Resolving conflicts between FERPA and public health data collection

The Family Education Rights Privacy Act (FERPA) was enacted in 1974 to protect the education privacy rights of students and their families. School health records are covered by FERPA., not the Health Insurance Portability and Accountability Act (HIPAA). Information covered by HIPAA can be shared for public health purposes without a written authorization to release information. However, US Department of Education FERPA memorandums issued in response to state and CDC inquiries state clearly that identifiable student health information in education records may not be shared for public health purposes. This includes personally identifiable state immunization reporting data, mandatory communicable disease reporting and surveillance and registry information regarding congenital and chronic diseases used to advise health policy. If student health records were covered by HIPAA, the exchange of information without authorization public health exemption would apply to this exchange of data, a tradition public health role of schools. This is especially pertinent in the beginning stages of a pandemic flu and other public health crises that do not meet the FERPA definition of an emergency. This session will share state and federal updates on this dilemma and provide strategies for obtaining information needed for public health purposes.