Student health records maintained by a school nurse are part of the education record subject to FERPA. California law also may apply to health information held by a school nurse. (See Glossary of Key Terms in Additional Resources.)
Education records are covered by FERPA. In general, a school nurse’s records become part of the school’s education record, as they contain information related to a student and are maintained by a school employee or agent.90 These records are not covered by HIPAA because HIPAA specifically exempts from its coverage health information in an education record.
However, California confidentiality law, including licensing rules, may still apply to some information held by the nurse. In some cases, these laws may conflict with FERPA. For example, if a student receives minor consent care, a parent’s right to access related health information is different under FERPA and California law. If FERPA and California law provide conflicting obligations regarding disclosure or protection, school nurses should seek guidance from their legal counsel about which rule to follow.
Generally, treatment records created by a school nurse are subject to FERPA, even if the records are kept in a separate file cabinet or file. Thus, while a school nurse may maintain a separate file as a means to limit accidental disclosures, the file still would be subject to FERPA in most cases. There are two types of records that are not considered part of an education record, though, and would not be subject to FERPA:
- Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the record91; and
- Treatment records of a student 18 and older when used only in connection with treatment and not made available to anyone other than those providing treatment.92
Whether either of these two exceptions applies is something to address with legal counsel.
Yes, FERPA still applies. Joint Guidance from the U.S. Departments of Education and Health and Human Services addresses this question: “Some schools may receive a grant from a foundation or government agency to hire a nurse. Notwithstanding the source of the funding, if the nurse is hired as a school official (or a contractor [of the educational agency]), the records maintained by the nurse or clinic are ‘education records’ subject to FERPA.”93 (emphasis added).
In most cases, yes. The information may be disclosed pursuant to a HIPAA/CMIA-compliant written authorization. Alternatively, HIPAA and California law also permit health care providers to disclose protected health information to other health care providers for “treatment” purposes. HIPAA defines “treatment” broadly in this context to include coordination or management of health care, consultation, and referral as well as direct treatment.94 Health providers also are allowed to disclose information to other providers even without authorization in a few other circumstances, such as in certain medical emergencies.
It is important to note that once disclosed to the school nurse, if the school nurse places the information in the pupil file, FERPA likely will apply when determining access to the information in the file, not HIPAA.95 This means that information that was once protected under HIPAA may lose those protections once it is placed in a student’s education file.
In limited circumstances, yes. The information may be disclosed pursuant to a valid FERPA-compliant written authorization. If there is no authorization in place, information can only be disclosed in a few limited circumstances. For example, the school could provide the health provider access to directory information about a specific student absent parental consent. What that would include will depend on how directory information has been defined by that school district in its annual notice to parents and whether parents have opted out. In addition, the school nurse also may disclose to the pediatrician information that is not contained in the education record, such as information from oral communications or personal observations that have not been recorded, as long as the disclosure does not violate professional codes of conduct or contractual obligations.96 In an emergency, the information in the education record may be disclosed to appropriate persons pursuant to the emergency exception, described below in May a school nurse disclose information from the education record in an emergency?.
Yes. FERPA authorizes disclosures to “appropriate parties” if “knowledge of the information is necessary to protect the health or safety of the student or other individuals.”97 This exception allows disclosure in response to a specific situation that poses an imminent danger. The release may occur “if the agency or institution determines, on a case-by-case basis, that a specific situation presents imminent danger or threat to students or other members of the community, or requires an immediate need for information in order to avert or diffuse serious threats to the safety or health of a student or other individuals.”98
“In making [this] determination”, FERPA goes on to say, “an educational agency or institution may take into account the totality of the circumstances pertaining to a threat to the health or safety of a student or other individuals. If the educational agency or institution determines that there is an articulable and significant threat to the health or safety of a student or other individuals, it may disclose information from education records to any person whose knowledge of the information is necessary to protect the health or safety of the student or other individuals. If, based on the information available at the time of the determination, there is a rational basis for the determination, the Department will not substitute its judgment for that of the educational agency or institution in evaluating the circumstances and making its determination.”99
Providers also should consult their ethical and licensing rules for applicable guidance, such as guidance on when the Tarasoff duty to warn may apply.