What is FERPA and how private is student vaccination information?
Most educational institutions are subject to federal privacy rules under the Family Educational Rights and Privacy Act of 1974 (FERPA).1 Information gathered by any K-12 school, college, or university receiving federal funding from the U.S. Department of Education is subject to FERPA.
There are differences between federal privacy rights ensured under the 1974 FERPA legislation,2 3 and medical privacy rights defined in the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).4
Generally speaking, educational institutions subject to FERPA are prohibited from sharing any personally identifiable information in a student’s educational record, unless they have specific written consent from the student’s parents and guardians, or from the adult student.5
While school vaccine information is usually a part of the educational record, protection from disclosure also depends on what entity is gathering vaccination information.
- If your state’s school vaccine laws require that school vaccine information be submitted directly to a health department or other state agency instead of the educational institution, it is not protected by FERPA and will likely end up in an electronic vaccine- tracking registry. Under HIPAA, student vaccination status stored in vaccine-tracking registries can be disclosed to third parties without consent from parents, guardians, and adult students.6
- If your state’s school vaccine laws require educational institutions subject to FERPA to gather vaccination information, then it is protected under FERPA and cannot be uploaded to an electronic vaccine-tracking registry by the educational institution and prevents the educational institution from disclosing personally identifying information from to third parties without specific written consent;7
- While student vaccination information may be protected by FERPA in an educational setting, there are other sources that may provide a student’s vaccination information to your state’s vaccine-tracking registry.
Disclosure of Personally Identifying Information Under FERPA
As with every rule and law, there are exceptions. For example, educational institutions subject to FERPA can disclose a student’s personally identifiable information when there is a public health emergency or other circumstance that is considered to be a threat to public safety.8
Overlap between FERPA and HIPAA
While in the majority of cases FERPA supersedes HIPAA in the educational setting, there are instances where FERPA and HIPAA interact together. For example, there is interaction between these laws when schools or colleges provide health care services to enrolled students.9
To understand when both FERPA and HIPAA apply and how privacy is preserved, the U.S. Department of Education and the Department of Health and Human Services have issued joint guidance to inform school personnel and the public.10
Enforcement of FERPA
Protecting and maintaining privacy when it comes to informed consent to vaccination and making voluntary vaccine decisions for minor children continues to be a hotly debated topic in America. Where privacy is protected by FERPA, violations can and should be reported.
If you believe your FERPA rights have been violated, filing a complaint against an educational institution is relatively easy. A claim must be filed within six months of the violation by the parent or guardian on behalf of a minor child, or by the adult student.11
FERPA violations by educational institutions can result in the withholding of federal funds, a cease and desist order, or termination of eligibility for funding under any applicable program.12
What laws exist to protect employees from vaccine mandates?
Under federal recommendations by the National Vaccine Program Office in the National Adult Immunization Plan (NAIP), Healthy People 2020 goals are used to guide adult vaccination goals.
While the NAIP fails to incorporate informed consent and privacy protections and Healthy People 2020 goals are aspirational and carry no statutory impact, the NAIP is used by states for guidance in implementing adult vaccine mandates.
Currently, most adult mandates are in the health care setting and impact health care workers and some contractors and are most often for Hepatitis B and Influenza vaccine. These mandates and any exemptions offered vary from state to state and NVIC links to this information on our state pages.
At a state level, rules and policies mandating vaccines in the workplace have been successfully challenged by the federal Equal Employment Opportunity Commission (EEOC)13 and health care workers who have been denied religious exemptions have received monetary settlements.14 15
The basis for these challenges is under Title VII of the Civil Rights Act of 1964. Under the Act employers are prohibited from discriminating against employees on the basis of race, color, religion, sex and national origin and provides for compensation and punitive damages when discrimination in the workplace occurs.
To be eligible for compensation and damages under a Title VII action a charge must be filed within 180 calendar days from the day the discrimination took place. To learn more about filing a charge, visit the EEOC’s website.
1 U.S. Department of Education. Family Educational Rights and Privacy Act of 1974 (FERPA). Mar. 1, 2018.
2 U.S. Department of Education. Family Educational Rights and Privacy Act of 1974 (FERPA). Mar. 1, 2018.
3 HHS. HIPAA – Does the HIPAA Privacy Rule apply to an elementary or secondary school? Jul. 26, 2013.
4 HHS. Summary of the HIPAA Privacy Rule. Jul. 26, 2013.
5 U.S. Department of Education. Laws & Guidance – Letter to Alabama Department of Education re: Disclosure of Immunization Records. FERPA Online Library. Feb. 25, 2004.
6 Cornell Law School Legal Information Institute. 45 CFR 164.512 – Uses and disclosures for which an authorization or opportunity to agree or object is not required. Jul. 27, 2019.
7 DOE. Protecting Student Privacy – Frequently Asked Questions: Exceptions - Health and Safety Emergency. Accessed Jul. 13, 2018.
10 U.S. Department of Education and U.S. Department of Health and Human Services. Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) And the Health Insurance Portability and Accountability Act of 1996 (HIPAA) To Student Health Record November 2008.
11 DOE. Protecting Student Privacy – File a Complaint. Accessed Jul. 13, 2018.
12 U.S. Department of Education. FERPA Regulations. 99.67 – How does the Secretary enforce decisions?
13 Opel, D. Sonne, J. Mello, M. Vaccination without Litigation – addressing Religious Objections to Hospital Influenza-Vaccination Mandates. N Engl J Med 2018; 278:785-788. Mar. 1, 2018
14 Thompson, C. Memorial Healthcare in Owosso settles religious discrimination suit for $75,000. Lansing State Journal, Jun. 28, 2019.
15 U.S. Equal Employment Opportunity Commission. Press Releases – Saint Vincent Health Center to Pay $300,000 to Settle EEOC Religious Accommodation Lawsuit. Dec. 23, 2016.