Student self-reported vaccination and medical exemption information is not regulated by the Health Information Portability and Accountability Act (HIPAA). For students, this information is regulated by FERPA. The University of Michigan takes appropriate measures to ensure the security and confidentiality of student records and personal human resources information.