The Family Policy Compliance Office is excited to announce the launch  of the new Student Privacy Website! This new website replaces both the Privacy Technical Assistance Center’s and the Family Policy Compliance Office’s sites.  The Student Privacy Website can be found at: Be sure to update your bookmarks accordingly!

Vivian A. Yamada 9/07/15

To whom it may concern:

Thank you so much for the articulate Dear Colleague Letter about the intersection of HIPAA, FERPA and state law.  I appreciate the balance of the student's right to privacy with the need to protect the welfare of the student and others. The letter describes the" narrow exception" of "treatment records" and goes on to describe how medical records which are not treatment records should be protected and exemptions to those protections.  While the treatment records might be a narrow definition in FERPA terms, as a Counseling Center Clinical Director, treatment records constitute the largest portion of records that I oversee.  So I have two broader areas of clarification I am requesting, with some finer questions to help understand the application of these two broader areas:

1) Could you please confirm that FERPA does not apply to/govern the confidentiality and privacy of "treatment records?" 

   a) If this is correct, does that mean we use other laws and professional ethics to guide us in decisions about disclosure of information?

   b) does this mean that only the information in  the medical record below in the blue area may be shared according to the FERPA exemptions (e.g., to the threat assessment team), but that the FERPA exemptions do not apply to the area in green (which is the vast majority of our records)

2) Definition of Treatment Records

 I believe approximately 95% of our records fall under treatment records, but want to clarify what constitutes the more general medical record and what constitutes the treatment record. In application, I understand the Dear Colleague letter to say that medical records include the more general parts of the medical records and the treatment record. In essence, my question is whether this graphic representation is correct in that the information in blue are more general medical records which are governed by FERPA and that FERPA does not apply to the green section.  The questions below the graphic outline the specific issues that would help me verify which pieces fall into the blue vs green sections:

a)      When I talk about a client's medical/counseling record, I am  talking about an average of 10 separate pieces of documentation for a 5 session counseling treatment. Most of these separate pieces of documentation would clearly fall under treatmentrecords per the 3 criteria definition. The letter refers to a medical record (counseling record) becoming an educational record once shared with non-treatment provider. 

In the example above, does that meant that all 10 pieces of documentation  from the counselor record become educational records once 1 piece of the documentation is shared, or does only that one piece of documentation that is shared become an educational record and the other 9 remain treatment records? 

b)      Obviously, if these records are shared with school officials or the student, they are now more general medical records and no longer treatment records according to this definition. What other "others”  trigger the criteria 

          to convert these into the more general category of medical records and therefore, educational records?

                     i) sharing treatment records with insurance companies?

                   ii) sharing that a client no shows with an office that bills for no shows>

                  iii) records that our administrative assistants have access to for filing purposes, audit puproses, etc?

                 iv) are records created by our administrative assistants for the purpose of scheduling or conveying messages to counselors considered more  general medical records or treatment records?

                  v) if an external auditing body comes in to review treatment records, do these records then become educational records 

         c) Another way to ask question b is for those of us who do not charge for services, what part of our medical/counseling record is NOT a treatment record if we have not shared it with anyone other than another provider?

         d) Lastly, FERPA refers to times educational records can be shared without written consent from the student.  In situations where we are concerned about a student's risk to self or others and hospitalization is required, we share information verbally with our campus police, but we do not share our medical record.  Some of this information is included in the police report, but other pieces are only part of verbal communication. Are these communications addressed by FERPA or do we follow state laws and professional ethics regarding when to share this information?

Thank you for any clarification you can provide. 


Vivian Yamada