Student Medical Records & HIPAA-FERPA

In an 8/18/15 “Dear Colleague Letter,” Kathleen M. Styles, U.S. Department of Education Chief Privacy Officer, advised colleges and universities that “without a court order or written consent, institutions that are involved in litigation with a student should not share student medical records with the institution’s attorneys or courts unless the litigation in question relates directly to the medical treatment itself or the payment for that treatment….”  HIPAA rules apply to student medical records, even though, under FERPA, portions of such records collected by college or university student health care clinics are considered educational records. This HIPAA-FERPA application issue has attracted particular attention since the filing of a recently settled Title IX lawsuit against the University of Oregon (Doe v. University of Oregon, D. Ore., No. 6:15-cv-00042-MC, settlement 8/4/15).  In this case, a female student, who was suing the university after an alleged sexual assault, claimed the university violated her rights under FERPA and HIPAA by obtaining her counseling records.  HIPAA generally applies to health care service providers and their business associates that are paid by insurers to deliver such service. However, there is not a HIPAA exemption for college and university student health care clinics. The DoE is seeking comment on the guidance outlined in the 8/18/15 “Dear Colleague Letter” until 10/2/15.