Home
Health Privacy

Health Privacy

The privacy of health data is governed by two related laws, one known as HIPAA, the Health Insurance Portability and Accountability Act, and the other known as FERPA, the Federal Educational Rights and Privacy Act.

Health records are strictly protected in the IU privacy program.

Sharing personal health information with IU

There are several situations in which you may share personal health information with IU. Here are some examples:

Student records: This includes immunization history. It also includes two-way communications between you and IU, such as COVID-19 test results, your interactions with the related IU Health app, and messages we send via text and email informing you of safety protocols.
Clinical services: IU manages specialized clinics such as dental, ophthalmology, and optometry, as well as providing general care at campus locations in Bloomington and Indianapolis. These services are available to students, employees, and the general public.
Medical Research: Health data may be shared for research purposes, including recruitment and participation in clinical trials.

How IU informs you of your privacy-related rights

There are several ways in which IU will inform you of your privacy-related rights.

If you are a student: you will receive an annual email known as the FERPA Privacy Notice. It will address such topics as who, and under what circumstances, other individuals (parents, employers, government agencies) are permitted to see your records, including health data. IU's FERPA site will help you learn more.
For direct patient services: you will be given a HIPAA Privacy Notice at the time you receive such care. Examples can be found on IU's Compliance site, along with related background on the IU HIPAA program.
In the research context: IU has special policies to protect the privacy of human research participants. For more information, see the IU Human Research Protection Program Policy on Use of Protected Health Information (PHI) in Research.

The purpose of a Privacy Notice, under both FERPA and HIPAA, is to put you in control of your personal health records and give you contact information in the event you have any concerns.

We encourage you to explore the links above and share any thoughts with us on this important subject.