HIPAA, 42 CFR Part 2, and FERPA - Rules for Managing Student Health Information

Overview:

This session focuses on the issues of managing health information when it may that of students and may involve substance abuse treatment information.

HIPAA and FERPA allow a number of disclosures without consent that SAMHSA prohibits without consent.

First we will explain how HIPAA relates to information management and release and explain the processes required for various releases of information under the HIPAA and FERPA rules, including release according to individual access requests, and under consents and HIPAA authorizations.

While FERPA overrides HIPAA, both HIPAA and FERPA take a back seat to the rules under 42 CFR Part 2. When substance abuse treatment information is involved, first you need to understand how to identify it. We will discuss how to make it distinguishable from "regular"health information, so that the appropriate extra protections can be provided. You may be able to use functions in your EHR to flag the information, or you may create a manual process for tracking the information, if it is rarely handled in your organization.

And the substance abuse treatment information you collect may or may not be under SAMHSA depending on whether or not you have a department or even a response team that specializes in SAMHSA-related situations. You need to understand your status under the rules before you release information inappropriately. We will discuss what qualifies treatment that falls under SAMHSA.