Dear FERPA Professor,
I am reaching out regarding a question we have related to Treatment records. Our Student Counseling Center had a privacy breach related to their treatment records; once we determine that a breach does not fall under FERPA – because it’s exempt – does our office need to retain any documentation of the matter or record it on the student record?
Thank you,
Ms. Pine
Dear Ms. Pine,
At the postsecondary level medical/treatment records are exempt from the definition of education records, but only so long as they are only shared with other treatment providers. (See § 99.3"Education Records" (b)(4) in the FERPA regulations.) Once they are disclosed to individuals other than treatment providers they lose their exempt status and become education records. This would include a breach such as you describe. Thus, § 99.32 of the FERPA regulations would require that notice of the disclosure be recorded in the students' education records.
I hope this is helpful in responding to your inquiry. You can find the above-cited regulations on pages 154 and 163 of the
.
The FERPA Professor
Want the Professor to come to your campus? Visit our FERPA compliance training page.
̽»¨Â¥ members, send your questions to the FERPA Professor at communications@aacrao.org.