It comes as no surprise that virtually every postsecondary
administrator is familiar with the Family Educational Rights and
Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99). After
all, FERPA, the primary federal law that protects student education
records, applies to any institution, public or private, that
receives funds under any program administered by the U.S.
Department of Education. As such, it covers the vast majority of
postsecondary institutions (because, among other things, they
participate in the federal financial aid programs).
In our experience, administrators are often less familiar with
(and less comfortable with) the HIPAA Privacy Rule (45 CFR Part 160 and
Subparts A and E of Part 164), the set of regulations that were
promulgated pursuant to the Insurance Portability and
Accountability Act of 1996 (42 U.S.C. § 300gg, 29 U.S.C §
1181 et seq., and 42 USC 1320d et seq.). We find that there
frequently is a lack of clarity regarding whether the
