POLICY LETTER: May 8, 2013 to Charlcie Flinn

www.ed.gov 400 MARYLAND AVE., SW, WASHINGTON, DC 20202 The Department of Education’s mission is to promote student achievement and preparation for global competit iveness by fostering educational excellence and ensuring equal access. U NITED STATES D EPARTMENT OF EDUCATION O FFICE OF SPECIAL EDUCATION A ND REHABILITATIVE SERVICES May 8, 2013 Charlcie Flinn ECI Program Director North Texas Rehabi litation Center 1005 Midwestern Parkway Wichita Falls, Texas 76302 Dear Ms. Flinn: This is in response to your electronic mail (email) correspondence to the U.S. Department of Education’s (Department) Information Resource Center dated December 6, 2012, in which you seek clarification regarding the applicability of the Family Educational Rights and Privacy Act (FERPA) and its regulations and the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule as those legal authorities relate to t he early intervention records of a toddler who received early intervention services under Part C of the Individuals with Disabilities Education Act (IDEA Part C) through your agency. Your inquiry was forwarded to the Department’s Office of Special Educati on Programs (OSEP), the office responsible for implementing IDEA Part C, for response because the inquiry is best answered in the context of IDEA Part C. From your email, I understand that your agency, the North Texas Rehabilitation Center, is an early intervention service (EIS) provider under IDEA Part C and that it received a request from TRICARE (a potential funding source for IDEA Part C services) for the early intervention records of an infant or toddler who had previously received early interventio n services under IDEA Part C from your agency. You stated that your agency did not provide TRICARE with the requested early intervention records because it did not have authorization, i.e., parental consent, in accordance with IDEA Part C and FERPA, to pr ovide the early intervention records to TRICARE. Finally, you stated that TRICARE cited to the HIPAA Privacy Rule as authority for your agency to be able to send the requested early intervention records without parental consent. While the Department does not administer HIPAA, your inquiry directly relates to the definition under IDEA Part C of “early intervention records” of infants and toddlers, and how that term is interpreted with respect to FERPA regulations and the HIPAA Privacy Rule. The term “earl y intervention records” was added to the September 28, 2011 final IDEA Part C regulations in 34 CFR §303.403(b) and is the same operationally as the term “education records” for purposes of the applicable confidentiality provisions in the FERPA regulations in 34 CFR Part 99. The more specific provisions in the IDEA Part C regulations in 34 CFR §§303.401 through 303.417 govern the confidentiality rights of infants and toddlers with disabilities and their parents under IDEA Part C and incorporate provisions in the FERPA regulations in 34 CFR Part 99 that refer to “education records.” As noted in the IDEA Part C regulations in 34 CFR §303.414(b)(1)(ii), “education records” under the FERPA regulations in 34 CFR §99.31 means “early intervention records” as defi ned in the IDEA Part C regulations in 34 CFR §303.403(b). With regard to your question about the HIPAA implications, the HIPAA Privacy Rule in 45 CFR §160.103 exempts from the definition of “Protected Health Information” (PHI), those “educati on records” that are covered by FERPA. The December 7, 2012 letter by the Family Policy Compliance Office (FPCO) which administers FERPA, noted that “early intervention records” under Part C of the IDEA are equivalent to or the same as “education records” under FERPA for purposes of the PHI exemption under Page 2 – Ms. Charlcie Flinn the HIPAA Privacy Rule. Thus, if IDEA Part C records are covered under the IDEA Part C confidentiality provisions in 34 CFR §§303.401 through 303.417 (which are consistent with, and incorporate specific protections under FERPA), those records are exempt as PHI under the HIPAA Privacy Rule. The IDEA Part C confidentiality provisions, in 34 CFR §303.414(b), state that a lead agency or other participating agency may not, “… disclose personally identifiable information, as defined in [34 CFR] §303.29, to any party except participating agencies (including the lead agency and EIS providers) that are part of the State’s Part C system without parental consent unless authorized to do so under …[specific exception s].” The definition of “participating agency” in 34 CFR §303.403(c) includes “any individual, agency, entity, or institution that collects, maintains, or uses personally identifiable information to implement the requirements in part C of the Act and the r egulations in this part with respect to a particular child. … [and] includes the lead agency and EIS providers….” This definition excludes “public agencies … that act solely as funding sources for [IDEA] Part C services” which would include TRICARE. Ther efore, unless the disclosure is otherwise authorized under 34 CFR §303.414(b), your agency, as an EIS provider and a participating agency under IDEA Part C, may only disclose personally identifiable information from an early intervention record to a fundin g source such as TRICARE after first obtaining parental consent as required under 34 CFR §303.414(a). Based on section 607(e) of the IDEA, we are informing you that our response is provided as informal guidance and is not legally binding, but represents an interpretation by the U.S. Department of Education of the IDEA in the context of the specific facts presented. If you have any further questions, please do not hesitate to contact Frank Miller, of my staff, at 202 -245 - 7065 or by email at Frank.E.Mille r@ed.gov Sincerely, Melody Musgrove, Ed.D Director Office of Special Education Programs cc: Part C Coordinator Dale King, Director, FPCO