Watch our quick school nurse guide to FERPA video HERE.

When it comes to student health records in schools, the complexity of legal requirements, standards of practice, and the various roles, rights, and responsibilities amongst parents/guardians, students, school nurses, and other school staff, can make it difficult to ascertain when and how data about students can be shared lawfully and appropriately.  Like all healthcare professionals, school nurses are familiar with and comfortable practicing under HIPAA, the Health Insurance Portability and Accountability Act, that “protects sensitive patient health information from being disclosed without the patient’s consent or knowledge.”  Most schools, however, are not bound by HIPAA, but instead by FERPA, which protects the privacy of student education records and gives parents the right to these records, as well as to consent to their disclosure.  It’s not as confusing as it may seem, however, as health records do not need the protection of HIPAA because they are protected by FERPA which is as or even more restrictive in its privacy restrictions.  What does this mean for school nurses in practice?

Is your school bound to FERPA?

All public or private schools–elementary, secondary, and post-secondary–that receive funds from programs administered by the United States Department of Education are subject to FERPA.

What constitutes a student education record?

FERPA protects students’ privacy in “education records” which, under FERPA, are defined as “any records that contain information directly related to a student and which are maintained by an educational agency or institution or by a party acting for the agency or institution.”

This includes student health records, immunization records, and other health records kept and maintained by the school nurse.

What are the rights of parents under FERPA?

FERPA gives parents/guardians and eligible students (over 18 years of age), the right to inspect and review their student’s educational records, request amendments for inaccuracies or errors, and to consent to the disclosure of the records.  Basically, parents or eligible students have control of their respective educational records and schools cannot disclose any personally identifiable information within the records without written consent.

What is personally identifiable information?

Also called PII, personally identifiable information in education records, as it pertains to FERPA, includes any information that can be used to distinguish or trace an individual’s identity either directly (name, ID) or indirectly (DOB), through linkages with other information.

What are permitted disclosures under FERPA?

FERPA allows the disclosure of information in student education (health) records without prior consent under these limited circumstances:

• To school administration, faculty, or staff, who have a “specific and legitimate educational interest in the information for supporting the student’s academic achievement or maintaining a safe and orderly learning environment.”
• To other schools, if a student is transferring
• To state or local officials if the disclosure concerns the juvenile justice system
• To comply with a judicial order or lawfully issued subpoena
• To appropriate officials in connection with a health or safety emergency (make sure to record such disclosures!)

Some states may have more restrictive privacy and confidentiality laws, so it is important to brush up on your local regulations.  Additionally, keep handy on your desk, the ultimate Legal Resource for School Health Services.  Often, situations can arise throughout the school year that leave school nurses trying to figure out how to best interpret the application of FERPA.  The United States Department of Education has compiled a detailed list of FAQs that can help sort out many of these common conundrums and save school nurses valuable time.

School nurses spend long days creating, updating, maintaining, and storing student health records, as well as responding to requests for access to those records.  Understanding the laws and regulations that protect these records is paramount to safeguarding student privacy, ultimately promoting the health, safety, and well-being of students.