Comparison between FERPA and HIPAA Compliance

The Federal Family Educational Rights and Privacy Act ("FERPA") provides parents of students and eligible students (students who are 18 or older) with privacy protections and rights for "education records" maintained by federally funded educational agencies or institutions (either private or public) or persons acting for these agencies or institutions .

The privacy regulations under the Federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA privacy regulations") contain a specific exemption for "education records" covered by FERPA. In fact, the HIPAA privacy regulations specifically exclude from the definition of "protected health information" any individually identifiable health information defined under FERPA as "education records" (See 45 CFR Part 164.501). The HIPAA privacy regulations also do not apply to certain records exempt from FERPA requirements. These are records:

(1) Of students who are 18 years or older or are attending post secondary educational institutions,
(2) Maintained by a physician, psychiatrist, psychologist, or recognized professional or paraprofessional acting or assisting in that capacity,
(3) That are made, maintained, or used only in connection with the provision of treatment to the student, and
(4) That are not available to anyone (including the student), except a physician or appropriate professional reviewing the record as designated by the student.