\n
Contact the HIPAA Privacy Program<\/h3>\n <\/div>\n \n \n \n <\/i>\n Email:<\/span>\n <\/div>\n hipaa@nau.edu<\/div>\n <\/a>\n \n \n <\/i>\n Call:<\/span>\n <\/div>\n 928-523-7906<\/div>\n <\/a>\n <\/div>\n<\/div>\n\n<\/span><\/p>\n<\/div>\n<\/div>\n<\/span><\/p>\nHIPAA & FERPA<\/h1>\n
The U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services published<\/a> joint guidance addressing the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to health records maintained on students.<\/p>\nFor colleges and universities, FERPA\u2014not HIPAA\u2014<\/strong>governs most student health records.<\/p>\nThis is because health and counseling records maintained by a postsecondary institution for its own students are considered education records or treatment records under FERPA. The HIPAA Privacy Rule explicitly excludes education records from its definition of PHI.<\/p>\n\n
\n \n \n When FERPA applies Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n \n \n\nCampus Health Services (CHS) or Counseling <\/strong><\/h4>\n\n- Records on students are FERPA education or treatment records.<\/li>\n
- HIPAA does not apply to those student records.<\/li>\n
- FERPA controls access, disclosure, and parental involvement.<\/li>\n<\/ul>\n
Treatment records vs. Education records<\/strong><\/h4>\n\n- Treatment records<\/strong>: Records made or maintained by a physician, psychiatrist, psychologist, counselor or other recognized professional for the purpose of providing treatment, used only by treating providers, and disclosed only to those providers (or the student’s chosen physician for review).\n
\n- Treatment records are excluded from the general definition of education records, so they are not subject to routine FERPA disclosures that education records might be (e.g., to school officials with “legitimate educational interest”). This limits who can see sensitive clinical notes.<\/li>\n<\/ul>\n<\/li>\n
- If used or disclosed for any other purpose (such as billing insurance), they become<\/em> education records and are subject to FERPA’s consent rules.<\/li>\n<\/ul>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\n\n \n \n
When HIPAA applies at NAU Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n \n \n\nNon‑student patients<\/strong><\/h4>\nNAU’s HIPAA‑covered entities are called Health Care Components<\/a> (HCCs) and provide care to non‑students:<\/p>\n\n- Non-students can be university staff or family members and the public, obtaining treatment at the university.<\/li>\n
- These non-student health records created or maintained at a covered entity is PHI under HIPAA.<\/li>\n<\/ul>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\n\n \n \n
Students who are also employees Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n \n \n\nIf a student works for the university and receives health care from the institution:<\/p>\n
\n- They remain FERPA education or treatment records, not HIPAA PHI.<\/li>\n
- Such records would be covered as education records by FERPA and thus would not be covered by the HIPAA Rules<\/li>\n<\/ul>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n<\/div>\n
Sharing Information<\/h2>\n\n\n \n \n Under FERPA Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n \n \n\nStudent treatment records may be shared with other treating professionals or when appropriate, school officials, to coordinate the student’s care. When the university receives external health records, they become FERPA records. Please see the NAU’s FERPA<\/a> webpage for more guidance.<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\n\n \n \n Under HIPAA Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n \n \n\nStaff and providers may disclose PHI for treatment, payment or operational purposes without a seperate authorization, when a Notice of Privacy Practices has been given to the patient. Often a valid HIPAA authorization is necessary to share PHI unless a permitted exception exists.<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n
![\"\"](\"https:\/\/in.nau.edu\/wp-content\/uploads\/sites\/52\/2026\/03\/6448_Letters_20260219-medium-464x348.jpg\")
<\/h2>\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/strong><\/h2>\nFAQs<\/strong><\/h2>\n\n\n \n \n Q: What is the difference between education records and treatment records? Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n \n \n\nA: Education records are records directly related to a student and maintained by the university.<\/em> Treatment records are records on an eligible student<\/em><\/a> made or maintained by a clinician and used only for treatment, and are excluded from FERPA’s definition of education records while they remain limited to treatment use.<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\n\n \n \n Q: Who can see treatment records? Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n \n \n\nA: Only the treating providers may access treatment records; an eligible student<\/a> may have those records reviewed by a physician or other appropriate professional of their choice. If records are disclosed beyond treating providers for other purposes, they become FERPA education records.<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\n\n \n \n Q: Does HIPAA apply to Campus Health Services or Counseling records? Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n \n \n\nA: Usually no. FERPA applies to student health records maintained by a university’s covered entity and are governed by FERPA (or the school’s policies) rather than HIPAA; both treatment and education records at schools are generally excluded from HIPAA.<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\n
\n \n \n Q: When can treatment or education records be disclosed without student consent? Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n \n \n\nA: FERPA allows limited exceptions (e.g., health\/safety emergencies, lawfully issued subpoenas, transfers to other schools, or disclosures to school officials with legitimate educational interest).<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\n
<\/div>\n<\/div>\n<\/span><\/p>\n The U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services published<\/a> joint guidance addressing the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to health records maintained on students.<\/p>\n For colleges and universities, FERPA\u2014not HIPAA\u2014<\/strong>governs most student health records.<\/p>\n This is because health and counseling records maintained by a postsecondary institution for its own students are considered education records or treatment records under FERPA. The HIPAA Privacy Rule explicitly excludes education records from its definition of PHI.<\/p>\n\n NAU’s HIPAA‑covered entities are called Health Care Components<\/a> (HCCs) and provide care to non‑students:<\/p>\n If a student works for the university and receives health care from the institution:<\/p>\n Student treatment records may be shared with other treating professionals or when appropriate, school officials, to coordinate the student’s care. When the university receives external health records, they become FERPA records. Please see the NAU’s FERPA<\/a> webpage for more guidance.<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\n Staff and providers may disclose PHI for treatment, payment or operational purposes without a seperate authorization, when a Notice of Privacy Practices has been given to the patient. Often a valid HIPAA authorization is necessary to share PHI unless a permitted exception exists.<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n A: Education records are records directly related to a student and maintained by the university.<\/em> Treatment records are records on an eligible student<\/em><\/a> made or maintained by a clinician and used only for treatment, and are excluded from FERPA’s definition of education records while they remain limited to treatment use.<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\n A: Only the treating providers may access treatment records; an eligible student<\/a> may have those records reviewed by a physician or other appropriate professional of their choice. If records are disclosed beyond treating providers for other purposes, they become FERPA education records.<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\n A: Usually no. FERPA applies to student health records maintained by a university’s covered entity and are governed by FERPA (or the school’s policies) rather than HIPAA; both treatment and education records at schools are generally excluded from HIPAA.<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\n A: FERPA allows limited exceptions (e.g., health\/safety emergencies, lawfully issued subpoenas, transfers to other schools, or disclosures to school officials with legitimate educational interest).<\/p>\n<\/body><\/html>\n\n <\/div>\n<\/div>\n\n\nHIPAA & FERPA<\/h1>\n
When FERPA applies Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n
Campus Health Services (CHS) or Counseling <\/strong><\/h4>\n
\n
Treatment records vs. Education records<\/strong><\/h4>\n
\n
\n
When HIPAA applies at NAU Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n
Non‑student patients<\/strong><\/h4>\n
\n
Students who are also employees Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n
\n
Sharing Information<\/h2>\n\n
Under FERPA Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n
Under HIPAA Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n
<\/h2>\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/strong><\/h2>\n
FAQs<\/strong><\/h2>\n\n
Q: What is the difference between education records and treatment records? Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n
Q: Who can see treatment records? Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n
Q: Does HIPAA apply to Campus Health Services or Counseling records? Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n
Q: When can treatment or education records be disclosed without student consent? Accordion Closed<\/span><\/h4>\n <\/span>\n <\/div>\n <\/a>\n