FERPA supersedes the HIPAA Privacy Rule when school health records fit FERPA's definition of 'education records' or 'treatment records'.

• A. FERPA supersedes HIPAA Privacy Rule when school health records fit FERPA's definition of 'education records' or 'treatment records'
• B. HIPAA always supersedes FERPA in all school health records
• C. FERPA and HIPAA do not interact
• D. HIPAA supersedes FERPA for all health records in schools

Answer: (A)

The key idea is how FERPA and HIPAA interact in the school setting. When health records are created and kept by the school or by someone acting for the school, and they are directly related to a student, those records are education records under FERPA. FERPA governs how those records can be accessed and disclosed, and HIPAA’s Privacy Rule does not override FERPA in this context. This includes records kept for the purpose of providing health services within the school, often referred to as treatment records. Because FERPA applies to these records, it supersedes HIPAA for their privacy protections and disclosures among school officials and with parents or eligible students, subject to FERPA’s own exceptions. HIPAA would apply only to health records outside the school’s control or to records maintained by non-school health providers. So the statement is correct: FERPA takes precedence for school health records that fit the education or treatment record definitions.