Under certain circumstances, yes. First, is the student truly a University student, or is this something that is required as part of the application process?
If it is done through the University, the student would be functioning in a “”trainee”” capacity, included in the workforce under HIPAA. In other words, if I’m an HSC student shadowing a professional in Dr. Joe’s office, I’m considered part of Dr. Joe’s workforce in this capacity. Of course, I function under whatever rules that Dr. Joe says that I must, e.g., don’t take any PHI with me, don’t access PHI that I’m not entitled to in my job duties, etc.
Here is another example: I take my child to see a doctor (not an HSC doc), and a UT medical student accompanies the doctor into the exam room, introduces herself and asks my permission to observe the exam. The patient has the option of asking the student not to be there.
If the student is not yet an HSC student, Dr. Joe’s office will definitely want to get him/her to sign a confidentiality acknowledgement and might want to get a specific patient authorization prior to allowing the student to observe patients.