Some of these questions were posted and answered on the National Association of College and University Attorneys (NACUA) listserv. All identifiers were removed, and permission sought (collectively) for use of same. Special thanks to Steve McDonald, General Counsel, Rhode Island School of Design, for his FERPA expertise. Steve is the editor of the 2nd edition of the Family Educational Rights and Privacy Act: A Legal Compendium, available from NACUA. For anyone who wants to know all of the ins and outs of FERPA, this guide is indispensable.
Some of these question were posted on a post webinar page after the January 2009 NACUA web seminar on the new FERPA regulations. Answers to these questions were posted by Steve McDonald and Peg O'Donnell (CUA). Institutions are free to use and adapt this material for educational purposes.
Q. When does HIPAA apply and when does FERPA apply?
A.FERPA applies to "education records." FERPA does not apply to medical records used only for treatment, (let's call those "unshared treatment records.") Once the medical records are shared outside the treatment sphere (let's call those "shared treatment records"), they become education records and are subject to FERPA. So, FERPA applies to education records, including shared treatment records, and does not apply to unshared treatment records.
HIPAA specifically excludes both education records, including shared treatment records, and unshared treatment records. (See 45 C.F.R. 160.103 definition of "Protected Health Information") It does not apply to any of the three
So, neither FERPA nor HIPAA applies to unshared treatment records.
However, State law regarding confidentiality of medical records applies to unshared treatment records and limits how they may be shared.
Answer courtesy of Nina Lavoie, Associate Counsel, University of Maine System
Q. A current student asked us whether or not an email that referenced the student between two professors is considered an education record under FERPA, and if so, would he/she have access to said email? If the professors discussed the student in the course of the academic process using college e-mail addresses, would this communication be considered an education record that said student would have access to?