Which statement about HIPAA's applicability to school health records that FERPA covers is correct?

• A. HIPAA applies to all student records in schools
• B. HIPAA does not apply to FERPA-covered health records in schools
• C. HIPAA applies only to private schools
• D. HIPAA supersedes FERPA in all cases

Answer: (B)

The essential idea is how FERPA and HIPAA divide responsibility for privacy in schools. FERPA governs student education records held by schools, including health information that the school itself maintains as part of a student’s education record. HIPAA, on the other hand, covers protected health information handled by health care providers and health plans (entities that are HIPAA “covered”). When the school is the custodian of the health information as part of the student’s education record, HIPAA does not apply. FERPA controls access and disclosures of those records instead.

So, for health records that the school keeps as education records, HIPAA isn’t the law that governs them—FERPA is. HIPAA could apply in other contexts, such as health information held by a separate medical provider outside the school or records not maintained as part of the education record. That’s why the correct statement is that HIPAA does not apply to FERPA-covered health records in schools.