Key Points about HIPAA and FERPA in California

Introduction

School-based health programs and providers bring a range of needed health care services to a school campus. These programs also provide an exciting opportunity to increase health care access for youth and improve care coordination and collaboration among providers and schools.

When developing school-based health programs, there are several legal considerations that the health provider(s) and education agencies should address early on. One of the most important is determining which confidentiality laws control access to and disclosure of the school-based health programs’ health care information. While there may be multiple laws to consider, the first question to address is whether the program’s information is subject to the federal Family Educational Rights and Privacy Act (FERPA) or the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Whether HIPAA or FERPA applies and how those laws interact with state confidentiality law will impact school-based health service operations in large and small ways:

  • from framing how school staff and health providers collaborate and share information;
  • to shaping policies about how to deal with suicide threats and other emergencies;
  • to determining the content of required notices and consent forms and other administrative issues.

Basics

  • FERPA and HIPAA can never apply to the same records at the same time.
  • FERPA and California medical confidentiality law can apply to the same records at the same time.
  • HIPAA and California medical confidentiality law can apply to the same records at the same time.
  • HIPAA or FERPA may apply to control the release of the health records created when health services are provided on a school campus.

FERPA or HIPAA?

  • A school health program’s records are subject to FERPA if the program is funded, administered and operated by or on behalf of a school or educational institution.
  • A school health program’s records are subject to HIPAA if the program is funded, administered and operated by or on behalf of a public or private health, social services, or other non-educational agency or individual.

The following video includes content based on laws, not ethics, clinic policy, or best practice. Simply because you can share information without an authorization form in some instances, doesn’t mean you always should. Sometimes ethics and your client relationship are more critical. Other times, your clinic policy recommends or requires that you obtain client consent/authorization before making a disclosure.

How HIPAA & FERPA Interact in California

This video provides legal information only and is accurate as of June 2020. To understand how this information might apply to you or to a specific situation, please seek legal counsel for specific advice. The content for this video was developed by Rebecca Gudeman at the National Center for Youth Law in partnership with the California School-Based Health Alliance.