FERPA, HIPAA, and Student Record Keeping Overview Part 2

Giving records to: 1) appropriate officials in health and safety emergencies 2) state and local authorities within a juvenile just system in accordance with state law 3) organizations conducting studies for or on behalf of the school, as long as personally identifiable information is used only for the purpose of the study, the study does not permit personal identification f students or parents by anyone other than the researchers or school officials with legitimate interests, and personally identifiable information is returned to the school or destroyed when no longer needed for research purposes 4) Other schools to which a student is transferring 5) Specified officials for audit and evaluation purposes

Information in the student record is: 1) inaccurate. 2) misleading. 3) violates the privacy or other rights of the student.

Schools must have a written policy consistent with FERPA regarding parent access to education records and confidentiality of records and provide annual notice to parents and eligible students of their right to inspect records.

A school must inform parents when any personally identifiable information collected, maintained, or used in accordance with Part B is no longer needed before it destroys that information. Schools are cautioned against destroying test protocols if such actions could deny parents their legal right to access to information used in educational decision making about their child.

Found that giving a copy of a copyrighted test protocol to the parents of special education students falls within the "fair use doctrine" of federal copyright law. Schools need to provide a copy of only those portions of the protocol that show the child's answers. To minimize the risk of improper use, the District may choose to use appropriate safeguards, such as requiring a review by parents of the original test protocols before obtaining a copy, a written request for a copy, a nondisclosure of confidentiality agreement, or other reasonable measures.

The Health Insurance Portability and Accountability Act. A 1996 federal law created to protect the privacy and security of patient physical and mental health information and to ensure the efficient electronic exchange of patient information and health care claims.

1) Privacy rules requiring procedures to effectively control access to and disclosure of personally identifiable patient information. 2) Security rules addressing standards for creation and maintenance of electronic private health records. 3) Transmission rules assuring secure and uniform electronic transmission of patient information.

APA suggests psychologists retain full records on adult clients until 7 years after the last date of service, and retain the records of minor clients for three years after the minor has reached the age of majority in the state where the psychologist practices. Student test protocols should be retained until there is a pattern of relatively stable findings across multiple reevaluations.

School psychologists must take special care to ensure that their files are always encrypted and password-protected, especially when using laptops and storage devices. In addition, they should avoid creating and sending sensitive information when using unsecured wireless access and personal digital assistant (PDA) devices (handheld mobile communication and computing devices).