Health Insurance Portability and
Accountability Act privacy rule. Thus,
notices required by HIPAA for subpoenas
(and HIPAA releases) usually do not
apply to these records. However, a
number of factors must be considered
in determining if records created and
maintained by a student health center
must be disclosed in response to a
subpoena. One of these factors is whether
or not the records are “treatment
records,” and, as such, are excluded
because they are not “education records”
under the FERPA definition of education
record. If the records are shared with the
student or made available to anyone for
any purpose, and are no longer available
solely to professionals rendering
treatment, the records lose their status
as “treatment records” and become
“education records”. Another factor
is whether or not the clinic provides
services to students based on their status
as a student, or if services are provided to
anyone without regard to their status as
a student at the institution. An example
is a university-affiliated hospital. If
the medical facility provides services
without regard to the student’s status,
the records are not “education records”
or “treatment records” under FERPA;
assuming that the medical facility is
otherwise subject to HIPAA, the records
maintained by the university-affiliated
hospital are subject to HIPAA. Another
factor relates to billing records if the
student health clinic bills for its services.
The examples provided are only
a few of the factors that must be
considered in determining whether
student health center records must be
provided in response to a subpoena.
Due to the complexities involved when
attempting to apply both of these laws
to these records, the U.S. Department
of Education and the U.S. Department
of Health and Human Services issued a
joint guidance letter in November 2008
explaining how HIPAA and FERPA
apply to student records (https://
studentprivacy.ed.gov/resources/jointguidance
12 Q3 - 2017 www.ParalegalToday.com
application-ferpa-and-hipaastudent
health-records).
What are an Institution’s Responsibilities
Under FERPA?
Under FERPA, an institution may
disclose only “directory information”
without a student’s consent. The specific
information included in directory
information is selected by the institution
from a list of items (such as contact
information, dates of attendance,
classification, and date and place of
birth) that it is allowed to be released
under FERPA. Institutions must provide
all students an annual FERPA notice that
a student has the right to inspect and
review his records; amend his records
and the steps necessary to do so; consent
to disclosures of personal information,
except for disclosures authorized by
FERPA and its implementing regulations;
and file a complaint with the U.S.
Department of Education. Most schools
provide this notice through a catalog
or bulletin and through their website,
usually on the registrar’s page.
Otherwise, an institution may disclose
a student’s records pursuant to a
lawfully issued subpoena only after it
complies with FERPA requirements.
There are 16 specific circumstances
under which an institution may release
a student’s education records without
prior notice to the student or without
the student’s consent. A subpoena is
one example in which the student’s
prior consent is not required; however,
the school must make “a reasonable
effort” to notify the student of the order
or subpoena in advance of compliance,
so that the student may seek protective
“...an institution may
disclose a student’s
records pursuant to
a lawfully issued
subpoena only after
it complies with
FERPA requirements.”
/www.ParalegalToday.com