A Pennsylvania court's view of HIPAA, FERPA, and student records

The Pennsylvania Superior Court considered, and rejected, the notion that two federal privacy statutes create privileges against disclosing student records during the course of litigation discovery. But a state law, however, might bar production of such records.

The case involved a former student’s discovery demands in a case against a private special school. Student alleged he suffered sexual abuse and sought records relating to other similar possible past claims against the school. The school opposed producing any such records citing various statutory confidentiality protections against disclosing records involving other students.

The court found that the Health Insurance Portability and Accountability Act of 1996, known as “HIPAA,” and the Federal Educational Rights and Privacy Act, known as “FERPA,”  set forth the parameters by which protected student records can be disclosed and that, generally, disclosure pursuant to court order is an exception to the non-disclosure rule. In this respect, the state court decision comports with the statutes.

More interesting is how the court viewed the argument about a privilege against litigation disclosure based on state law. The Pennsylvania Mental Health Procedures Act, known as the “MHPA,” is seen as creating a privilege, with the only exception being legal proceedings permitted under the MHPA. The court did not decide the ultimate issue but instead sent the case back to the trial court to consider with the school was a “facility” under the MHPA and whether the MHPA actually applied. 

The case is a good reminder that many times state laws can offer more protections (or obstacles depending on your position) than federal laws. 

Proposed changes to FERPA regulations

On March 24, 2008 the U.S. Department of Education published proposed changes to the Family Educational Rights and Privacy Act (known as FERPA) regulations.  The changes are needed because of various statutory acts like the USA Patriot Act, two U.S. Supreme court cases, technology changes, and events like the Virginia Tech tragedy. The Department seeks comment and input on the proposal.

The proposed regulations offer definitional changes (clarifying that cyber-students “attend” a school; that social security numbers, student ID numbers, and unique electronic identifiers are not disclosable directory information, and more). Another proposal would permit a school receiving a record, such as a transcript to provide the record to the creating institution in order to verify the record as accurate and not falsified. “Personally identifiable information” is also changed to include information that, alone or in conjunction with other information, can lead to private student information (such as mother’s maiden name and information). 

Of particular interest in the higher education area, the proposal addresses concerns raised in the wake of the Virginia Tech tragedy and attempts to provide better guidance and assurance on disclosing information in health and safety situations. For students 18 and over, the proposal clarifies certain circumstances in which information can be disclosed to parents without consent, for example: when the student is a federal tax dependent of the parents; when necessary for health and safety; and when a student under age 21 violates substance abuse policies. 

The proposal also clarifies the means by which outside parties, such as contractors, may receive records without prior consent. Other matters address disclosure of “de-identified” information, verifying the identity of the person requesting records, among other items.

The Department will receive comments up to May 8, 2008. The link information explains how to submit comments.

New federal FERPA / privacy guidance and emergency preparedness planning

After a national dialogue following the tragic loss of life at Virginia Tech, on October 30, 2007, the U.S. Department of Education issued additional guidance regarding the Family Educational Rights and Privacy Act (“FERPA”).   According to the Secretary’s accompanying letter, educators and others identified the need for clarification about FERPA rights and obligations. 

The Department issued guidance directed to both elementary and secondary education, “Balancing Student Privacy and School Safety: A Guide to the Family Educational Rights and Privacy Act for Elementary and Secondary Schools” and higher education, “Balancing Student Privacy and School Safety: A Guide to the Family Educational Rights and Privacy Act for Colleges and Universities.”  A separate guidance is also available for parents, “Parents' Guide to the Family Educational Rights and Privacy Act: Rights Regarding Children’s Education Records.”

In addition to the FERPA issue, the Department, in conjunction with other federal agencies, is making available a summary to assist with development of an emergency management plan. 

With respect to emergency planning, including in the educational setting, the National Council on Disability,  draws attention to the first of FEMA’s promised series called, A Reference Guide for Accommodating Individuals with Disabilities in the Provision of Disaster Mass Care, Housing and Human Services.  Additional emergency planning information in this regard can be found here

Annual notice time

Annual notices are one among the many things that school administrators must remember to do at this busy time of year. The National School Boards Association has issued a convenient summary regarding the multiple notices that schools (including higher education institutions in some cases) must provide to parents, students, and the public, complete with handy links to model forms and other information. 

You should note that the model forms links are to federal models and are not specific to a particular state's or district's requirements or needs. A district should consider its unique circumstances for each notice, for example, whether the FERPA notice covers independent contracts, such as private student evaluators, sufficiently to meet anticipated district needs. 

FERPA guidance for higher education

The Family Policy Compliance Office (“FPCO”)  of the U.S. Department of Education has issued a policy guidance statement with respect to the Family Educational Rights and Privacy Act, known as FERPA, and higher education. 

The statement, “Disclosure of Information from Education Records to Parents of Postsecondary Students,”  is a question-and-answer formant addressing issues arising in the postsecondary setting. Among other things, the statement addresses application of the Health Insurance Portability and Accountability Act of 1996, known as HIPPA, to student records, as well as when an institution may notify parents of student alcohol / drug use.