Understanding whether education level falls under protected health information (PHI) helps organizations navigate HIPAA compliance and education privacy laws. This article explains how PHI is defined, how education data fits (or doesn’t fit) within that definition, and what this means for health care providers, covered entities, and educational institutions in the United States. It also clarifies the interaction between HIPAA and FERPA when education records touch health information.
What Counts As Protected Health Information Under HIPAA
Under the Health Insurance Portability and Accountability Act (HIPAA), protected health information (PHI) is individually identifiable health information held by covered entities or business associates. PHI includes any information related to a person’s past, present, or future physical or mental health condition, the provision of health care, or the payment for health care, that can identify the individual. Identifiers such as name, address, date of birth, SSN, and many other data points combined with health information create PHI.
PHI is regulated by the HIPAA Privacy Rule, which restricts how PHI can be used and disclosed. The key concept is that PHI connects health information with an identifiable person. If health data is de-identified, it is no longer PHI and falls outside HIPAA restrictions.
Where Education Level Fits in Privacy Law
Education level, by itself, is generally not PHI. A person’s highest degree, grades, or educational attainment does not inherently reveal health information. HIPAA’s PHI definition focuses on health-related data and identifiers tied to health care or health status.
However, education data can become PHI if it is directly linked to health information in a way that identifies the individual. For example, if a health condition is documented in a medical record and the record also includes the person’s education level, education data can become part of PHI because it is embedded in health information that identifies the individual.
In practice, this boundary matters most in healthcare settings that discuss a patient’s health in the context of their demographics or education. For instance, a clinician noting that a patient with a particular health condition has a specific education level does not automatically turn the education level into PHI, unless that education detail is inseparable from health information and used to identify the patient’s health data.
FERPA vs. HIPAA: Who Protects Education Records?
Education records are primarily protected by the Family Educational Rights and Privacy Act (FERPA), not HIPAA. FERPA applies to educational agencies and institutions that receive federal funds, safeguarding students’ education records from unauthorized disclosure. Education records under FERPA include general academic information, attendance, disciplinary records, and other information maintained by the school.
When health information is created or maintained within an educational context, the status of privacy depends on who holds the data. If a school provides health services or maintains medical records, those records may be subject to HIPAA if the school is a covered entity or a business associate under HIPAA. In many cases, schools act under FERPA for education records, while health clinics on campus or school-sponsored health services may be subject to HIPAA for health information.
Practical Implications for Organizations
- Healthcare providers and covered entities: Treat health information as PHI when it is identifiable, and avoid disclosing education level unless it is necessary and permitted by HIPAA. If health records include education data, ensure the education data is safeguarded as part of PHI.
- Educational institutions: Manage education records under FERPA. Be cautious when health information is involved. If a health record is created by a school health clinic and qualifies as PHI, HIPAA obligations may apply to that portion of the data.
- Business associates: If a business associate processes PHI that includes education data linked to health information, ensure agreements include appropriate safeguards and disclosures under HIPAA.
- Data handling: Use minimum necessary standards for PHI; restrict access to health information and any education data tied to health information to only those who need it for treatment, payment, or operations.
Scenarios Illustrating the Boundary
Scenario A: A patient’s medical record includes the patient’s highest education level. If the education level is merely demographic data and not tied to health information, it remains PHI because it accompanies health information in a medical record. Scenario B: A hospital releases a de-identified health dataset that includes education level as a separate variable. If the data set is properly de-identified to meet HIPAA standards, it is no longer PHI. Scenario C: A school health clinic documents a student’s immunization status and notes that the student has a college degree. The health information is PHI, and the education data is part of that PHI only insofar as it is linked with health data, which could require HIPAA safeguards depending on the entity’s status.
How Entities Determine Responsibility
Determining whether education data falls under HIPAA hinges on the entity’s status and the data’s context. If a covered entity (such as a clinician, hospital, or health plan) maintains health information that includes education data, that data can be PHI. If a school is not a HIPAA-covered entity for health records, education data remains under FERPA. When a school operates a campus health clinic that handles PHI, HIPAA obligations apply to those health records.
Best Practices for Compliance and Privacy
- Map data flows: Identify where health information is stored and whether education data is linked to health data in those records.
- Apply least-privilege access: Limit who can view PHI, including health data that intersects with education information.
- Use de-identification when sharing data: Remove or obfuscate education level or health identifiers when releasing datasets that do not need to reveal identifiable information.
- Clarify policy boundaries: Have clear policies distinguishing FERPA protections for education records from HIPAA protections for PHI, especially for school clinics.
- Training and awareness: Educate staff about when education data becomes PHI and the applicable regulations.
Key Takeaways
Education level alone is generally not PHI under HIPAA. PHI focuses on health information linked to an identifiable person. Education data becomes PHI only when it is part of, or inseparable from, health information in a way that identifies an individual. FERPA governs education records in most school contexts, while HIPAA governs PHI handled by covered entities and business associates. In mixed contexts, organizations should carefully assess the data’s role, status, and the applicable privacy rule to determine the correct protections and disclosures.