The Federal Educational Rights and Privacy Act, FERPA, is obscure for most health care professionals, yet more and more services link to educational institutions. Often schools, and districts, contract for services related to health and mental health counseling. This contractual link may require that the privacy professional clearly define what information is covered by each regulation so both institutions may be compliant.
This chapter is designed to give a general outline of the most important parts of FERPA. If you have mastered other health care privacy laws many pieces of FERPA will look familiar; however, never assume one substitutes for another or compliance with one satisfies both.
If the privacy professional serves an educational institution that delivers health care, a passing acquaintance with FERPA is not sufficient to ensure compliance. Additionally, placing artificial legal barriers to the legitimate use of information because of inattention to the specifics does not serve the person who is the subject of the information, nor does it serve the institution’s best interest.
This outline will put FERPA in a simple context:
Who does FERPA apply to?
What information is covered?
What information is excluded?
What are the mandates and client rights?
Who Does FERPA Apply To
(20 U.S.C. § 1232g; 34 CFR Part 99). FERPA applies to educational agencies and institutions that receive funds under any program administered by the U.S. Department of Education. This includes virtually all public schools and school districts and most private and public postsecondary institutions, including medical and other professional schools.
New guidance came out in 2012 that rescinds the restrictive interpretation of “educational agencies.” It now defines an authorized representative as
any entity or individual designated by a State or local educational authority or an agency headed by an official listed in §99.31(a)(3) who is involved in Federal- or State-supported education programs.
This means that state and local government services and education authorities are now allowed to share data with other government agencies that are not under their direct control, as long as those other agencies are involved in federal- or state-supported education programs.
While this quote seems to put the applicability of the act into a simple framework, it should be pointed out that “any program” encompasses nearly three hundred Department of Education programs. Careful research should be done to determine if federal program funds actually are available to the institution, and subsequently to the health care provider. Additionally, the “availability of funds” criterion is defined in the Act and should be reviewed carefully. In short FERPA
…considers funds to be made available (if),
1)…provided to the agency or institution by grant, cooperative agreement, contract, sub-grant, or subcontract; or
2)… provided to students attending … and the funds may be paid to the agency or institution by those students for educational purposes, such as … Pell Grant Program and the Guaranteed Student Loan Program...
“Private and religious schools, at the elementary and secondary level, generally do not receive funds from the Department of Education and are, therefore, not subject to FERPA” Please note the author has emphasized “generally”, as it is important to check for the availability of fed funds to the institution or students and not rely on the private or religious affiliation to make the FERPA applicability decision.
Another applicability wrinkle, according to the federal government, “Note that a private school is not made subject to FERPA just because its students and teachers receive services from a local school district or State educational agency that receives funds from the Department.”
You have to account for a record relating to a student whose records are subject to FERPA, but where the record resides at another institution.
For example, if a school district places a student with a disability in a private school that is acting on behalf of the school district with regard to providing services to that student, the records of that student are subject to FERPA, but not the records of the other students in the private school. 
The Act says:
(d) If an educational agency or institution receives funds under one or more of the programs covered by this section, the regulations in this part apply to the recipient as a whole, including each of its components (such as a department within a university).
Conversely if the medical clinic for a university is contracted out, none of the health care records are available to the department that holds the official educational record. The clinic isn’t necessarily considered a division of the university as it is a stand alone and a part that does not provide any educational services. So while the Act applies to the whole institution, care must be taken to not over apply FERPA.
Notes: A health care provider covered by HIPAA would only send the school the Minimum Necessary to accomplish the purpose, which is the educational record. A school may need to know that the physical therapy sessions were accomplished, but the entire content of the medical information (such as range of motion, specific measurements or diagnosis) may not be necessary. The purpose of the educational record is education, not health care treatment. This transfer of information must be negotiated in advance of any disclosure.
Nursing Records are specifically considered part of the Educational Record. Nurses do not diagnose or treat individuals in the medical sense and by licensure they cannot practice medicine. It would be rare that a school nurse’s documentation would be covered by HIPAA regulations. Rare, but not impossible.
Generally, applicability is based on the institution receiving either fed funds directly, through a subcontract or fed funds received by a student and used for payment of educational services.