Skip to main content

Privacy and Confidentiality of Medical Information

The SSU Student Health Center (SHC) is committed to maintaining patient privacy and confidentiality.  We do not release medical information without the documented authorization of the patient unless required to do so by law, subpoena, court order, public health and safety requirements or as indicated below.  Access to patient medical information by SHC staff is on a minimum necessary basis and is limited to those who need to have this information in order to effectively participate in the provision of the patient’s SHC medical care.  Similarly, the SHC may share such information with a collaborating non-SHC healthcare related entity (or receive information from it) in accordance with its involvement in the patient’s medical care (e.g. consulting specialist, hospital, patient’s off-campus medical provider, medical software company, after-hours nurse advice line provider, regulatory or oversight entity).  When SSU NCAA athletes have been referred to us by SSU team physicians or athletic trainers, we may share limited illness and injury information with them that is directly related to medical fitness for athletic participation. Release of medical information beyond this requires the patient’s authorization. In rare circumstances and only as allowed by law, the SHC may share medical information without patient authorization or may attempt to contact the patient through e-mail, if the treating clinician determines that not doing so could present a danger to the health or safety of the patient or others.

  • We may leave appointment reminders and similar medically necessary messages (but not sensitive medical information) on a patient’s voice mail or by cell phone text message, using the number the patient has provided to SSU, unless the patient specifically requests that we not do so.
  • We may mail individual medical information or notification to a patient in a sealed envelope to the address they have provided to the SHC or SSU.
  • We do not share information with a patient’s friends, partners, or family members or with university faculty, staff or administrators unless the patient has formally authorized us to do so.
  • The SHC doesn’t bill personal health insurance, so information isn’t released by us for this purpose.  Information related to worker’s compensation is released to the extent required by state law. 

The patient’s informed consent to release medical information is legally limited to circumstances that are in process or have already taken place, because a consent given in advance of circumstances that have not yet happened does not meet the requirements of informed consent. A patient may terminate consent to release medical information at any time - in writing.  It’s not possible for this to apply to records that have already been released as authorized. 

The SHC carefully safeguards private medical information, functioning under the Family Educational Rights and Privacy Act (FERPA) and California Medical Privacy law rather than HIPAA (as the SHC doesn’t engage in HIPAA covered transactions). The SHC also chooses to follow many HIPAA privacy and security processes. Under FERPA Student Health Center records are managed as medical treatment records (rather than educational records) in accordance with the stringent medical privacy laws of California.  Under FERPA, medical records that a student authorizes to be released to campus entities outside the SHC are no longer under our authority and become the responsibility of the recipient.  As a result, they are protected only as educational but not as medical treatment records. Confidentiality protections under FERPA, though stringent, could then allow further access to campus entities that are not a student’s medical or mental health providers.