Advocates

Advocate links

ecbt photo

HIPAA/FERPA Issues

Under HIPAA, Covered Entities (including health departments and immunization registries) are subject to other federal laws and regulations but HIPAA excludes any records that are covered by FERPA.  That means the information contained in an education record is exempt from HIPAA requirements and only subject to FERPA requirements.  A problem arises with regard to immunization registries, public health practice and FERPA.  Most states have mandatory student immunization laws, along with requirements for schools to monitor student compliance with these laws.  Immunization registries provide a very efficient way to monitor student compliance with these laws.  Immunization data flowing into the schools from the immunization registry is not restricted by FERPA and is therefore a great tool to determine if students are in compliance with immunization regulations for school entry.  The schools collect important immunization data that would be very beneficial to include in registries (from shots given at school clinics and student compliance documentation provided to the schools by parents and providers).  FERPA requires written parental consent for this data to be provided to the registry.   Ideally, FERPA should contain provisions similar to those made under HIPAA laws allowing disclosure to public health where it is mandated or permitted by law.  Unfortunately, this is not currently the case and so the flow of information from the schools into the immunization registry is severely, if not totally limited.