Privacy Statement FAQs

HIPAA and FERPA are complicated federal laws. Each uses different terms to describe the legal requirements concerning how and when health information can be used and disclosed. Please note that under FERPA, which will be the dominant law pertaining to student health information at the University, a student's "Consent" is required before Mount Union can disclose his or her health information for purposes that are not permitted by law. Under HIPAA, which may apply when a student obtains Treatment outside of the University, an "Authorization" is required before the student's health information can be used or disclosed by a Covered Entity for purposes not related to health care and treatment.

Privacy Statement FAQs

What does HIPAA's Privacy Rule cover?

HIPAA's Privacy Rule covers the use and disclosure of Protected Health Information by Covered Entities.
What is a Covered Entity?

A Covered Entity is a health care provider that submits health claims electronically, a health plan, or a health care clearinghouse.
Are the Student Health Center, Human Performance and Sports Business Department, Student Counseling Services, and Office of Alcohol, Drug and Wellness Education covered under HIPAA?

While they offer health, sports medicine, and mental health/counseling services, the Student Health Center, Human Performance and Sports Medicine Department, Student Counseling Services, and Office of Alcohol, Drug and Wellness Education are not covered under HIPAA's Privacy Rule, in part, because they do not submit electronic claims for payment of the services they render. Moreover, the health records they create (or receive) for students either meet the definition of "Medical Record" or "Education Record" under the Family Educational Rights and Privacy Act (FERPA), which is expressly excluded under HIPAA.
Does HIPAA's Privacy Rule change or modify any of FERPA's provisions regarding the use or disclosure of "Medical Records" or "Education Records?"

No. HIPAA's Privacy Rule expressly states that it does not affect or change FERPA.
Are hospitals and private physicians to whom the Student Health Center, Student Counseling Services, and Office of Alcohol, Drug and Wellness Education may send a student for treatment covered by HIPAA?

Yes. Hospitals, private physicians and other health care providers are covered by HIPAA and must comply with HIPAA's Privacy Rule governing the use and disclosure of Protected Health Information.
Are records (x-rays, test results, treatment and treatment records) that hospitals and physicians send to the Student Health Center protected by HIPAA?

Yes, these records are protected by HIPAA when they are in the possession of the hospital or private physician, which are Covered Entities. The hospital or physician may send a copy of these records to nurses or physicians at the Student Health Center, without a HIPAA Authorization, when the Student Health Center maintains these records for treatment purposes. Once these records become a part of the student health records maintained by the Student Health Center, they either will be considered a "Medical Record" or an "Education Record" under FERPA and, therefore, would be subject to FERPA's requirements for written Consent by the student before they can be inspected or released.
Can the Student Health Center release health care information (such as immunization records or laboratory test results) to students, who sign a Consent for Release and Disclosure?

Yes. Neither HIPAA nor FERPA prohibits the Student Health Center from releasing health care information to a student, who signs a Consent for the release and receipt of his or her own health care information. There are two considerations to keep in mind, however: First, if the student is younger than 18 years, then a parent would need to sign. Even under these circumstances, the student still may receive his or her own information. Second, it is foreseeable that the student may give this health care information to a professor or other third party. Once that occurs, the information may no longer be protected by FERPA or HIPAA. Having the Student Health Center send health care information directly to a physician, from a HIPAA standpoint, would ensure that the health care information remains "protected," since the physician is a Covered Entity and is required to comply with HIPAA's Privacy Rule.
May Student Counseling Services or Office of Alcohol, Drug and Wellness Education send a student's counseling records to another counselor or health care provider?

Yes, for consultation purposes with another counselor or health care provider, located on-campus, as necessary to reasonably assure the student's health, safety and well-being. A student's written Consent is required if Student Counseling Services or Office of Alcohol, Drug and Wellness Education must consult with another counselor or health care provider located off-campus or refer the student to a counselor or health care provider who is not affiliated with the University of Mount Union.
May a student sign a Consent or Authorization, permitting appropriate disclosures to be made by Mount Union throughout the academic year?

Yes, provided the disclosures are being made to the same designated entity (or entities) identified in the Consent or Authorization for the same defined purpose(s) and subject to the student's right to revoke the Consent or Authorization in writing at any time.
Is it necessary for the Student Health Center, Human Performance and Sports Business Department, Student Counseling Services, or Office of Alcohol, Drug and Wellness Education to give students a Notice of Privacy Practices?

No, because the Student Health Center, Human Performance and Sports Business Department, Student Counseling Services and Office of Alcohol, Drug and Wellness Education are not Covered Entities under HIPAA. Mount Union, however, is providing students and parents with a written explanation of what rules apply to privacy and confidentiality in this Q&A and in the accompanying Notice to Students and Parents.
May the Student Health Center, Human Performance and Sports Business Department, Student Counseling Services, or Office of Alcohol, Drug and Wellness Education disclose student health information to parents?

Yes. Under FERPA, disclosures may be made by a student's written Consent or, in some cases, disclosures may be made where there exists a legal obligation to report certain information to parents.
Is an Authorization required for a student's name to be included on a sick list for professors?

No, provided the only information included is the student's name and date seen at the Student Health Center. If information about the student's medical condition and treatment is included, then a Consent must first be signed.
May the Student Health Center, Student Counseling Services or Office of Alcohol, Drug and Wellness Education disclose student health information to law enforcement officials?

Yes, as permitted by FERPA, for limited purposes of protecting the health and safety of the student, other students and the college community, and in connection with certain crimes, such as crimes of violence and sexual offenses.
May the Student Health Center, Student Counseling Services or Office of Alcohol, Drug and Wellness Education disclose student health information in an emergency or crisis situation?

Yes, disclosure is permitted if the information is necessary to protect the health and safety of the student, other students or other members of the college community. Disclosure of a student's health information under these circumstances is limited to the appropriate parties who have a legitimate interest in the behavior of the student, the health and safety of other students and/or the college community.
May the Student Health Center, Student Counseling Services or Office of Alcohol, Drug and Wellness Education disclose student health information to the Dean of Students?

Yes. A student's health information may be disclosed to the Dean of Students in the event of an emergency or as dictated by the Student Handbook and the Student Code of Conduct, to ensure that the appropriate response and follow-up measures are taken to protect the health and safety of the student, other students and members of the college community. Please refer to the Student Handbook and the Student Code of Conduct for additional information.