Today, the U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services released updated joint guidance regarding the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to student records.

The guidance was first issued in 2008, and has been updated to clarify how FERPA and HIPAA respectively apply to education and health records maintained about students. The updated guidance includes helpful frequently asked questions and answers to importantly address when a student’s health information can be shared without the written consent of the parent or eligible student under FERPA, or without written authorization under the HIPAA Privacy Rule, and is intended to provide school leaders with the information they need to help keep students safe.

Examples of helpful frequently asked questions, in particular with regard to students who may be experiencing a mental health concern, include, “Does FERPA permit a school to disclose PII from the education records of a student, who is under the age of 18 years and is not attending a postsecondary institution, with a mental health condition and/or substance use disorder to the parents of the student?;” “What options do the parents of an eligible student with mental illness have under FERPA if they are concerned about the student’s mental health and the eligible student refuses to provide consent to permit a school subject to FERPA to share PII from education records with the family?;” and “When can PHI or PII be shared about a student who presents a danger to self or others?”