Beu Health Center

Privacy of Your Health Information

Beu Health Center maintains records of your health information. These records will be either education records or treatment records under FERPA, both of which are excluded from coverage under the HIPAA Privacy Rule.

The term "education records" is broadly defined under FERPA to mean those records that are: (1) directly related to a student and (2) maintained by an educational agency or institution or by a party acting for the agency or institution.

"Treatment records" under FERPA are: records on a student who is eighteen years of age or older, or is attending an institution of postsecondary education, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student's choice. For example, treatment records would include health or medical records that Beu Health Center maintains only in connection with the provision of treatment to an eligible student.

"Treatment records" are excluded from the definition of "education records" under FERPA. However, it is important to note, that Beu Health Center may disclose an eligible student's treatment records for purposes other than the student's treatment provided that the records are disclosed under one of the exceptions to written consent under 34 CFR § 99.31(a) or with the student's written consent under 34 CFR § 99.30. If we disclose an eligible student's treatment records for purposes other than treatment, the treatment records are no longer excluded from the definition of "education records" and are subject to all other FERPA requirements, including the right of the eligible student to inspect and review the records. See the Official University Policy Manual: Policy on Family Educational Rights and Privacy Act of 1974 (Notification to Students)

Under FERPA, treatment records are not available to anyone other than professionals providing treatment to the student, or to physicians or other appropriate professionals of the student's choice. However, this does not prevent Beu Health Center from allowing a student to inspect and review such records. If we choose to do so, such records are no longer excluded from the definition of "education records" and are subject to all other FERPA requirements.

Student in Waiting Room

Under FERPA, can eligible student treatment records be shared with parties other than treating professionals?

As previously stated, treatment records, by definition, are not available to anyone other than professionals providing treatment to the student, or to physicians or other appropriate professionals of the student's choice. However, this does not prevent Beu Health Center from using or disclosing these records for other purposes or with other parties. If Beu Health Center chooses to do so, a disclosure may be made to any party with a prior written consent from the eligible student or under any of the disclosures permitted without consent in 34 CFR § 99.31 of FERPA. Disclosures may be subject to additional requirements including but not limited to Illinois Mental Health and Developmental Disabilities Confidentiality Act 740 ILCS 110/1 et seq., AIDS Confidentiality Act, 410 ILCS 305/1 et seq.and Confidentiality of Alcohol and Drug Abuse Records, 42 CFR Part 2.

For example, a Beu physician treating an eligible student might determine that treatment records should be disclosed to the student's parents. This disclosure may be made if the eligible student is claimed as a dependent for federal income tax purposes. If the eligible student is not claimed as a dependent, the disclosure may be made to parents, as well as other appropriate parties, if the disclosure is in connection with a health or safety emergency. Once the records are disclosed under one of the exceptions to FERPA's general consent requirement, the treatment records are no longer excluded from the definition of "education records" and are subject to all other FERPA requirements as "education records" under FERPA.

Under what circumstances does FERPA permit student treatment records to be disclosed to a third-party health care provider for treatment?

An eligible student's treatment records may be shared with health care professionals who are providing treatment to the student, including health care professionals who are not part of or not acting on behalf of the educational institution (i.e., third-party health care provider), as long as the information is being disclosed only for the purpose of providing treatment. In addition, your treatment records may be disclosed to a third-party health care provider when you have requested that your records be reviewed by a physician or other appropriate professional of your choice. In either of these situations, if the treatment records are disclosed to a third-party health care provider that is a HIPAA covered entity, the records would become subject to the HIPAA Privacy Rule. The records at Beu Health Center continue to be treatment records under FERPA, so long as the records are only disclosed by the institution for treatment purposes to a health care provider or to the student's physician or other appropriate professional requested by the student.

If the disclosure is for purposes other than treatment, an eligible student's treatment record only may be disclosed to a third party as an "education record," that is, with the prior written consent of the eligible student or if one of the exceptions to FERPA's general consent requirement is met. For example, if the University is served with a court order requiring the disclosure of the mental health records of a student maintained as treatment records at the Beu Health Center, the University may disclose the records to comply with the court order in accordance with the provisions of FERPA regulations. However, the mental health records that the university disclosed for non-treatment purposes are no longer excluded from the definition of "education records" and are subject to all other FERPA requirements as "education records" under FERPA.

Are all student records maintained by Beu Health Center "treatment records" under FERPA?

Not all records on eligible students that are maintained by Beu Health Center are treatment records under FERPA because many such records are not made, maintained, or used only in connection with the treatment of a student. For example, billing records that Beu Health Center maintains on a student are "education records" under FERPA, the disclosure of which would require prior written consent from the eligible student unless an exception applies. In addition, records relating to treatment that are shared with persons other than professionals providing treatment to the student i.e. immunization records for compliance with the Illinois College Immunization Act are "education records" under FERPA. Thus, to the extent Beu Health Center has shared a student's treatment information with persons and for purposes other than for treatment, such information is an "education record," not a treatment record under FERPA.

Does FERPA permit Beu Health Center to disclose a student's treatment records or education records to law enforcement, the student's parents, or others if the institution believes the student presents a serious danger to self or others?

An eligible student's education records and treatment records (which are considered education records if used or made available for any purpose other than the eligible student's treatment) may be disclosed, without consent, if the disclosure meets one of the exceptions to FERPA's general consent rule. See 34 CFR § 99.31. One of the permitted disclosures is to appropriate parties, which may include law enforcement or parents of a student, in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals. There are other exceptions that apply to disclosing information to parents of eligible students that are discussed on the "Safe Schools & FERPA" Web page, as well as other information that should be helpful to school officials, at: http://www2.ed.gov/policy/gen/guid/fpco/ferpa/safeschools/index.html .

What protections apply to non-student records?

The health records of non-students are not subject to FERPA, but may be subject to HIPAA or State law. Beu Health Center does provide services for spouses and domestic partners of eligible students and limited services for employees (first aid, injections, respirator fit testing), but does not perform HIPAA covered transactions on these records. These nonstudent records are protected under applicable State law. 

Are the health records of an individual who is both a student and an employee of a university at which the person receives health care subject to the privacy provisions of FERPA or those of HIPAA?

The individual's health records would be considered "education records" protected under FERPA and, thus, excluded from coverage under the HIPAA Privacy Rule. FERPA defines "education records" as records that are directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution. While FERPA excludes from this definition certain records relating to employees of the educational institution, to fall within this exclusion, such records must, among other things, relate exclusively to the individual in his or her capacity as an employee, such as records that were created in connection with health services that are available only to employees. Thus, the health or medical records that are maintained by Beu Health Center as part of its provision of health care to a student who is also an employee of a university are covered by FERPA and not the HIPAA Privacy Rule.

What about Student Health Benefits records?

Student health insurance plans are exempt from the definition of a group plan or individual plan under the Employee Retirement Income and Security Act of 1974 (ERISA), 29 U.S.C. 1002(1)), and therefore not subject to requirements of HIPAA. These records are subject to all other FERPA requirements as "education records" under FERPA.
Effective Nov, 2008

Adapted from: Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) And the Health Insurance Portability and Accountability Act of 1996 (HIPAA) To Student Health Records, November 2008

Revised 07/2018