Back to Resources

Health Information Data Sharing: Family Educational Rights and Privacy Act (FERPA)

posted on Wed, Jan 7 2015 11:23 am by The Network for Public Health Law

The Network was recently contacted by an advisor for a state department of health for assistance in her work on asthma with a school district within her state. She asked whether the school district can specifically request that parents provide details regarding their child’s absence for illness under the Family Educational Rights and Privacy Act (FERPA), and if so, what logistics would be implied in legally collecting and protecting that information.

FERPA is a federal law that protects the privacy of student education records. 20 U.S. Code § 1232g, 34 CFR Part 99.  FERPA speaks to a school’s responsibilities to safeguard student information and prohibits a school from disclosing most identifiable information that it maintains, unless the parent consents. FERPA does not explicitly address information that a school can request or maintain on a child. However, this is indirectly addressed by §99.31, which allows information to be shared among school officials, teachers or other staff who have “legitimate educational interests.”

In other words, when a school collects information, it should be able to articulate the educational reason for doing so. For example, asthma-related information may be relevant to a student’s asthma-management plan or the ability of the school to identify and evaluate potential conditions that may trigger respiratory distress for asthmatic children.

Schools are permitted to share identifiable information within the school with teachers and other staff who have a need to know the information for educational purposes. If the school district decides to collect the information and is able to clearly articulate the educational basis for doing so, it will need to work through the logistics of collecting and storing that information in order to ensure that only authorized persons have access and to satisfy any applicable recordkeeping requirements.

FERPA does permit the school to share health-related information with public health entities as long as the information is de-identified (§99.31(B)). FERPA permits a school to share identifiable health-related information if the parent consents to the disclosure of personally identifiable information (§99.30(a)), in connection with a health or safety emergency (§99.31(a)(10)), or if the health department is conducting studies for, or on behalf of, the school to improve instruction (§99.31(a)(6)).

More on FERPA and health information sharing here.

Need more information?

Ask a Question