If a school BCBA shares notes with a 3rd party health care provider, to which regulation are they subject?

The correct response is that the school BCBA is subject to HIPAA only when sharing notes with a third-party health care provider. This is because HIPAA, the Health Insurance Portability and Accountability Act, regulates the sharing of health information, specifically Protected Health Information (PHI), which is applicable in a healthcare context. When a BCBA shares notes that contain information about an individual’s psychological assessment or treatment with a health care provider, they are dealing with sensitive health data that falls under HIPAA regulations.

FERPA, the Family Educational Rights and Privacy Act, pertains specifically to the privacy of student education records held by educational institutions. While FERPA applies to information related to a student’s educational record, once that information is shared with a third-party health care provider, especially if it contains identifiable health information, HIPAA takes precedence. In such circumstances, the BCBA must adhere to the standards set by HIPAA to protect that information and ensure compliance with health privacy laws. Therefore, the focus here is on the healthcare aspect of the shared information, making HIPAA the governing regulation in this context.