HIPAA and FERPA

1
HIPAA and FERPA
ECURE 2002

• (or, Is Your HIPAA Eating Your FERPA?)
• C.W. Goldsmith
• The University of Texas System

2
Comparison of FERPA and HIPAA

• History of FERPA and HIPAA
• Administrative Rule versus Law
• Whats Covered?
• What are the Penalties?
• Similarities
• Coping Strategies
• Whos Not Covered?
• Opportunity

3
History

• Why FERPA?
• 1960s Berkeley Free Speech
• Loss of loco parentis
• 1974 FERPA (Buckley) in Response to Abuse

• Why HIPAA?
• 1996 Failure to Leverage Technology to Reduce
  Costs

4
Difference Between Administrative Rule and Law

• Rule Offers More Less Formal Steps to Discover
  Problems/Answers to Resolve Issues/Complaints
  Before Going to Court
• HIPAA is Both
• Enforcement Through the Office of Civil Rights
• FERPA is Both

5
Whats Covered ?

• FERPA
• Education Records/Privacy

• HIPAA
• Code Sets
• Privacy
• Security
• Identifiers

6
Implementation Dates

• FERPA
• 1974

• HIPAA
• Code Sets October 16, 2002
• Privacy April 14, 2003
• Security
• Identifiers -- ??

7
What are the Penalties?

• FERPA Penalties
• Institutional Sanctions
• Loss of Federal Funding

• HIPAA Penalties
• Security A Maximum of 25,000
• Privacy
• Intent to 50,000, one year in jail
• False pretenses 100,000, 5 years jail
• Commercial or personal gain 250,000, 10 years
  jail

8
What are the Penalties?

• FERPA Penalties
• No right of personal action, Civil Rights Cause
  of Action May Exist Against Public Institutions

• HIPAA Penalties
• Transactions/codes/identifiers
• 100 per incident/up to 25,000 per year per
  standard

9
Any Similarities?

• FERPA Directory Information
• opt out

• HIPAA Directory Information
• opt in

10
What does HIPAA say about FERPA?

• HIPAA says FERPA is to be followed for student
  medical record
• FERPA says student medical record not covered
• HIPAA says medical records seen by other than
  physician/nurse is an education record and must
  be handled accordingly

11
Coping Strategies

• HIPAA
• Use HIPAA to Refresh Campus Understanding of
  FERPA
• Compliance and Federal Sentencing Guidelines
  Encourage Training Everyone(!)
• UAB Committee Structure

• FERPA
• Culture and education
• History

12
UAB HIPAA Steering Committee
Clair Goldsmith, PhD
Lucy Hicks, JD
Joan Lorden, PhD
Michael R. Waldrum, MD
Advisory Staff
J Hicks J Piazza, JD T Tatum, JD
Technical Advisory
Don Fast Landy Manderson
UAB Clinics
Employees
Research
HSIS / Children's
Students
Tusc / Hunstville Clinics
Roger McCullough
All UAB Campus and affiliated
Viva / VA
William Fulcher, MD
Allen Bolton
Training/Insurance
William Grizzle, MD, PhD
Amanda Dorsey
Hunstville / Tusc?
All Campus and Hunstville Tusc
EDI
EDI
EDI
EDI
EDI
Privacy
Privacy
Privacy
Privacy
Privacy
Security
Security
Security
Security
Security
Identifiers
Identifiers
Identifiers
Identifiers
Identifiers
13
Communities Not Covered by FERPA and HIPAA

• Human Research Subjects in Other Disciplines
• Psychology, Education
• IRB Responsibility/Waiver
• What is Done With Personally Identifiable
  Research Information when Investigator Leaves the
  Institution?

14
Conclusion

• FERPA and HIPAA Are Great Platforms for the
  Exercise of Leadership in Protecting Privacy of
  Individuals

15
But

• Why hasnt Higher Education Taken a Stronger Role
  in the use of Technology to Protect Privacy?

16
http//www.educause.edu/pub/er/erm01/erm015w.htm
lemailcgoldsmith_at_utsystem.edu