Can a Tennessee school, college, or university share campus criminal incident reports with police, and can law enforcement and juvenile courts swap information about minor children?

Plain-English summary

A Memphis-area district attorney asked the Tennessee AG three related questions about how privacy laws affect law enforcement's ability to get information from schools and juvenile courts.

FERPA (the federal student-records statute): Doesn't block schools from sharing campus criminal incident reports with police. FERPA defines "education records" to exclude records created by a school's law enforcement unit for law enforcement purposes (20 U.S.C. § 1232g(a)(4)(B)). Even when records would otherwise be protected, the Sixth Circuit (United States v. Miami University) recognized that law enforcement records sit outside FERPA's scope.

HIPAA (the federal health-information statute): Generally restricts disclosure of identifiable health information by "covered entities," but contains several explicit exceptions for law enforcement. Schools that operate a separate health-care function may be HIPAA-covered, but even then 45 C.F.R. § 164.512(e) and (f) allow disclosures pursuant to court orders or subpoenas, for identifying suspects, fugitives, or missing persons, and for evidence of crimes occurring on the covered entity's premises.

Sharing juvenile information between courts and police: Yes. Tenn. Code Ann. § 37-1-153 keeps juvenile court files confidential but allows inspection with permission of the court by anyone with a legitimate interest. Tenn. Code Ann. § 37-1-154 keeps law enforcement juvenile records confidential but allows inspection by juvenile courts and by law enforcement officers of other jurisdictions when necessary for their official duties.

Currency note

This opinion was issued in 2010. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Why doesn't FERPA stop schools from sharing campus crime reports?
A: FERPA's "education records" definition explicitly excludes records that a school's "law enforcement unit" created for law enforcement purposes (20 U.S.C. § 1232g(a)(4)(B)(ii)). Campus police reports created for law enforcement are categorically outside FERPA's protection.

Q: What if a campus has no separate "law enforcement unit"?
A: The exclusion is for records created by a unit designated as law enforcement for law enforcement purposes. A school without such a unit might handle disciplinary records as part of "education records" subject to FERPA. The AG's analysis (and the cases it cites, like Miami University) focus on the law-enforcement-unit exclusion.

Q: Is FERPA enforced through individual lawsuits?
A: No. Gonzaga University v. Doe, 536 U.S. 273 (2002), held that FERPA does not create individually enforceable rights. The only enforcement is the Department of Education's authority to withhold federal funds from non-compliant schools.

Q: Are all schools "covered entities" under HIPAA?
A: Not automatically. A school is a HIPAA-covered entity only if it provides health care services and transmits health information electronically in covered transactions, and only if the health-care function is identified as separate from the school's other operations (United States v. Mathis, M.D. Tenn. 2005). For most schools, this means the medical clinic might be HIPAA-covered while the rest of the institution is not.

Q: When can a HIPAA-covered school share health information with police?
A: Several scenarios under 45 C.F.R. § 164.512(f): in response to a court order or qualifying subpoena (subsection (e)); when needed to identify or locate a suspect, fugitive, material witness, or missing person (subsection (f)(2), but never DNA); when the covered entity has a good-faith belief the information is evidence of a crime that occurred on the entity's premises (subsection (f)(5)).

Q: How much process do police need to look at a juvenile court file?
A: Per Tenn. Code Ann. § 37-1-153(a)(5), they need permission of the juvenile court. The court evaluates whether the requestor has a "legitimate interest" in the proceeding or work of the court. Routine law enforcement need to discharge official duties qualifies.

Q: What about juvenile law enforcement records (held by police, not the court)?
A: Tenn. Code Ann. § 37-1-154(a) keeps these confidential too, but allows inspection by the juvenile court itself and by law enforcement officers of other jurisdictions "when necessary for the discharge of their official duties." So inter-agency law enforcement sharing is built into the statute.

Q: Does Schneider v. City of Jackson change this?
A: Not for these particular questions. Schneider establishes the general Tennessee presumption that government records are open to the public unless a statute makes them confidential. The juvenile-records statutes are exactly that kind of confidentiality exception, but they also build in their own access exceptions for law enforcement and courts.

Background and statutory framework

The opinion sits at the intersection of three different privacy regimes:

• FERPA (federal): protects "education records" but expressly carves out records made by school law enforcement units for law enforcement purposes. Gonzaga held FERPA creates no private right of action.
• HIPAA (federal): governs covered entities (health plans, clearinghouses, certain providers). Limited application to schools; even when applied, has multiple law-enforcement exceptions.
• Tennessee juvenile-records statutes (state): § 37-1-153 (juvenile court files) and § 37-1-154 (juvenile law enforcement files) both default to confidentiality but allow inter-agency sharing for legitimate law enforcement purposes.

The AG's analysis is conservative on each point, refusing to claim the privacy laws absolutely permit any disclosure but tracking the explicit statutory and regulatory exceptions that allow disclosure in the typical scenarios a campus prosecutor will face.

Citations and references

Federal statutes and regulations:

• 20 U.S.C. § 1232g (FERPA)
• 42 U.S.C. § 1983
• 45 C.F.R. § 160.103 (HIPAA covered entity definition)
• 45 C.F.R. § 164.502(a) (HIPAA privacy rule)
• 45 C.F.R. § 164.512(e), (f) (HIPAA law enforcement disclosures)

Tennessee statutes:

• Tenn. Code Ann. § 37-1-134 (transfer for criminal prosecution)
• Tenn. Code Ann. § 37-1-153 (confidentiality of juvenile court files)
• Tenn. Code Ann. § 37-1-154 (confidentiality of juvenile law enforcement records)

Cases:

• Gonzaga University v. Doe, 536 U.S. 273 (2002) (no FERPA private right of action)
• United States v. Miami University, 294 F.3d 797 (6th Cir. 2002) (FERPA does not protect law enforcement records)
• Bauer v. Kincaid, 759 F. Supp. 575 (W.D. Mo. 1991)
• Smith v. Duquesne Univ., 612 F. Supp. 72 (W.D. Pa. 1985)
• Young v. City of Omaha, 2009 WL 4726949 (D. Neb.) (FERPA does not bar law enforcement from getting student records)
• United States v. Mathis, 377 F. Supp. 2d 640 (M.D. Tenn. 2005) (HIPAA covered-entity analysis for schools)
• Schneider v. City of Jackson, 226 S.W.3d 332 (Tenn. 2007) (presumption of openness for government records)

Source

• Landing page: https://www.tn.gov/attorneygeneral/opinions.html
• Original PDF: https://www.tn.gov/content/dam/tn/attorneygeneral/documents/ops/2010/op10-070.pdf

Original opinion text

May 21, 2010
Opinion No. 10-70

Law Enforcement Access to Information

QUESTIONS

1. Is a city/county school, university or college prohibited by the Family Educational Rights and Privacy Act (FERPA) from sharing criminal incident report data with law enforcement?

2. Is a city/county school, university or college prohibited by the Health Insurance Portability and Accountability Act (HIPAA) from sharing criminal incident report data with law enforcement?

3. May information regarding minor children be shared between law enforcement officers and juvenile courts?

OPINIONS

1. No, a city/county school, university or college would not be prohibited by FERPA from sharing criminal incident report data with law enforcement.

2. No, under most circumstances, a city/county school, university or college would not be prohibited by HIPAA from sharing criminal incident report data with law enforcement.

3. Yes, law enforcement officers and juvenile courts may share information regarding minor children when necessary for the discharge of their official duties.

ANALYSIS

1. The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, was enacted by Congress to protect the privacy rights of students and their parents with regard to education records. FERPA conditions federal funding to educational institutions on the requirement that such institutions not have a "policy or practice of permitting the release of education records (or personally identifiable information contained therein . . . .) of students without the written consent of [the students or] their parents[.]" 20 U.S.C. § 1232g(b)(1). The Supreme Court has recognized that FERPA does not create an individual enforceable right under 42 U.S.C. § 1983. Gonzaga University v. Doe, 536 U.S. 273, 289 (2002). Rather, FERPA's sole enforcement mechanism is the Department of Education's power to withhold federal funds from educational institutions that disclose education records to unauthorized third parties. 536 U.S. at 279.

FERPA defines "education records" as records, files, documents, and other materials which—

(i) contain information directly related to a student; and
(ii) are maintained by an educational agency or institution or by a person acting for such agency or institution.

20 U.S.C. § 1232g(a)(4)(A).

The term "education records" does not include—

(ii) records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement;

20 U.S.C. § 1232g(a)(4)(B).

FERPA was intended to deter schools from indiscriminately releasing student educational records. Bauer v. Kincaid, 759 F. Supp. 575, 590-91 (W.D. Mo. 1991); Smith v. Duquesne Univ., 612 F. Supp. 72, 80 (W.D. Pa. 1985). While the Sixth Circuit Court of Appeals has held that student disciplinary records are protected by FERPA, the court has recognized that FERPA does not protect law enforcement records or place restriction on their disclosure. United States v. Miami University, 294 F.3d 797, 814 (6th Cir. 2002). The Sixth Circuit Court of Appeals has not specifically addressed the issue of whether law enforcement officers may obtain criminal incident report data from an educational institution. One district court, however, recently addressed this issue. Young v. City of Omaha, 2009 WL 4726949 (D. Neb.). In Young, the court found that FERPA's text does not prohibit law enforcement officers from obtaining a student's education records from an educational institution. Id. at *8. Accordingly, it is our opinion that a city/county school, university or college would not be prohibited by FERPA from sharing criminal incident report data with law enforcement.

2. As a general rule, HIPAA prohibits the use or disclosure of individually identifiable health information by a covered entity. 45 C.F.R. § 164.502(a). A "covered entity" is defined to include: (1) a health plan; (2) a health care clearinghouse; and (3) a health care provider who transmits health information in electronic form in connection with a transaction covered by HIPAA. 45 C.F.R. § 160.103. Whether a particular city/county school, university or college is a "covered entity" subject to HIPAA will depend on whether the school is providing health care services and whether the school has identified the provision of health services as separate from its other functions. See United States v. Mathis, 377 F. Supp. 2d 640, 645 (M.D. Tenn. 2005).

HIPAA's prohibition against disclosure of individually identifiable health information is subject to several exceptions. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal or in response to a subpoena if certain requirements are met. 45 C.F.R. § 164.512(e). A covered entity is also authorized to disclose protected health information for a law enforcement purpose to a law enforcement official if certain conditions are met. 45 C.F.R. § 164.512(f). For example, law enforcement may receive individually identifiable health information, except DNA, if needed for the purpose of identifying or locating a suspect, fugitive, material witness or missing person. 45 C.F.R. § 164.512(f)(2). Law enforcement may also receive protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity. 45 C.F.R. § 164.512(f)(5). Therefore, a city/county school, university or college is not necessarily prohibited by HIPAA from sharing criminal incident report data with law enforcement.

3. As a general rule, there is a presumption that all governmental records are open to the public unless a specific statutory exception to disclosure exists. Schneider v. City of Jackson, 226 S.W.3d 332, 343 (Tenn. 2007). There are two relevant statutes establishing the confidentiality of records involving juveniles and prohibiting the release of such records to the public. It is our opinion, however, that these statutes contain exceptions allowing law enforcement officers and juvenile courts to share otherwise confidential information when necessary for the discharge of their official duties.

First, Tenn. Code Ann. § 37-1-153 provides for the confidentiality of all files and records of the juvenile court except under specific circumstances. Under the provisions of Tenn. Code Ann. § 37-1-153(a)(5), the records and files of juvenile courts are open to inspection, with permission of the court, to any person or agency having a legitimate interest in the proceeding or in the work of the court. Thus, if law enforcement officers should need information contained in juvenile court records for the discharge of their official duties, the files and records may be open for inspection with permission of the court.

Second, Tenn. Code Ann. § 37-1-154 provides for the confidentiality of law enforcement records and files involving juveniles. As provided in Tenn. Code Ann. § 37-1-154(a), there are exceptions to allow inspection of law enforcement records and files regarding juveniles. Specifically, this statute provides:

Unless a charge of delinquency is transferred for criminal prosecution under § 37-1-134, the interest of national security requires or the court otherwise orders in the interest of the child, the law enforcement records and files shall not be open to public inspection or their contents disclosed to the public; but inspection of the records and files is permitted by:

(1) A juvenile court having the child before it in any proceeding;

(4) Law enforcement officers of other jurisdictions when necessary for the discharge of their official duties;

Tenn. Code Ann. § 37-1-154(a).

Accordingly, it is the opinion of this Office that confidential information regarding minor children that is contained in the files and records of juvenile courts and law enforcement may be shared between juvenile courts and law enforcement as necessary for the discharge of their official duties.

ROBERT E. COOPER, JR.
Attorney General and Reporter

BARRY TURNER
Deputy Attorney General

DIANNE STAMEY DYCUS
Deputy Attorney General

Requested by:

Honorable William L. Gibbons
District Attorney General
Office of the District Attorney General
201 Poplar Avenue, Third Floor
Memphis, TN 38103-1947