New York Privacy Laws for University Health Services: A Complete Guide to HIPAA, FERPA, and NYS Rules

FERPA Overview and Protections

As you navigate student care, the Family Educational Rights and Privacy Act (FERPA) is your starting point. FERPA protects student education records, which include any records directly related to a student and maintained by the institution or its agents. In university health services, this often covers billing, immunization documentation shared with the registrar, disability accommodation files, and communications that become part of the student’s academic record.

FERPA also recognizes “treatment records.” These are records made or maintained by a physician, nurse, counselor, or other recognized professional, used only for treatment, and not disclosed beyond treatment providers. Treatment records are not “student education records” unless they are shared for non-treatment purposes, in which case they become education records and the broader FERPA rules apply.

Core FERPA rights and duties

• Student right to inspect and review education records within a reasonable time.
• Right to request amendment of inaccurate or misleading information.
• Written consent required for disclosure, subject to specific exceptions.
• Ability to opt out of directory information disclosures.
• Access by school officials only when they have a legitimate educational interest as defined by institutional policy.

FERPA Exceptions for Disclosure

FERPA’s default rule is consent before disclosure. However, limited exceptions permit sharing without consent when specific conditions are met. You should apply these narrowly, document the rationale, and disclose only what is necessary to achieve the permitted purpose.

Common no-consent disclosures under FERPA

• School officials with a legitimate educational interest, including contractors performing institutional services under direct control.
• Health and safety emergency disclosures to appropriate parties when needed to protect the student or others.
• Parents of IRS-dependent students, consistent with institutional verification practices.
• Another school where the student seeks or intends to enroll or is already enrolled.
• Judicial orders or subpoenas, after reasonable efforts to notify the student unless prohibited.
• Certain disciplinary outcomes for crimes of violence or non-forcible sex offenses, as permitted by FERPA.
• Directory information and the Solomon Amendment, which requires release of specific “student recruiting information” to military recruiters, subject to directory opt-out rules.
• Disclosures required by law, including child abuse reporting and specified public health notifications to government authorities.

When using an exception, record the basis for disclosure, the parties receiving the information, and the date. Limit internal redisclosure and remind recipients of confidentiality where appropriate.

Health Records and FERPA Coverage

Determining whether a health record is an education record or a treatment record drives which rules apply. Documents in the registrar, dean’s office, athletics department, or disability services that relate to a student’s health are typically student education records. Counseling or clinic notes maintained solely for treatment and shared only among treating providers are treatment records.

Treatment records versus education records

• Treatment records: created by licensed professionals, used only for treatment, not accessible as education records; they may be reviewed by a physician or appropriate professional chosen by the student.
• Education records: include health information once used beyond treatment (for conduct, academic accommodation, or administrative purposes). Students have direct inspection rights, and broader FERPA rules govern disclosure.

Maintain separate systems or clear tagging so treatment records are not inadvertently placed into the education record. If cross-team coordination is necessary, seek consent or confirm a qualifying FERPA exception before sharing.

HIPAA Basics and Applicability

The Health Insurance Portability and Accountability Act (HIPAA) protects individually identifiable health information held by a HIPAA-covered entity. A covered entity includes a health care provider that transmits standard electronic transactions, health plans, and health care clearinghouses. Business associates handle protected health information (PHI) on behalf of covered entities under contractual safeguards.

Most student medical and counseling records maintained by a university clinic are excluded from HIPAA because FERPA applies. However, HIPAA can apply on campus when services fall outside FERPA’s scope or when the university organizes itself to bring specific components under HIPAA.

When HIPAA applies on campus

• University hospitals or health systems that provide care to the general public and bill electronically.
• Hybrid entities, where the university designates a HIPAA-covered health care component separated from non-covered functions.
• Clinics serving non-students (e.g., dependents, visitors), when those records are not student education or treatment records under FERPA.
• Third-party vendors or independent practices operating on campus as separate HIPAA-covered entities.

When HIPAA applies, PHI is governed by the Privacy, Security, and Breach Notification Rules. When FERPA applies, those records are excluded from HIPAA’s definition of PHI, and FERPA controls disclosure and access.

HIPAA Compliance in University Health Services

If your clinic is a HIPAA-covered entity, you must implement privacy notices, safeguards, patient access processes, and incident response protocols. You also need to track disclosures, manage authorizations, and apply the minimum necessary standard for routine uses and disclosures.

Core requirements to operationalize

• Issue a clear Notice of Privacy Practices and honor timely right-of-access requests and amendments.
• Implement administrative, physical, and technical safeguards, including risk analysis, encryption, and access controls.
• Execute Business Associate Agreements with vendors handling PHI (telehealth, EHR, secure messaging, billing).
• Apply the minimum necessary standard for workforce access and routine disclosures.
• Maintain a breach response plan with investigation, mitigation, individual notification, and reporting as required.

Coordinating HIPAA and FERPA on campus

• Segregate HIPAA and FERPA systems or data sets; avoid co-mingling PHI with student education records.
• Use precise workflows for releases to parents, coaches, or deans; require student authorization unless a clear exception applies.
• Document health and safety emergency decisions and limit disclosures to parties who can reduce the risk.
• Address substance use, mental health, and sensitive services with heightened controls and clear need-to-know criteria.

New York State Privacy Law Preemptions

HIPAA sets a federal privacy “floor.” Under state law preemption principles, more protective New York rules supersede HIPAA where they provide greater privacy for individuals. Where New York law mandates reporting or permits disclosures for public health, those rules operate alongside FERPA and HIPAA.

Areas commonly more protective in New York

• HIV-related information and sexually transmitted infection services, which often require specific written consent and limited redisclosure.
• Mental health and counseling records, including heightened confidentiality for psychotherapy notes and sensitive communications.
• Genetic testing information, which typically demands explicit consent and narrow downstream use.
• Minors’ rights to consent to certain services (e.g., sexual and reproductive health, some mental health and substance use services), with corresponding limits on parental access absent the minor’s consent or a legal exception.
• Communicable disease control and immunization reporting obligations to the New York State Department of Health, with privacy safeguards built into reporting workflows.

Practical effect of preemption

• When New York law is stricter than HIPAA, follow the state rule—even if HIPAA would allow broader disclosure.
• Document the specific state requirement or heightened standard you relied on and the minimal data disclosed.
• Align policies with New York State Department of Health guidance if your clinic is licensed or otherwise subject to state oversight.

Practical Guidance for University Health Privacy

Turning rules into reliable practice requires deliberate design. Use the steps below to build a privacy program that works in real campus settings and supports timely student care.

Action steps you can implement now

• Map your records: separate treatment records from student education records; label and store them in systems built for their use and access patterns.
• Decide your entity status: document whether your clinic is FERPA-only, HIPAA-covered, or part of a hybrid entity; publish clear notices to students.
• Tighten access controls: grant staff access based on legitimate educational interest or role-based clinical need; audit regularly.
• Standardize consent: use plain-language authorization forms; build quick paths for routine releases to parents or athletic staff only with student consent.
• Prepare for emergencies: create a health and safety emergency playbook with decision criteria, approved recipients, and post-event review.
• Manage third parties: for vendors, use Business Associate Agreements or FERPA “school official” contracts with direct control and data return/destruction terms.
• Train and test: run scenario-based training for front desk, clinicians, coaches, and deans; test identity verification and subpoena response.
• Protect sensitive services: add extra steps for mental health, sexual health, and substance use encounters; disclose narrowly and only when necessary under law.
• Coordinate with public health: establish secure channels to the New York State Department of Health for required reporting while minimizing shared identifiers.

Conclusion

In New York, university health privacy sits at the intersection of FERPA, HIPAA, and robust state rules. By classifying records correctly, applying exceptions carefully, honoring state law preemption, and operationalizing safeguards, you can protect students’ trust while enabling effective, lawful care.

FAQs

What privacy laws protect student health records at New York universities?

Most student health and counseling records held by a university are protected by FERPA as either student education records or treatment records. HIPAA applies to HIPAA-covered entity components (such as a university hospital or designated clinic), and New York laws provide additional protections and reporting rules, including those administered by the New York State Department of Health.

How does FERPA differ from HIPAA for university health services?

FERPA governs student education records and treatment records maintained by the institution, focusing on access, consent, and limited no-consent disclosures. HIPAA governs PHI held by a HIPAA-covered entity and emphasizes privacy, security, and breach notification. If FERPA applies to a record, HIPAA generally does not apply to that same record.

When can university health records be disclosed without student consent?

FERPA allows limited no-consent disclosures, including to school officials with a legitimate educational interest, during a health and safety emergency, to parents of IRS-dependent students, to another school, under a subpoena with notice, and for certain disciplinary outcomes. Directory information and the Solomon Amendment also permit specified disclosures, subject to opt-out rules.

Does HIPAA apply to all university health clinics in New York?

No. HIPAA applies when the clinic is a HIPAA-covered entity (for example, it bills electronically as a health care provider or is part of a university hospital) or operates as a designated HIPAA component in a hybrid entity. Otherwise, student records maintained by the university are typically governed by FERPA rather than HIPAA.

How do New York State laws affect HIPAA compliance in university settings?

Under state law preemption principles, New York’s more protective privacy rules override HIPAA where they offer stronger safeguards, especially for sensitive services. New York also imposes specific reporting and operational requirements through the New York State Department of Health. Your policies should follow the stricter standard and document the legal basis for each disclosure.