Q. What does HIPAA's Privacy Rule cover?
A. HIPAA's Privacy Rule covers the use and disclosure of Protected Health Information by Covered Entities.
Q. Is the Student Health Center covered under HIPAA?
A. While they offer health, sports medicine, and mental health/counseling services, the Student Health Center, Human Performance and Sports Medicine Department, Student Counseling Services, and Office of Alcohol, Drug and Wellness Education are not covered under HIPAA's Privacy Rule, in part, because they do not submit electronic claims for payment of the services they render. Moreover, the health records they create (or receive) for students either meet the definition of "Medical Record" or "Education Record" under the Family Educational Rights and Privacy Act (FERPA), which is expressly excluded under HIPAA.
Q. Does HIPAA's Privacy Rule change or modify any of FERPA's provisions regarding the use or disclosure of "Medical Records" or "Education Records?"
A. No. HIPAA's Privacy Rule expressly states that it does not affect or change FERPA.
Q. If a student-athlete is seen in the Student Health Center, are the records covered by HIPAA or FERPA?
A. They are considered either a "Medical Record" or an "Education Record" under FERPA, the same as any other student's record.
Q. Are hospitals and private physicians to whom the Student Health Center may send a student for treatment covered by HIPAA?
A. Yes. Hospitals, private physicians and other health care providers are covered by HIPAA and must comply with HIPAA's Privacy Rule governing the use and disclosure of Protected Health Information.
Q. Are records (x-rays, test results, treatment and treatment records) that hospitals and physicians send to the Student Health Center protected by HIPAA?
A. Yes, these records are protected by HIPAA when they are in the possession of the hospital or private physician, which are Covered Entities. The hospital or physician may send a copy of these records to nurses or physicians at the Student Health Center, without a HIPAA Authorization, when the Student Health Center maintains these records for treatment purposes. Once these records become a part of the student health records maintained by the Student Health Center, they either will be considered a "Medical Record" or an "Education Record" under FERPA and, therefore, would be subject to FERPA's requirements for written Consent by the student before they can be inspected or released.
Q. Can the Student Health Center release health care information (such as immunization records or laboratory test results) to students, who sign a Consent for Release and Disclosure?
A. Yes. Neither HIPAA nor FERPA prohibits the Student Health Center from releasing health care information to a student, who signs a Consent for the release and receipt of his or her own health care information. There are two considerations to keep in mind, however: First, if the student is younger than 18 years, then a parent would need to sign. Even under these circumstances, the student still may receive his or her own information. Second, it is foreseeable that the student may give this health care information to a professor or other third party. Once that occurs, the information may no longer be protected by FERPA or HIPAA. Having the Student Health Center send health care information directly to a physician, from a HIPAA standpoint, would ensure that the health care information remains "protected," since the physician is a Covered Entity and is required to comply with HIPAA's Privacy Rule.
Q. May Student Counseling Services send a student's counseling records to another counselor or health care provider?
A. Yes, for consultation purposes with another counselor or health care provider, located on-campus, as necessary to reasonably assure the student's health, safety and well-being. A student's written Consent is required if Student Counseling Services must consult with another counselor or health care provider located off-campus or refer the student to a counselor or health care provider who is not affiliated with Bethune-Cookman College.
Q. Is it necessary for the Student Health Center to give students a Notice of Privacy Practices?
A. No, because the Student Health Center are not Covered Entities under HIPAA. Bethune-Cookman College, however, is providing students and parents with a written explanation of what rules apply to privacy and confidentiality in this Q&A and in the accompanying Notice to Students and Parents.
Q. May the Student Health Center, disclose student health information to parents?
A. Yes. Under FERPA, disclosures may be made by a student's written Consent or, in some cases, disclosures may be made where there exists a legal obligation to report certain information to parents.
Q. May the Student Health Center disclose student health information to law enforcement officials?
A. Yes, as permitted by FERPA, for limited purposes of protecting the health and safety of the student, other students and the college community, and in connection with certain crimes, such as crimes of violence and sexual offenses.
Q. May the Student Health Center disclose student health information in an emergency or crisis situation?
A. Yes, disclosure is permitted if the information is necessary to protect the health and safety of the student, other students or other members of the college community. Disclosure of a student's health information under these circumstances is limited to the appropriate parties who have a legitimate interest in the behavior of the student, the health and safety of other students and/or the college community.
Q. May the Student Health Center disclose student health information to the Dean of Students?
A. Yes. A student's health information may be disclosed to the Dean of Students in the event of an emergency or as dictated by the Student Handbook and the Student Code of Conduct, to ensure that the appropriate response and follow-up measures are taken to protect the health and safety of the student, other students and members of the college community. Please refer to the Student Handbook and the Student Code of Conduct for additional information.