ECURE 2002

HIPAA and FERPA

(or, Is Your HIPAA Eating Your FERPA?)

C.W. Goldsmith
The University of Texas System

1

Comparison of FERPA and HIPAA

History of FERPA and HIPAA
Administrative Rule versus Law
What’s Covered?
What are the Penalties?
Similarities
Coping Strategies
Who’s Not Covered?
Opportunity

2

History

Why FERPA?
- 1960s Berkeley Free Speech
- Loss of Ioco parentis
- 1974 FERPA (Buckley) in Response to Abuse

Why HIPAA?
- 1996 Failure to Leverage Technology to Reduce Costs

3

Difference Between Administrative Rule and Law

Rule Offers More Less Formal Steps to Discover Problems/Answers to Resolve Issues/Complaints Before Going to Court
HIPAA is Both
- Enforcement Through the Office of Civil Rights
FERPA is Both

4

What’s Covered?

FERPA
- Education Records/Privacy

HIPAA
- Code Sets
- Privacy
- Security
- Identifiers

5

Implementation Dates

FERPA
- 1974

HIPAA
- Code Sets - October 16, 2002
- Privacy - April 14, 2003
- Security
- Identifiers- ??

6

What are the Penalties?

FERPA Penalties
- Institutional Sanctions
  - Loss of Federal Funding

HIPAA Penalties
- Security: A Maximum of $25,000
- Privacy:
  - Security
  - Identifiers

7

What are the Penalties?

FERPA Penalties
- No right of personal action, Civil Rights Cause of Action May Exist Against Public Institutions

HIPAA Penalties
- Transactions/codes/identifiers:
  - $100 per incident/up to $25,000 per year per standard

8

Any Similarities?

FERPA Directory Information
- opt out

HIPAA Directory Information
- opt in

9

what does HIPAA say about FERPA?

HIPAA says FERPA is to be followed for student medical record
FERPA says student medical record not covered
HIPAA says medical records seen by other than physician/nurse is an education record and must be handled accordingly

10

Coping Strategies

FERPA
- Culture and education
- History

HIPAA
- Use HIPAA to Refresh Campus Understanding of FERPA
- Compliance and Federal Sentencing Guidelines Encourage Training Everyone(1)
- UAB Committee Structure

11

UAB HIPAA Steering Committee

[Hierarchy of the UAB HIPAA Sterring Committee]

12

Communities Not Covered by FERPA and HIPAA

Human Research Subjects in Other Disciplines
- Psychology, Education
IRB Responsibility/Waiver
What is Done With Personally Identifiable Research Information when Investigator Leaves the Institution?

13

Conclusion

FERPA and HIPAA Are Great Platforms for the Exercise of Leadership in Protecting Privacy of Individuals

14

But...

Why hasn’t Higher Education Taken a Stronger Role in the use of Technology to Protect Privacy?

15

http://www.educause.edu/pub/er/erm01/erm015w.html

email: cgoldsmith@utsystem.edu

16