Dear FERPA Professor,
I am reaching out regarding a question we have related to Treatment records. Our Student Counseling Center had a privacy breach related to their treatment records; once we determine that a breach does not fall under FERPA – because it’s exempt – does our office need to retain any documentation of the matter or record it on the student record?
Thank you,
Ms. Pine
Dear Ms. Pine,
At the postsecondary level medical/treatment records are exempt from the definition of education records, but only so long as they are only shared with other treatment providers. (See § 99.3"Education Records" (b)(4) in the FERPA regulations.) Once they are disclosed to individuals other than treatment providers they lose their exempt status and become education records. This would include a breach such as you describe. Thus, § 99.32 of the FERPA regulations would require that notice of the disclosure be recorded in the students' education records.
I hope this is helpful in responding to your inquiry. You can find the above-cited regulations on pages 154 and 163 of the
2012 AACRAO FERPA Guide.
The FERPA Professor
Want the Professor to come to your campus? Visit our FERPA compliance training page.
AACRAO members, send your questions to the FERPA Professor at communications@aacrao.org.