Utah University Student Health Privacy Law Guide: HIPAA, FERPA, and Your Rights

FERPA Overview and Student Rights

As a student at a Utah university, your education records are protected by the Family Educational Rights and Privacy Act (FERPA). FERPA gives you control over who can see information maintained by your institution and under what conditions those records may be shared.

The education records definition under FERPA includes records that are directly related to you and maintained by the university or its agents. Examples include transcripts, advising and conduct files, financial aid records, housing files, and communications kept in a record system. Exclusions can include law enforcement unit records, employee records unrelated to student status, alumni records, and certain treatment records maintained by health professionals solely for treatment.

Your core rights under FERPA are to: (1) inspect and review your education records within a reasonable time (typically within 45 days of request), (2) seek amendment of inaccurate or misleading information, (3) control most disclosures through prior written consent, (4) restrict release of “directory information” by opting out, and (5) file a complaint if you believe your rights were violated. These rights apply regardless of your age once you enroll in higher education.

FERPA exists alongside medical privacy laws. When a record is part of your education record, FERPA governs access and disclosure. When a record is not an education record—such as clinical care provided by a HIPAA-covered health system—HIPAA may apply instead. Understanding which law applies starts with the record’s purpose and who maintains it.

FERPA Disclosure Exceptions

FERPA generally requires your written permission before disclosing non-directory information, but it allows limited disclosures without consent in defined situations. Common exceptions include:

• School officials with a legitimate educational interest who need the information to perform their job duties.
• Directory information (unless you opt out), such as your name, major, and enrollment status, as defined by your university.
• Health or safety emergencies, when disclosure is necessary to protect you or others from an articulable and significant threat.
• Transfer or enrollment at another school where you seek or intend to enroll, or are already enrolled.
• Financial aid purposes, including eligibility, amount, and conditions of aid.
• Compliance with a judicial order or lawfully issued subpoena (usually with reasonable effort to notify you in advance).
• Parents of a tax-dependent student, as defined by the Internal Revenue Code.
• Results of certain disciplinary proceedings to an alleged victim of a crime of violence or nonforcible sex offense, and limited disclosures to parents for alcohol/drug violations by students under 21.

When an exception is used, universities document the basis for disclosure. You can request an accounting of certain disclosures from your record custodian.

Distinction Between HIPAA and FERPA

HIPAA protects protected health information (PHI) held by covered entities like hospitals, clinics, and health plans. FERPA protects education records held by schools. A single record is typically governed by one law or the other, not both.

Key distinctions to know as a student: education records (and most treatment records kept by a university solely for your treatment) are excluded from HIPAA and governed by FERPA. If a student health or counseling record is shared beyond treatment—for example, with deans, coaches, or conduct officers—it generally becomes part of your FERPA education record. By contrast, care you receive from a hospital or health system that bills electronically is normally subject to HIPAA, and those records are PHI.

Practically, this means your rights and processes differ by setting. Under FERPA, you typically use the registrar or records office to access or control disclosures. Under HIPAA, you use the provider’s medical records and privacy offices to access, amend, or authorize release of PHI. Knowing which gate to knock on saves time and protects your privacy.

University of Utah Health Privacy Practices

University of Utah Health operates as a HIPAA-covered health care provider. It issues a Notice of Privacy Practices that explains how it may use and disclose protected health information (PHI) and describes your rights as a patient. When you receive care through this health system, HIPAA—not FERPA—typically governs those medical records.

Common HIPAA uses and disclosures include treatment, payment, and health care operations. Additional permitted disclosures can include public health reporting, health oversight activities, compliance with laws and court orders, law enforcement purposes, research under approved safeguards, organ and tissue donation, workers’ compensation, and to avert a serious threat to health or safety.

Your HIPAA rights with University of Utah Health generally include the right to access and obtain copies of your PHI, request amendments to incorrect or incomplete information, receive an accounting of certain disclosures, request restrictions on certain uses or disclosures, ask for confidential communications, and receive notice of a breach affecting your information.

To exercise these rights, you submit requests to the appropriate University of Utah Health records or privacy contacts. If you also have education records at your university, remember that separate processes apply under FERPA for those records.

Student Health Center Confidentiality Policies

Campus health and counseling services prioritize doctor-patient confidentiality. Records used only for your treatment and maintained by a campus provider are generally FERPA treatment records, not HIPAA PHI. They are stored separately from academic files and are not shared with faculty, advisors, coaches, or parents without your permission, unless a FERPA exception applies (for example, a health or safety emergency).

Sensitive services—such as mental health care, sexual and reproductive health, or substance use treatment—are protected by strict confidentiality rules. Disclosures often require your information disclosure consent, and state law may add extra protections. Ask the clinic how your records are classified and which law applies before you authorize any release.

For minor students, parental access can depend on multiple factors, including dependency status, state law, and the type of service. When in doubt, clarify with the student health center what can be shared and how you can limit access through FERPA and clinic authorization forms.

FERPA Release Consent Procedures

To allow someone else—such as a parent, partner, advisor, or scholarship donor—to access your education records, you complete a FERPA release. A clear, narrow release protects your privacy while meeting your goals. Follow these steps:

• Obtain the university’s FERPA consent form from the registrar or records office. Verify which offices and record types it covers using the education records definition on the form or instructions.
• Specify exactly what to disclose (for example, grades in a given term, financial aid status, billing details) and exclude anything you do not wish to share.
• Name the authorized recipient(s) and provide contact details. Note any legitimate educational interest that justifies access.
• State the purpose of the disclosure and set an expiration date or event (for example, “valid through the end of Spring 2027”).
• Date and sign the form. Be prepared to verify your identity for in-person, mailed, or electronic submissions.
• Keep a copy. You may revoke your consent in writing at any time; revocation stops future disclosures but does not undo releases already made.

If you want a health care provider to share HIPAA PHI (for example, from University of Utah Health) with a third party or your university, you must complete the provider’s HIPAA Authorization form in addition to any FERPA release.

Compliance and Complaint Processes

If you believe your privacy rights were violated, act promptly and document everything. Start locally when possible, then escalate as needed:

• Education records (FERPA): Contact the registrar or privacy officer for your Utah university to request resolution, access logs, or a record correction.
• HIPAA PHI (University of Utah Health): Contact the health system’s patient privacy or medical records office to raise concerns or request an accounting of disclosures.
• FERPA complaint procedures: If unresolved, submit a written, signed complaint to the U.S. Department of Education’s Student Privacy Policy Office. Include facts, dates, the records involved, and how FERPA was allegedly violated. Retain copies of all correspondence.
• HIPAA complaints: You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, regarding PHI handling by a covered entity.
• Non-retaliation: Universities and health providers may not retaliate against you for exercising your privacy rights or filing a good-faith complaint.

In short, use FERPA processes for education records and HIPAA processes for clinical care. Keep requests specific, use written authorizations, and escalate methodically if you need independent review.

FAQs

What records are protected under FERPA at Utah universities?

FERPA protects education records—records directly related to you and maintained by the university or its agents. This includes transcripts, advising and conduct files, financial aid and housing records, and similar files. Exclusions can include law enforcement unit records, certain employment records, alumni records, and treatment records maintained solely for your treatment.

How does HIPAA differ from FERPA in university settings?

HIPAA governs protected health information held by covered health care providers and health plans, while FERPA governs education records held by schools. Student health or counseling records kept only for treatment are generally overseen by FERPA, not HIPAA. Care delivered by a health system like University of Utah Health is typically HIPAA-covered, with different access and authorization processes.

When can student health information be disclosed without consent?

Disclosures without your permission can occur under specific exceptions. Common scenarios include a health or safety emergency, school officials with a legitimate educational interest, transfer to another institution, financial aid purposes, compliance with subpoenas or court orders, limited parental notifications, and certain disciplinary outcomes allowed by FERPA.

How can students file a FERPA violation complaint?

First, seek resolution with your university’s registrar or privacy office. If the issue remains unresolved, submit a written, signed complaint to the U.S. Department of Education’s Student Privacy Policy Office describing the facts, dates, records involved, and how FERPA was violated. Keep copies of all submissions and responses for your records.