Federal Student Privacy Rights and Vaccine Registries

To activate and view hyperlinked references, please click once and then click any superscripted number below to access a hyperlinked reference, or scroll down to the bottom of the article to view all hyperlinked references.

Educating yourself on student enrollment requirements during the K-12 or college enrollment process isn’t limited to understanding vaccine requirements and exemptions.

Legislation introduced in some states like Colorado is shifting the authority to obtain vaccine status information on individuals from educational institutions to health departments, which poses a threat to students’ privacy. ^{1 2}  

Protecting your minor child’s privacy will largely depend on your understanding of student privacy rights. Becoming knowledgeable about federal student privacy rights and how federal law intersects with state vaccine laws when vaccine status information is gathered and entered into electronic immunization information systems (IIS), better known as vaccine-tracking registries, will help prevent inadvertent loss of these federal student privacy rights.

The majority of state vaccine-tracking registries are opt-out, meaning you or your child’s vaccine information may already be in your state’s vaccine tracking registry without your knowledge or express consent and, if you do not want to share that information, you must actively opt out.

Data Sharing with Vaccine Registries

Most states maintain an electronic vaccine-tracking registry to monitor the vaccination status of children, ³ and in some states these registries also track adult vaccination status. ⁴ These registries obtain vaccination status information on individuals from a variety of health care sources through electronic health or medical record (EHR or EMR) data-sharing. ⁵ These sources include local public health agencies, pharmacies, health plans, school-based health centers, and health care professionals and facilities. In some states birth certificates are another source used to populate these registries with vaccination information.

Under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), student vaccination status stored in vaccine-tracking registries can be disclosed to third parties without consent from parents, guardians, and adult students. ⁶  

Most educational institutions are subject to a different set of federal privacy rules under the Family Educational Rights and Privacy Act of 1974 (FERPA). ⁷ Information gathered by any K-12 school, college, or university receiving federal funding from the U.S. Department of Education is subject to FERPA.

History of FERPA

During the 1820’s, records gathered by the New England states’ educational institutions grew to include more than enrollment and attendance data. These records, which are now known as a student’s educational record, in some cases included subjective and sensitive information about the student, the student’s family life and medical conditions, with no guidelines on how the disclosure of this information was to be made to parents, students and third parties. ⁸

By 1970 the lack of disclosure guidelines resulted in information being shared with third parties without parental or student knowledge or consent. Parents and adult students were also often banned from seeing what was contained in these records. ⁹

Due to these privacy concerns, Congress passed FERPA in 1974 with the intent of providing students and parents access to the educational record and to bar the release of an individual’s records to anyone else without the consent of the adult student, or the parents and guardians of a minor child. ¹⁰   

FERPA vs. HIPAA

There are differences between federal privacy rights ensured under the 1974 FERPA legislation, ^{11 12} and medical privacy rights defined in the 1996 HIPAA legislation. ¹³ Generally speaking, educational institutions subject to FERPA are prohibited from sharing any personally identifiable information in a student’s educational record, unless they have specific written consent from the student’s parents and guardians, or from the adult student. ¹⁴

While school vaccine information is usually a part of the educational record, protection from disclosure also depends on what entity is gathering vaccination information.

• If your state’s school vaccine laws require that school vaccine information be submitted directly to a health department or other state agency instead of the educational institution, it is not protected by FERPA and will likely end up in an electronic vaccine-tracking registry;

• If your state’s school vaccine laws require educational institutions subject to FERPA to gather vaccination information, then it is protected under FERPA and cannot be uploaded to an electronic vaccine-tracking registry by the educational institution. It also prevents the educational institution from disclosing personally identifying information to third parties without specific written consent from parents, guardians and adult students; ¹⁵

• While student vaccination information may be protected by FERPA in an educational setting, there are other sources that may provide a student’s vaccination information to your state’s vaccine-tracking registry.

As with every rule and law, there are exceptions. For example, educational institutions subject to FERPA can disclose a student’s personally identifiable information when there is a public health emergency or other circumstance that is considered to be a threat to public safety. ¹⁶

Overlap between FERPA and HIPAA

While in the majority of cases FERPA supersedes HIPAA in the educational setting, there are instances where FERPA and HIPAA interact together. For example, there is interaction between these laws when schools or colleges provide health care services to enrolled students. ¹⁷ To understand when both FERPA and HIPAA apply and how privacy is preserved, the U.S. Department of Education and the Department of Health and Human Services have issued joint guidance to inform school personnel and the public. ¹⁸

The differences in FERPA and HIPAA underscore the importance of understanding privacy rights and school vaccine laws, their application to your situation, and how they interact with each other when you complete school enrollment forms.

Enforcement of FERPA

Protecting and maintaining privacy when it comes to informed consent to vaccination and making voluntary vaccine decisions for minor children continues to be a hotly debated topic in America. Where privacy is protected by FERPA, violations can and should be reported.

If you believe your FERPA rights have been violated, filing a complaint against an educational institution is relatively easy. A claim must be filed within six months of the violation by the parent or guardian on behalf of a minor child, or by the adult student. ¹⁹

FERPA violations by educational institutions can result in the withholding of federal funds, a cease and desist order, or termination of eligibility for funding under any applicable program. ²⁰ 

Educate Yourself and Protect Vaccine Choice and Privacy Rights 

The introduction of legislation to restrict or eliminate the legal right to make vaccine choices and the erosion of privacy is likely to continue across America in the foreseeable future.

Any abuse of school vaccine laws that involve violations of privacy when personal medical information is shared without consent, should be brought to the attention of the agencies involved and copied to your state legislator with a request for corrective measures. You can learn about your state’s vaccine requirements, exemptions and vaccine-tracking registry on NVIC’s state pages.

NVIC’s free Advocacy Portal tracks legislation to expand or restrict vaccine choices and privacy. NVIC’s staff does the heavy lifting for you and provides analysis of legislation, timely updates and action alerts, effective advocacy tips, and hyperlinks to quickly and easily communicate with your legislators. Every voice is needed and NVIC is here to help make your voice heard. Register today!

Leave a comment

Your email address will not be published. Required fields are marked with an *

* Name

Name is a required field

* Email

Please enter a valid email address

* Comments

Please enter a comment.

Post Comment

2 Responses to "Federal Student Privacy Rights and Vaccine Registries"

Dani

Posted: 7/31/2019 1:16:09 PM

Parents, be aware also that many health forums (in our district, the topics typically were vaccination, and mental health/the need for psychotropic medications) held in school (to minors) do not require parental consent due to the New Freedom Commission Group (created by presidential executive order in 2002). Many of these presentation are put on by astroturfing organizations (front organizations for pharmaceutical companies under the guise of a "grassroots" movement). When I first learned of this, I submitted a Parental Exemption Form exerting my parental right that my child be exempt from these types of presentations. The "powers that be" are trying every angle ... parents, be aware.

loryn Ankeny

Posted: 7/31/2019 2:00:57 PM

It seems that whoever determined these rules about vaccine information, seemed to be able to change any rule they wanted. I thought that with these HIPAA laws, that all medical info should be private. The federal govt. should not be able to access these records under any circumstances. Informed consent should be the norm, not mandatory vaccinations and any govt agency able to access educational info or medical info. The govt needs to cease and desist where it comes to medical info privacy.