It depends. Providers should review the HIPAA FERPA Decision Tree to determine which law applies.
In some cases, a school therapist’s records become part of the school’s education record, as they contain information related to a student and are created and maintained by“a school employee or agent.”100 Education records are covered by FERPA. These records are not covered by HIPAA because HIPAA specifically exempts from its coverage health information in an education record. Certain education counseling records may not become part of the education record. (See FERPA Basics Page: What does California Law say about Educational Counseling records?.)
Even if FERPA applies, California confidentiality law, including licensing rules, may also still apply to some information held by the therapist. For example, if a student receives minor consent care, a parent’s right to access related health information is different under FERPA and California law. If FERPA and California law provide conflicting obligations regarding disclosure or protection, school counselors should seek guidance from their legal counsel about which rule to follow.
Generally, records created by a school counselor are subject to FERPA, even if the records are kept in a separate file cabinet or file. Thus, while a school counselor may maintain a separate file as a means to limit accidental disclosures, the file still would be subject to FERPA in most cases. There are two types of records that are not considered part of an education record, though, and would not be subject to FERPA.
- Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the record101; and
- Treatment records of a student 18 and older when used only in connection with treatment and not made available to anyone other than those providing treatment. 102
In addition, California law states that certain educational counseling records do not become part of the pupil file. (See FERPA Basics Page: Do exceptions in FERPA allow educational agencies to disclose information without a release form? and Endnotes 53 and 54.) Whether either of these two exceptions applies to exempt school counselor files from FERPA is something to address with legal counsel.
Yes, FERPA most likely still applies, if the mental health provider is acting as a “school employee.” The Joint Guidance from the U.S. Departments of Education and Health and Human Services addressed this question in relation to school nurses: “Some schools may receive a grant from a foundation or government agency to hire a nurse. Notwithstanding the source of the funding, if the nurse is hired as a school official (or a contractor [of the educational agency]), the records maintained by the nurse or clinic are ‘education records’ subject to FERPA.”103 (Emphasis added). The same rule the Department of Education laid out above for hiring school nurses applies to other health providers employed by a school district. If the providers are employed by the district and hired to fill a traditional, institutional position, then their records would be subject to FERPA. Whether FERPA applies should be discussed with legal counsel.
In some cases, yes. The information may be disclosed pursuant to a valid HIPAA/CA-compliant written authorization. In addition, HIPAA and state medical confidentiality law permit mental health providers to share information related to outpatient care (except therapy notes) with other health and mental health care professionals for purposes of treatment. The therapist has discretion to determine what disclosures are appropriate in these cases.104 Providers also are allowed to disclose information to other providers absent authorization in a few other circumstances, such as in certain medical emergencies pursuant to an emergency exception (described below). It is important to note that once disclosed to a school employee, if the school employee places the information in the pupil file, FERPA likely will apply when determining access to the information in the file, not HIPAA.105
In limited circumstances, yes. The information may be disclosed pursuant to a valid FERPA-compliant written authorization. If there is no authorization in place, information can only be disclosed in a few limited circumstances. For example, the school could provide the health provider access to directory information about a specific student absent parent consent. What that would include will depend on how directory information has been defined by that school district in its annual notice to parents and whether parents have opted out. In addition, the school also may disclose information to the provider that is not contained in the education record, such as information from oral communications or personal observation that have not been recorded as long as the disclosure does not violate professional codes of conduct or contractual obligations.106 In an emergency, the information in the education record may be disclosed to appropriate persons pursuant to the emergency exception. (For more information, see May a provider whose records are subject to FERPA disclose information from the education record in an emergency?.)
Yes, FERPA authorizes disclosures to “appropriate parties” if “knowledge of the information is necessary to protect the health or safety of the student or other individuals.”107 This exception allows disclosure in response to a specific situation that poses an imminent danger. The release may occur “if the agency or institution determines, on a case-by-case basis, that a specific situation presents imminent danger or threat to students or other members of the community, or requires an immediate need for information in order to avert or diffuse serious threats to the safety or health of a student or other individuals.”108
“In making [this] determination”, FERPA goes on to say, “an educational agency or institution may take into account the totality of the circumstances pertaining to a threat to the health or safety of a student or other individuals. If the educational agency or institution determines that there is an articulable and significant threat to the health or safety of a student or other individuals, it may disclose information from education records to any person whose knowledge of the information is necessary to protect the health or safety of the student or other individuals. If, based on the information available at the time of the determination, there is a rational basis for the determination, the Department will not substitute its judgment for that of the educational agency or institution in evaluating the circumstances and making its determination.”109
Providers also should consult their ethical and licensing rules for applicable guidance, such as guidance on when the Tarasoff duty to warn may apply.
Under California’s Child Abuse and Neglect Reporting Act, mandated reporters of child abuse must make a report to child protective services or law enforcement whenever they have knowledge of or observe a child in their professional capacity whom they know or reasonably suspect has been the victim of child abuse or neglect. If information protected by FERPA is relevant to making that report, the information still must be disclosed to CPS or law enforcement. This does not mean that the information loses its confidentiality protections. While relevant information must be disclosed to CPS or law enforcement, disclosure to anyone else or for any other reason still must comply with FERPA.