From the Legal Hotline

By Teri Henning, General Counsel; Melissa Melewsky, Media Law Counsel
Pennsylvania Newspaper Association

Q: Does HIPAA or FERPA prevent a school district from releasing the number of students affected by a staph outbreak? The school district has refused to provide the information citing HIPAA and FERPA.

A: Neither HIPAA nor FERPA prohibit the release of general information such as the number of students affected by a staph outbreak.

The Health Insurance Portability and Accountability Act (HIPAA) covers only certain healthcare entities that electronically transmit data related to standard procedures outlined by the Department of Health and Human Services (hospitals, doctors, HMOs, health insurance companies, etc.). Most public schools are not covered by HIPAA and even if they were, HIPAA does not prohibit the release of general information. HIPAA prohibits covered entities from releasing “individually identifiable health information.” This is data or health records that identify an individual or for which there is a reasonable basis to believe can be used to identify an individual. Information such as the number of students affected by a staph outbreak does not give information that could identify a specific individual, therefore, HIPAA should not be a basis for refusing this type of general information.

Likewise, the Family Educational Rights and Privacy Act (FERPA) does not prohibit releasing general information. FERPA prohibits a school from releasing personally identifiable information from a student's education record without permission from a student’s parent. FERPA does not prohibit schools from releasing general information, unrelated to specific students. General information like the number infected students at a school is not covered by FERPA and FERPA does not provide a basis for denial.

Additionally, FERPA permits the release of “directory” information. Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school.

There is no law that prohibits the school district from releasing general information that does not and could not reasonably be used to identify specific students. The number of students affected by a staph outbreak is general, newsworthy and should be released.

Please call the Legal Hotline at (717) 703-3080 for more information on HIPAA and FERPA.

Use this link to the Headlines & Deadlines archive of weekly 'From the Hotline' columns. 

[HOTLINE ARCHIVE]

PNA Legal Hotline: (717) 703-3080