What is FERPA and how private is student vaccination information?

Most educational institutions are subject to federal privacy rules under the Family Educational Rights and Privacy Act of 1974 (FERPA).  Information gathered by any K-12 school, college, or university receiving federal funding from the U.S. Department of Education is subject to FERPA.

There are differences between federal privacy rights ensured under the 1974 FERPA legislation,   and medical privacy rights defined in the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA). 

Generally speaking, educational institutions subject to FERPA are prohibited from sharing any personally identifiable information in a student’s educational record, unless they have specific written consent from the student’s parents and guardians, or from the adult student. 

While school vaccine information is usually a part of the educational record, protection from disclosure also depends on what entity is gathering vaccination information.

• If your state’s school vaccine laws require that school vaccine information be submitted directly to a health department or other state agency instead of the educational institution, it is not protected by FERPA and will likely end up in an electronic vaccine- tracking registry. Under HIPAA, student vaccination status stored in vaccine-tracking registries can be disclosed to third parties without consent from parents, guardians, and adult students. 

• If your state’s school vaccine laws require educational institutions subject to FERPA to gather vaccination information, then it is protected under FERPA and cannot be uploaded to an electronic vaccine-tracking registry by the educational institution and prevents the educational institution from disclosing personally identifying information from to third parties without specific written consent; 

• While student vaccination information may be protected by FERPA in an educational setting, there are other sources that may provide a student’s vaccination information to your state’s vaccine-tracking registry.

FERPA Privacy Exceptions

As with every rule and law, there are exceptions. For example, educational institutions subject to FERPA can disclose a student’s personally identifiable information when there is a public health emergency or other circumstance that is considered to be a threat to public safety. 

Directory Information: Many might consider a school disclosing  a student's name, address, telephone number, date and place of birth and participation in school activities, as personally identifying information. However, a school may disclose this information with third parties without consent if the school has given public notice that this information has been designated as  "directory information".   

Under federal law the school must provide parent/guardian/student's with public notice on what information the school has designated as directory information, as well as the right to opt out of being in the directory and the opt-out deadline established by the school for written opt-outs to be honored by the school. In general, the school may not designate the student's identification number, other types of unique identifier numbers, or their social security number.

If your school doesn’t receive federal funding, it is not subject to FERPA. In that case, inform yourself and obtain a copy of the school’s privacy policies to understand what information can and cannot be shared without consent.

The opt-out must be provided to the school in writing by the parent or guardian of a minor child, or the adult student. Many schools include the required public notice in their yearly enrollment packages given to parents, guardians and adults student prior to the start of the academic school year. A written opt-out from the school's directory remains in effect while the student attends that school. To learn more, visit the U.S. Department of Education's website on FERPA student privacy.

Overlap between FERPA and HIPAA

While in the majority of cases FERPA supersedes Health Insurance Portability and Accountability Act of 1996 (HIPAA) in the educational setting, there are instances where FERPA and HIPAA interact together. For example, there is interaction between these laws when schools or colleges provide health care services to enrolled students.

To understand when both FERPA and HIPAA apply and how privacy is preserved, the U.S. Department of Education and the Department of Health and Human Services have issued joint guidance to inform school personnel and the public.

Filing a Privacy Violation Report

Under FERPA, violations must be reported within 180 days of the violation. The complaint is filed with the form provided to parents and guardians on the U.S. Department of Education’s website.  Protecting and maintaining privacy when it comes to informed consent to vaccination and making voluntary vaccine decisions for minor children continues to be a hotly debated topic in America. Where privacy is protected by FERPA, violations can and should be reported.

If you believe your FERPA rights have been violated, filing a complaint against an educational institution is relatively easy. A claim must be filed within six months of the violation by the parent or guardian on behalf of a minor child, or by the adult student.

FERPA violations by educational institutions can result in the withholding of federal funds, a cease and desist order, or termination of eligibility for funding under any applicable program.

To learn more about filing a FERPA complaint, visit the U.S. Department of Education's website.