Comment by 35fbe7d3d5b9
4 years ago
> whether or not they had a nut allergy (protected by HIPAA)
Personal pet peeve:
Your high school is not a covered entity and is not acting as a business associate of a covered entity. HIPAA does not apply. They are free to keep a plaintext file with your name, nut allergies, COVID vaccination status, and anything else they want to put in there - without HIPAA entering into the discussion.
FERPA could apply, but I don't know much about that.
Nut allergy info that was collected by the school (teacher, admin, nurse, whoever) is part of the student records and would be protected information under FERPA.