Federal Law and
Student Privacy
and
Federal Law and Health
Care Privacy
New Business Manager Training
NMASBO
Student Privacy
Family Educational Rights and Privacy Act
34 CFR 99.3
Also know as FERPA
This Federal law protects the privacy interests of
students and affords parents the right to have
access to and amend “student records”
Common Student Interactions in
Business
• Insurance, Legal and Health Claims
• IDEA (Individuals with Disabilities in Education
Act) issues
• Individual Education Plans (IEP)
• Parent Issues
• Transportation Services
• Food Services
• ADA and Accessibility
Business Staff may be Involved
• Purchasing
• Accounts Payable
• Treasury
• Maintenance
• Transportation
• Food Service
Who is Covered
• Public School Students under the age of 18
• Parents: natural or adoptive
• Legal Guardian
• Individual acting as a parent
• “Eligible Students” (over the age of 18)
What is a Student Record
• Definition: All records, files, documents and
other materials containing information directly
related to the student;
• Maintained by an agency, institution, or person
acting for such agency;
• Not limited to handwriting, videotape,
audiotape, computer and electronic files, film,
print, microfilm or microfiche
Records Privacy
• Records may be accessed by employees only
when performing OFFICIAL DUTIES and who
have a LEGITIMATE EDUCATIONAL INTEREST
• Records may only be released, without parental
consent for legitimate educational interest
• Employees are legally and ethically obligated to
safeguard the confidentially of student records
that may be encountered while performing one’s
job duties
Surveillance Cameras
• Must not infringe on student privacy rights
• Generally classrooms, hallways and common areas are
okay
• Buses okay
• Should have a Camera/Surveillance Policy
• Saved media with specific student information are
“student records”
• Media used for discipline is a “student Record”
Internet Postings
• Internet postings must comply with FERPA and
officials must consider safety concerns and
exercise caution when displaying information
such as identifiable pictures
FERPA Recommendations
• Be sensitive, do not “gossip” about student issues
• Discuss student issues with only those who do have a
“legitimate educational need”
• Do not allow staff to “gossip” about student
information; train staff about FERPA
• Do not give access to student records to those without
a legitimate education need
• Do not allow the press (or anyone else) to film, take
pictures or interview students without parental
permission
FERPA Recommendations
• Keep your records such a media from the bus
cameras secure from general viewing
• Discuss issues with the Superintendent when
you have questions (Superintendents are
generally better trained in student issues than
business managers)
• Develop a Student Privacy Policy and Procedures
Health Privacy Issues
Health Insurance Portability and Accountability Act
Also known as HIPAA
45 CFR 160.103
This law sets standards for the sharing of
health care information
Business Office Issues
• Health insurance applications
• Health insurance claims
• Records related to health care related leave
• FMLA (Family and Medical Leave Act) records
• Workers Compensation health records
Student Health Care
• Generally – Student health care information is a
“student record” (Parental permission for
release)
• Examples:
IDEA health records
Immunization Records
Nurse Records
Staff Health Records
HIPAA Requirements
• The highest degree of confidentially when
accessing, discussing (either written, verbal or
electronically) a person’s protected health
information.
• Healthcare organizations must adopt processes
and procedures that will ensure the safety and
protection of health care information.
Are Schools Health Care
Organizations?
YES
• The law defines a group health plan as “an employee welfare
benefit plan to the extent that the plan provides medical care
to employees or their dependents directly or through
insurance, reimbursement or otherwise.” In addition, NMPSIA
is required to be HIPAA compliant therefore the schools
districts that are under NMPSIA must also comply with the
HIPAA laws
Recommendations
• Make sure Business Office health care related
records are secure and have restricted access
• Make sure staff is aware of health care
information restrictions
• Do not “gossip” about employee health care
issues
• Discuss information with only those who have a
legal and legitimate interest
Recommendations
• Develop HIPAA policy and Procedures
• Contact NMPSIA with privacy questions
• Questions?