Sara Jasper, JD
Staff Attorney
The Therapist
March/April 2017

---

This is Part 1 of a three-part series called Practice Guidelines for School-Based Psychotherapists. The three-part series will discuss the Family Educational Rights and Privacy Act (FERPA), the Health Insurance Portability and Accountability Act (HIPAA), state laws and professional codes of ethics and how they apply to the work of school-based psychotherapists. This first installment of the series discusses the importance of school personnel working together to create a program that meets the needs of the students while complying with relevant laws and ethical codes. The article also provides an overview of FERPA and how it may apply to school-based therapy programs.

Introduction
Mental health programs are an important part of support services offered to students. To be effective, such programs require collaboration between school professionals and mental health providers. Such programs require planning to ensure a shared understanding of the services to be provided, clear and open communication between school staff and providers, and a mutual understanding of the roles and responsibilities of those involved.

Every setting is different and providers should collaborate with school personnel to determine how, where, and when services can best be offered. Flexibility is often needed, as providers adapt to settings, which are different from the clinic or office settings they may be used to. Similarly, school professionals may be unfamiliar with the variety of legal and ethical standards that govern the conduct of mental health professionals concerning issues such as consent, confidentiality, and access to treatment records.

Laws to Consider When Establishing School-Based Mental Health Programs
Whether a school must comply with FERPA or HIPAA depends on how a counseling program is structured. FERPA and HIPAA are federal laws that protect privacy and limit how personal information can be shared. Generally speaking, HIPAA limits disclosure of health information maintained by health care providers and FERPA limits disclosure of information in education records that are maintained by schools. One of these federal laws may apply to counseling programs and the records that are generated by the counseling staff. The ways counseling programs are run and how the record is treated determines which of these laws applies. State laws and professional ethical standards should also be considered when a mental health program is being developed.

School personnel should decide and, at all times, be clear about which services will be provided by the school-based counseling staff and whether the counseling program will be academic, career, and psychoeducational in nature, or whether the program will also include a therapeutic services component. Other important decisions and steps include identifying who will run the counseling program and developing program goals, policies and procedures that meet the legal and ethical standards which pertain to those counseling services. If any of these aspects of a program lack clarity or are not clearly defined, it will be difficult, if not impossible, to carry out the program in accordance with appropriate legal and ethical standards. A school that fails to handle students’ confidential information and records responsibly can face serious, and potentially expensive, consequences for violating the rights of students and their parents.

Overview of FERPA
FERPA is a federal law that protects the privacy of students’ “education records” and parents’ rights or students’ rights to access that specific type of record.¹ The law applies to all education records that are created and maintained by schools, whether public or private, that receive funds under the programs of the U.S. Department of Education.

Education Records Defined
Under FERPA, education records are defined as records that are 1) directly related to the student and 2) maintained by an educational agency or institution or by a party acting on behalf of the agency or institution.² At first glance, this definition might appear to describe students’ counseling records. Records created and maintained by school-based counselors will often, if not always, relate to the students whom they serve. And, school-based counselors, whether employees of the school district or contracted providers, can often accurately be categorized as parties acting on behalf of the educational agency or institution.

Exceptions
However, mental health providers and school officials must be aware of an important exception to this seemingly all-encompassing definition of education records. FERPA law excludes records which are 1) kept in the sole possession of the maker and 2) are not accessible or revealed to any other person, except a temporary substitute for the maker of the record from the definition of education records.³

While FERPA does not provide an exception for mental health records specifically, an exception can be applied to records that have not been shared. Therefore, the recordkeeping practices of school-based counselors, and any policies related to access of students’ counseling records, determine whether those records are education records or whether they fall outside of that definition and beyond the reach of FERPA.

Specifically excluded from the definition of education records under FERPA are treatment records about students who are 18 years of age or older, or are attending an institution of postsecondary education 1) which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional or paraprofessional capacity, or assisting in that capacity, and 2) which are made, maintained, or used only in connection with the provision of treatment to the student, and 3) are not available to anyone other than persons providing the treatment.⁴

These exceptions for sole-possession records and treatment records of students age 18 or older are not absolute. Once sole-possession records or treatment records are shared with a third party outside of the treatment realm, they may then be treated as an education record under FERPA. For example, mental health records that are maintained using a software program for education records which can be accessed by all school personnel may then be considered an education record and subject to FERPA law because the provider did not keep those records separate from the education record. A school-based counselor who is attempting to protect students’ counseling records from becoming part of the education must maintain sole-possession of those records. The records cannot be shared with anyone, other than another provider for the purpose of treatment. Even if records have been handled in a manner which gives rise to assertions they are education records, counselors should take caution before handling them in accordance with FERPA because the proper treatment of those records may also be governed by applicable state laws and professional ethical standards.

The categorization of mental health records is sometimes also contemplated in the context of services being provided to students under the Individuals with Disabilities Education Act (IDEA). Depending upon the needs of a child, Special Education resources may include a mental health assessment and treatment. In those cases, and with consent of the parents, Individualized Education Plans (IEPs) will include information about mental health services and the measurable mental health treatment goals that are created to address students’ educational needs. In those situations, it is critical for those involved in the IEP process to understand that IEPs and mental health records are separate records. Although IEPs, which may contain information about students’ mental health, are education records which are subject to FERPA, the mental health records of students receiving Special Education services do not become education records merely because the mental health provider is involved in rendering specialized services under the IDEA.

Just as a counselor has to be mindful about what information to share with the school, schools that hire outside contractors need to be mindful about what information from education records may be shared with those providers. The U.S. Department of Education has indicated that schools operating in accordance with FERPA may disclose education records to parties whom they have hired to offer services, as long as that disclosure is governed by the same conditions which apply to school personnel who are employed by the school. In order to release information from education records, a school must be able to demonstrate the following: 1) The outside party provides a service for the school that it would otherwise provide for itself using employees; 2) The outside party would have legitimate educational interests in the information disclosed if the services were being performed by employees; and 3) The outside party is under the direct control of the school with regard to the use and maintenance of information from education records.⁵ Schools are responsible for ensuring that their contractors comply with FERPA laws.

Access to Records, Considerations Under FERPA
FERPA law gives parents the right to inspect and review their children’s education records which are maintained by the school.⁶ Once a student reaches the age of 18, that right to inspect and review those education records transfers to the student.⁷ The law also gives parents, or students who have reached the age of majority, the right to request that those education records be amended under certain circumstances.⁸ FERPA law does not, however, require schools to provide copies of the education records, unless it is impossible for the parents or students to inspect the records. In those situations, schools may charge a fee for copies.

Counseling records that have not been shared do not fall under FERPA. Providers who have shared students’ counseling records as discussed below should seek legal guidance as to whether FERPA access laws are applicable or whether state laws and ethical standards would apply when requests for records are made.

Records which fall under the definition of education records and are, therefore, subject to FERPA generally should not be released without the written consent of a parent or the of-age student.⁹ Common exceptions to the requirement include instances when school officials have a legitimate education interest or when the release is deemed necessary to protect the health or safety of a student or others.¹⁰ The United States Department of Education has interpreted the term “school official” to include a teacher; school principal; president; chancellor; board member; trustee; registrar; counselor; admissions officer; attorney; accountant; human resources professional; information systems specialist; and support or clerical personnel.¹¹ The Department would consider a school official to have a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.¹² The term “legitimate educational interest” generally refers to the right of certain school officials to access student information and records for the purpose of serving a student; protecting the health, safety, and learning of the student and others; maintaining operations of the school district; obtaining payment for educational programs and services; and other purposes as specified in federal and State law.¹³

As in cases where school officials have a legitimate educational interest in documents that fall within the definition of an education record, FERPA also allows for unauthorized disclosures of information from these records in emergencies. FERPA permits these unauthorized disclosures if a good faith belief exists that the release of information is necessary to prevent or lessen a serious and imminent threat to the health or safety of the student or others and is reasonably able to present or lessen the threat.¹⁴ School officials are not required to collect evidence of “an articulable and significant threat” prior to contacting those that can intervene to protect.¹⁵ Emergency disclosures may be made to law enforcement, family members, the target of the threat or others who the school counselor believes can help mitigate the threat.¹⁶ The U.S. Department of Education has interpreted this exception to be limited to the time of the emergency. The exception does not apply to situations where a possible threat exists, but the probability of that threat occurring is unknown. Likewise, disclosures made for emergency preparedness drills are not permitted under the emergency exception. Schools must evaluate whether an emergency exists on a case-by-case basis.¹⁷

Similar to California law, FERPA provides that students’ counseling records or treatment records may be shared with health care providers who are treating them without compromising the confidential status of those records. This includes providers who are not employees of, or acting on behalf of, the school if the information is released for the purpose of offering treatment to students. Counseling records may likewise be shared with third-party health care providers if the parent or the of-age students have asked that a physician or  other health care professional be given access to them.¹⁸ If, however, the records are being disclosed for a reason other than treatment and none of the exceptions to the consent requirement apply, written consent should be obtained prior to release. Finally, providers should be aware that oral communications and/or personal observations are not considered part of the counseling record or categorized as part of the education record under FERPA and may be shared accordingly, as long as that release of information is not prohibited by state law or relevant codes of ethics. Under state law, oral communications between a provider and a student that were part of a confidential therapeutic session would be considered confidential.

Whether FERPA applies to a mental health records depends upon how the records are managed. The handling and disclosure of mental health records are also governed by professional codes of ethics as well as state laws, including laws related to medical confidentiality, minor consent, professional licensing laws, and education laws. These legal and ethical standards place restrictions on release of mental health records and must be considered by school-based mental health providers and other school personnel before decisions about release of those records are made.

This concludes Part 1 of the series. Part 2 of the series will appear in subsequent issues of the magazine and cover the relevant aspects of HIPAA law, state law, and ethical codes that must be considered by school-based psychotherapists. Part 3 of the series will address how the legal and ethical standards apply to common scenarios psychotherapists face as they work to provide school-based mental health services.

---

Sara Jasper, JD, is a staff attorney for CAMFT. Sara is available to answer member calls regarding legal, ethical, and licensure issues.

---

Endnotes 

¹ 20 U.S.C. §1232g; 34 CFR Part 99
² 20 U.S.C. §1232g(a)(4)(A); 34 CFR §99.3
³ 20 U.S.C. §1232g(a)(4)(B)(i)
⁴ 20 U.S.C. §1232g(a)(4)(B)(iv)
⁵ U.S. Dept. pf Educ., Family Policy Compliance Office, Letter to Clark County School District (NV) re: Disclosures of Education Records to Outside Service Providers, June 28, 2006, available at www.ed.gov/policy/gen/guid/fpco/ferpa/library/clarkcty062806.html.
⁶ 20 U.S.C. §1232g(a)(1)(A)
⁷ 20 U.S.C. §1232g(d); 34 CFR §99.3
⁸ 34 CFR §§ 99.10-99.12 and §§99.20-99.22
⁹ 34 CFR §99.30
¹⁰ 20 U.S.C. §1232g(b)-(j); 34 CFR §§99.31(a)(1) and 99.31(a) (10); 34 CFR §99.36
¹¹ U.S. Dept. of Educ. Privacy Office, June 8, Letter to Honorable Ron Wyden of the United States Senate re: applicability of FERPA to college and university students’ medical records, including therapy and treatment records, held by educational institutions, June 8, 2015, available at https://www2.ed.gov/policy/gen/guid/ fpco/doc/letter-to-senator-ron-wyden.pdf
¹² Id.
¹³ Schwab NC, Rubin M Mare JA, Gelfman MHB, Bergren MD, Mazyck D, Hine B. (2005), Protecting and Disclosing Student Health Information: How to Develop School District Polices and Procedures. Kent, OH: American School Health Association
¹⁴ 34 CFR §99.36(a)
¹⁵ 34 CFR §99.36 (c)
¹⁶ 45 CFR §164.512(j)(1)(i)
¹⁷ U.S. Dept. of Educ. Family Compliance Policy Office, Letter to University of Mexico re: applicability of FERPA to Health and Other State Reporting Requirements, Nov. 29, 2014, available at www. ed.gov/policy/gen/guid/fpco/ferpa/baiseunmslc.html
¹⁸ 20 U.S.C. §1232g(a)(4)(B)(iv)

---

This article is not intended to serve as legal advice and is offered for educational purposes only. The information provided should not be used as a substitute for independent legal advice and it is not intended to address every situation that could potentially arise. Please be aware that laws, regulations and technical standards change over time. As a result, it is important to verify and update any reference or information that is provided in this article.