Most educational institutions are subject to federal privacy rules under the Family Educational Rights and Privacy Act of 1974 (FERPA). Information gathered by any K-12 school, college, or university receiving federal funding from the U.S. Department of Education is subject to FERPA.
There are differences between federal privacy rights ensured under the 1974 FERPA legislation, and medical privacy rights defined in the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Generally speaking, educational institutions subject to FERPA are prohibited from sharing any personally identifiable information in a student’s educational record, unless they have specific written consent from the student’s parents and guardians, or from the adult student.
While school vaccine information is usually a part of the educational record, protection from disclosure also depends on what entity is gathering vaccination information.
- If your state’s school vaccine laws require that school vaccine information be submitted directly to a health department or other state agency instead of the educational institution, it is not protected by FERPA and will likely end up in an electronic vaccine- tracking registry. Under HIPAA, student vaccination status stored in vaccine-tracking registries can be disclosed to third parties without consent from parents, guardians, and adult students.
- If your state’s school vaccine laws require educational institutions subject to FERPA to gather vaccination information, then it is protected under FERPA and cannot be uploaded to an electronic vaccine-tracking registry by the educational institution and prevents the educational institution from disclosing personally identifying information from to third parties without specific written consent;
- While student vaccination information may be protected by FERPA in an educational setting, there are other sources that may provide a student’s vaccination information to your state’s vaccine-tracking registry.
