The Family Policy Compliance Office is excited to announce the launch  of the new Student Privacy Website! This new website replaces both the Privacy Technical Assistance Center’s and the Family Policy Compliance Office’s sites.  The Student Privacy Website can be found at:  https://studentprivacy.ed.gov. Be sure to update your bookmarks accordingly!

Barbara Holthaus 9/11/2015

To whom it may concern-  These comments represent my personal comments as a member of the legal profession, rather than those of my employer, The University of Texas System. The University of Texas System will be submitting formal responses under separate cover.

As an attorney who works frequently with FERPA, HIPAA and state medical privacy laws, I respectfully think the interpretation in the Dear Colleague letter represents a misinterpretation of the applicable law.

1. As the Dear Colleague letter states, “treatment records” are exempted from the definition of an “education record” under FERPA:

Education records. (b) The term does not include:

(4) Records on a student who is 18 years of age or older, or is attending an institution of postsecondary education, that are:

(i) Made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assisting in a paraprofessional capacity;

(ii) Made, maintained, or used only in connection with treatment of the student; and

(iii) Disclosed only to individuals providing the treatment. For the purpose of this definition, “treatment” does not include remedial educational activities or activities that are part of the program of instruction at the agency or institution;

Because these records are not Education Records, FERPA, which applies only to Education Records, should not apply to these records at all. Therefore, the exceptions available under FERPA that normally allow school employees to share records with other school officials are simply inapplicable to records maintained by licensed treatment providers and clinics within an post-secondary educational institution that provide care to students.

Instead, the records should be shared outside of the treatment facility only is accordance with applicable state law that governs medical records and or the state licensing law and regulations that govern the licensed health care provider that provided the treatment and who is responsible for maintaining the treatment records.

 2) Even if the Department for some reason rejects this argument, it remains a fact that FERPA does not pre-empt state medical records privacy laws and/or the state licensing law and regulations that govern the provision of health care by the health care provider that creates and maintains the treatment records. Therefore, the guidance provided by the FPCO should include a reminder that the exceptions noted in the Dear Colleague letter would not permit the treating provider to share records with other university officials unless applicable state law would permit the disclosure.

I have attached an email that was previously provided to me by the FPCO in 2009 in which that office confirmed that, at least at the time, the FPCO agreed with my interpretation of the interaction between FERPA and applicable state medical record privacy and confidentiality laws with regard to student treatment centers and their ability to disclose treatment records outside of the treatment center to the institution at large.