The U.S. Department of Education reports that school districts face an average of five cyber incidents per week. Student health data sits at an odd legal intersection too: it can fall under HIPAA, FERPA, or both, depending on who holds it and why. Many districts don't realize which rules apply until something goes wrong.
This guide covers the real risks, the security standards that matter, and what to look for when evaluating a school health EHR.
Key Takeaways
- Student health records mix medical and education data, so HIPAA and FERPA obligations often overlap
- Weak access controls, unencrypted data, and untrained staff create the most common school EHR risks
- Role-based access, audit trails, and encryption should be non-negotiable when choosing a platform
- Purpose-built school health EHRs reduce risk far more than spreadsheets, paper, or fax
Why EHR Security Matters for K-12 Student Health Records
School health records aren't generic files. They typically include:
- Immunization histories
- Current medication lists and dosages
- Allergy and emergency care plans
- Chronic condition documentation
- Mental and emotional health notes
Each of these is valuable to identity thieves, and identity theft involving minors is especially dangerous because it can go undetected for years. The FTC notes that warning signs often surface years later, such as a collections notice for a child's "overdue" account or an IRS letter about unpaid taxes tied to a Social Security number a child hasn't used yet.
For context on scale, HHS reported 663 healthcare breach notifications affecting roughly 242.9 million people in 2024 alone. That's a healthcare-sector benchmark, not a K-12-specific figure, but it shows how attractive medical data is to bad actors industry-wide.
What's at stake for a district after a breach:
- Regulatory penalties under HIPAA and/or FERPA
- Parents losing trust in the school's ability to protect their children
- Nurse workflows disrupted during investigation and remediation
- Reputational damage that lingers long after systems are restored
Everyday record-handling tools often widen that exposure. Many districts still rely on:
- Spreadsheets and shared drives
- Paper charts
- Faxed medical orders
- Email threads for sensitive updates
None of these were built for audit trails or encryption, so unauthorized access can go unnoticed.
Unique Security Risks in School Health Settings
Shared and Public-Facing Infrastructure
Clinic workstations often serve multiple nurses, substitutes, and front-office staff throughout the day. Shared logins or unattended screens create windows for unauthorized access, whether accidental or deliberate.
Volume and Diversity of Data Handlers
Nurses are not the only people who handle student health data:
- Coaches review athletic physical clearances
- Front-office staff process medication pickups
- Administrators pull compliance reports
Every additional person with access is another potential point of exposure.
Parent and Family Access Complexity
Parents legitimately want visibility into their child's care. Broad record access, however, can expose information to unauthorized family members, parties in custody disputes, or other third parties who should not see it.
Legacy and Manual Processes
Paper forms and faxed medical orders lack the basics: no encryption, no audit trail, no way to prove who accessed what and when. Email isn't much better. These are still the dominant workflows in many schools—and the ones most overdue for replacement.
What Security Standards and Features Should a School EHR Have
HIPAA's Security Rule requires specific technical safeguards that translate directly into school clinic requirements:
| HIPAA Standard | What It Means for a School Clinic |
|---|---|
| Access control | Unique logins per staff member, not shared accounts |
| Automatic logoff | Sessions end after inactivity on shared workstations |
| Encryption | Data protected in transit and at rest |
| Audit controls | Every record access is logged and reviewable |
| Authentication | System verifies who's actually logging in |
Those technical safeguards address how the system protects data. FERPA governs who may see and share it. Health records the school maintains as part of a student's education record generally fall under FERPA's disclosure rules, not HIPAA's, so districts still need tight control over access and sharing.
Core features to look for:
- Role-based access control: nurses, front office staff, and administrators see only what their role requires
- Audit trails: every visit note, medication entry, and record view is timestamped and logged
- Data encryption: covers parent uploads, clinic documentation, and district reporting
- SOC 2 certification: independent proof that a vendor's security controls work in practice
A SOC 2 report is not a HIPAA or FERPA certificate. It shows a third party tested the vendor's controls. Ask for the full report, not only the badge.
Best Practices for Schools and Nurses to Reduce Risk
CISA's K-12 guidance points to a few concrete, achievable steps:
- Appoint a designated security/privacy contact within the district specifically for school health data who owns the incident-response plan and vendor reviews
- Train staff regularly on phishing recognition, password hygiene, and safe handling of student health information, not as a one-time onboarding checkbox
- Replace paper, fax, and email workflows with a single structured digital system so nothing slips through untracked
- Require multi-factor authentication for anyone with elevated system privileges
- Maintain tested backups isolated from the main network
For a health office managing medication and emergency care data, these controls are baseline requirements.
How MyCabinet Builds Security Into School Health Workflows
MyCabinet is SOC 2 Type II certified, HIPAA compliant, and FERPA compliant. It is built around the compliance overlap schools actually face, not adapted from a general medical EHR.
Role separation that matches how schools actually work:
- Nurses manage clinic visits, medications, and documentation in a dedicated portal with structured visit types and audit trails
- Parents see only their own child’s clinic updates, medication status, and expiration alerts via app or web portal
- Administrators get district-level visibility without unnecessary clinical detail
The platform runs on a separate, medical-grade environment isolated from broader school information systems, keeping sensitive health data away from general SIS traffic.
One-way parent notifications, by design. Parents receive clinic visit reasons, medication expiration reminders, and active medications on file—without an open messaging inbox.
Nurses cannot see inside a parent’s app. They only see whether a notification was delivered and viewed. That keeps communication clear and compliant instead of becoming an unmanaged chat stream.
Digital forms, closed loop. Parents upload immunization records, medical forms, and medication documentation directly. Nurses review and approve in-platform, and approved files attach straight to the student record—no forms lost in a fax tray or buried in an inbox.
Cobb County School District’s superintendent, Chris Ragsdale, described the impact at a 2025 school board meeting: the platform “digitized and makes documentation easier,” giving parents a way to submit paperwork electronically and see when their child was seen and given medication.
As he put it, it’s “a win for the parents and a win for the district.”
Frequently Asked Questions
What safety measures are typically built into EHR systems?
Core built-in safeguards include role-based access controls, encryption of data in transit and at rest, and audit trails that log every record access. These controls limit who can view data and create a clear record of every access event.
What are the potential risks associated with EHR systems?
Key risks include unauthorized access from weak or shared logins, data breaches, phishing attacks on staff credentials, and unpatched software. Fragmented manual workflows running alongside a digital system compound these risks.
What are the security standards required by HIPAA?
HIPAA's Security Rule requires administrative, physical, and technical safeguards to protect health data. Technical requirements specifically include access controls, audit controls, encryption, and authentication measures.
How is student health data different from general medical records under FERPA?
When a school maintains health records as part of a student's education record, FERPA's disclosure rules apply rather than HIPAA's Privacy Rule. This changes who can access the data and under what circumstances it can be shared.
Who should have access to a student's health record in a school setting?
Access should be role-based and limited to school nurses and authorized staff on a need-to-know basis. Coaches, administrators, and front-office staff should only see the specific information their role requires.
How can parents securely view their child's health information at school?
Controlled parent portals or apps can provide limited visibility, such as clinic visit summaries and medication alerts, without exposing the full health record. Parents see what they need; the rest stays restricted to authorized school staff.
