Connections Feature Article, April 2005

April, 2005

Understanding FERPA
A quick overview of a 30-year-old federal law

The Connections community participates in monthly conference calls that address topics of interest among members. In February, the monthly Connections conference call centered around the Family Educational Rights and Privacy Act, also known as FERPA.

The conference call featured guest speaker Gail Horlick, a lawyer and public health analyst at the Centers for Disease Control (CDC), who provided “a quick overview of FERPA.” Beverly Dozier, Privacy Officer in the Office of the Director at CDC, provided comment and answered questions from the participants.

FERPA facts
The Family Education Rights and Privacy Act (FERPA) of 1974 is federal law, often called the Buckley Amendment, and it gives parents of students under 18, and students 18 and over, the right to examine the student’s individual education records. These may contain health-related information, including medical records.

Major provisions of the Act are:

Parents and eligible students have the right to inspect and review the student's educational records.
Schools must have written permission from the parent or eligible student before releasing information from a student's records. Some information recipients are exempt from the consent requirement (e.g., other school officials, a school to which a student is transferring, certain government officials, and state and local authorities). The school, however, must log requests for these records in the student’s file, and parents and eligible students can inspect this information.
Parents and eligible students have the right to have information release records explained and interpreted by school officials.
School officials may not destroy any education records if there is an outstanding request to inspect and review them.

Parents and eligible students who believe that information in the education records is inaccurate or misleading may request that the records be amended. The parent or eligible student must be advised if the school decides that the records should not be amended.

Finally, each school district must give parents of students in attendance, or students age 18 or over, an annual notice to inform them of their rights under this law, and the right of parents and eligible students to file a complaint with the U.S. Department of Education.

FERPA and public health
FERPA protects the individual school record and exercises some control over a student’s record among schools that receive federal funds – that is, most public schools. Health information is considered part of the education record, as is early intervention health information that is funded by the Individuals with Disabilities Education Act (IDEA) Part C.

When a request for health information is submitted to a school, FERPA requires written parental consent to disclose almost any of the education record’s content, except basic “directory” information, such as name and address. The written consent statement must include the purpose of disclosure and with whom the health information will be shared. Schools may disclose limited information in cases of health and safety, such as health emergencies and “imminent danger.” Some states have laws governing the exchange of information between schools. Since FERPA is a federal law, it supercedes or preempts state laws.

Public health faces the challenge of obtaining health information from early intervention programs and immunization records for school-age children. To integrate or access a child’s early intervention program information in the process of coordinating care for public health services, a public health agency could be required to seek parental consent. Likewise, parental consent may be needed for a school health nurse to enter immunization information into a state registry, if that immunization was provided by an individual or with resources from the Department of Education.

Decisions about when parental consent is needed to obtain public health information vary substantially by state. Guest speakers Gail Horlick and Beverly Dozier advised working with the state attorney, as specific guidelines do not exist at the federal level.

The CDC is launching a study to examine the qualitative and quantitative information about obtaining disclosure. They are exploring issues about how to resolve differences between education and health records.

Relationship of HIPAA and FERPA
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and FERPA both address the handling of health information, and their similarities can be confusing.

HIPAA and state laws govern disclosure of health information to schools and to other providers of health care services. HIPAA legislation includes a provision to exclude records covered by FERPA, such as school health records. FERPA legislation regulates the release of the individually identifying information in school records.

Report on FERPA due in May 2005
Congress has asked the Department of Education and Department of Health and Human Services to work together to provide clarification to states regarding disclosure of information to public health agencies. Confusion continues over the ways in which states interpret the release of public health information from school-based records and early intervention programs. The report is expected in May 2005.

Q&A with Gail Horlick and Beverly Dozier

Participants raised several questions during the discussion period. Questions and responses are below.

Consent to release information

Q: In our state, the required hearing screenings for school are generally performed by an outside vendor. Could those screenings be added to the education record and the hearing screening program database?

A: In general, it depends on who is paying: the state education system or the public health department. If the education system is financially responsible for the hearing screen, then the screening information is covered under FERPA. If, however, the public health department has contracted with a vendor to conduct the hearing screening, then the screening information might not be covered under FERPA. It is difficult to provide advice for such a situation without more information, which should be confirmed with a state’s legal authority.

Note: FERPA applies only to individual-level information. Schools are permitted to release aggregate population information that does not include personal identifying information.

School clinics

Q: How does FERPA apply to information about services provided in a school-based clinic?

A: A school-based clinic is a murky area. The federal government has not issued clear guidance. The records of school clinics maintained separately from the school system might not be considered part of the educational record – but this is not a legal opinion.

Conflicting requirements

Q: CDC immunization grants require the inspection of immunization information from school health records to validate survey results. This is an obligation for the state under its grant money, and these reviews have been conducted without obtaining parental consent for each child. States have complied. Does this mean that the state’s obligation to CDC for the grant money conflicts with FERPA’s parental consent requirement?

A: The Department of Education would most likely interpret school-based immunization review as falling under the aegis of FERPA; therefore, individual parental consent would be required. In this case, however, CDC grants are within the purview of the Department of Health and Human Services (HHS) and it is not clear how HHS would respond.

Q: In addition to sharing immunization information, a public health department typically shares IDEA Part C information with other public health programs to coordinate services. For example, early intervention services may be coordinated with special health care needs services. Does FERPA apply in this situation?

A: States vary in their interpretation of this situation. It appears to depend on whether the funds to support the IDEA Part C program flow through the health department or through the education system. When money flows through the public health department, some states have interpreted this to mean that the money is public health money and FERPA does not apply. Other states have differed and concluded that if the IDEA Part C funds flow through the education system, FERPA applies. Still other states have concluded that regardless of which state agency handles the funds for the delivery of early intervention services, the money originates with the Department of Education and therefore FERPA applies.

Clearly, there is no consensus or consistency in how funding streams or the laws are interpreted. State agencies embarking on information system integration projects should include legal review in their plans.

For more information, view this Department of Education FERPA summary:
http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html

HOME | SITE MAP | CONTACT US | SEARCH | PRIVACY POLICY

Last updated November 1, 2005 November 1, 2005