It depends. The information can always be disclosed with parent consent. Absent parent consent, FERPA permits a school to disclose information in the education record to other school officials as long as they have a legitimate educational interest in the information.110 FERPA requires schools to include in their annual notices to parents a statement indicating whether the school has a policy of disclosing information from the education file to school officials, and, if so, which parties are considered school officials for this purpose and what the school considers to be a “legitimate educational interest.”111 Thus, the school may share the information with the school nurse or counselor if the nurse or counselor has a legitimate educational reason in needing the information, as legitimate educational interest is defined by the district.112
In addition, FERPA authorizes disclosures to “appropriate parties” if “knowledge of the information is necessary to protect the health or safety of the student or other individuals”113 in response to a specific situation that poses an imminent danger. The release may occur “if the agency or institution determines, on a case-by-case basis, that a specific situation presents imminent danger or threat to students or other members of the community, or requires an immediate need for information in order to avert or diffuse serious threats to the safety or health of a student or other individuals.”114 The school-based provider will be required to protect the information subject to FERPA.115
It depends. The information can always be disclosed with parent consent. Absent parent consent, FERPA permits a school to disclose information in the education record to other school officials as long as they have a legitimate educational interest in the information.116 FERPA requires schools to include in their annual notices to parents a statement indicating whether the school has a policy of disclosing information from the education file to school officials, and, if so, which parties are considered school officials for this purpose and what the school considers to be a “legitimate educational interest.”117 Thus, the school nurse may share the information with the teacher if the teacher has a legitimate educational reason in needing the information, as legitimate educational interest is defined by the district.118
In addition, FERPA authorizes disclosures to “appropriate parties” if “knowledge of the information is necessary to protect the health or safety of the student or other individuals”119 in response to a specific situation that poses an imminent danger. The release may occur “if the agency or institution determines, on a case-by-case basis, that a specific situation presents imminent danger or threat to students or other members of the community, or requires an immediate need for information in order to avert or diffuse serious threats to the safety or health of a student or other individuals.”120
It depends. The information can always be disclosed with FERPA-compliant parent consent. If there is no consent in place, the information can be shared in some cases depending on the contractor’s role and the services being provided. According to guidance from the U.S. Department of Education, “agencies and institutions subject to FERPA are not precluded from disclosing education records to parties to whom they have outsourced services so long as they do so under the same conditions applicable to school officials who are actually employed.” The guidance reminds schools and educational agencies that “an educational agency or institution may not disclose education records without prior written consent merely because it has entered into a contract or agreement with an outside party. Rather, the agency or institution must be able to show that 1) the outside party provides a service for the agency or institution that it would otherwise provide for itself using employees; 2) the outside party would have “legitimate educational interests” in the information disclosed if the service were performed by employees; and 3) the outside party is under the direct control of the educational agency or institution with respect to the use and maintenance of information from educational records.” Examples of services that a district would otherwise use an employee to perform but may be contracted to a vendor include legal services, student transportation, school nursing, and online data systems.
The guidance reminds districts that they remain completely responsible for their contractor’s compliance with FERPA requirements in these situations and states “[f]or that reason, we recommend that these specific protections be incorporated into any contract or agreement between an educational agency or institution and any non-employees it retains to provide institutional services.” The U.S. Department of Education adds that if the school has not “listed contractors and other outside service providers as ‘school officials’ in its annual §99.7 FERPA notification, then it is required to record each disclosure to a qualifying contractor in accordance with § 99.32(a).”121
Yes, but only with a signed FERPA-compliant release or in an emergency. Disclosure of information in the education file about a student’s chronic conditions to a provider operating under HIPAA is permitted under a FERPA-compliant release. In addition, information from the education record may be disclosed to protect the health or safety of a student or other individual.122 However, this exception has been strictly interpreted by the U.S. Department of Education. The emergency must be a specific situation that requires immediate need for disclosure of the information. Thus, for example, the emergency exception could not be used to send a list of all students with asthma or diabetes to the school-based health center; however, the exception could be used by the school to provide information to a health provider about a specific student with asthma who is having acute symptoms and needs immediate intervention.
It depends. If a school nurse, or another health provider subject to FERPA, documents minor consent information, this becomes part of the education file and is subject to FERPA.
Information in the education file of a student 18 and younger can always be disclosed to the principal with parent consent. Absent parent consent, FERPA permits a school to disclose information in the education record to other school officials as long as the school official has a legitimate educational interest in the information.124 A principal is a school official, but the principal can only access the information if the principal has a legitimate educational interest in the information. FERPA requires schools to include in their annual notices to parents a statement indicating whether the school has a policy of disclosing information from the education file to school officials, and, if so, which parties are considered school officials for this purpose and what the school considers to be a “legitimate educational interest.”125
In limited circumstances, yes. The information may be disclosed pursuant to a FERPA compliant written authorization. If there is no authorization in place, information can only be disclosed in a few limited circumstances. For example, the school could provide the health provider access to directory information about a specific student absent parent consent. What that would include will depend on how directory information has been defined by that school district in its annual notice to parents and whether parents have opted out. In addition, the school also may disclose information to the provider that is not contained in the education record, such as information from oral communications or personal observation that have not been recorded.129 In an emergency, the information in the education record may be disclosed to appropriate persons pursuant to the FERPA emergency exception described in School Nurses Frequently Asked Questions: May a school nurse disclose information from the education record in an emergency?.
HIPAA/Confidentiality of Medical Information Act (CMIA): If the provider’s records are subject to HIPAA/CMIA, then the provider can share information pursuant to a HIPAA/CMIA-compliant signed authorization. Otherwise, there is no exception under HIPAA that would allow a provider to share protected health information with a teacher for this purpose.
FERPA: If the records are subject to FERPA, yes in several situations. The provider can release if a FERPA-compliant release form is in place. In addition, an exception in FERPA allows school staff to share information with “school officials” in the same educational agency who have a “legitimate educational interest” in the information. The term “school official” includes school staff, such as teachers, counselors, principals, and school nurses. A school or district may define this term more broadly in its school policies so that it also includes outside consultants, contractors or volunteers to whom a school has outsourced a school function if certain conditions are met.76 The school official must have a “legitimate educational interest” in the information. This phrase has been defined to mean that the school official needs the information to perform his or her official duties.77 FERPA requires schools to include in their annual notices to parents a statement indicating whether the school has a policy of disclosing information from the education file to school officials, and, if so, which parties are considered school officials for this purpose and what the school considers to be a “legitimate educational interest.”78