 27-page document includes FAQs clarifying for schools, health care professionals and families how FERPA and HIPAA apply to student education and health records. The FAQs answer which rule applies in particular circumstances, and what information can be shared, for example, when dealing with an adult student, a minor with a mental health condition or one who presents a danger to one’s self or others. The FAQs also address when educational institutions can disclose personal information from a student’s records, including health records, to the institution’s law enforcement officials or to the National Instant Criminal Background Check System.