But digitizing health information also creates new obligations. Once a record lives in a database instead of a locked filing cabinet, questions about who can see it, how it's protected, and which law governs it become far more concrete.
Four federal frameworks shape this landscape: HIPAA, FERPA, HITECH, and the 21st Century Cures Act. Which one applies depends on the organization, the type of record, and the relationship between the school and any healthcare provider involved.
This article is an educational overview, not legal advice. Districts should confirm specific requirements with qualified counsel, their privacy officer, and current federal and state guidance before finalizing policy.
Key Takeaways
- HIPAA governs covered entities and business associates handling protected health information
- FERPA generally governs student education records maintained by schools
- HITECH strengthened privacy and security enforcement and accelerated certified EHR adoption
- The 21st Century Cures Act targets interoperability, patient access, and information blocking
- Compliance depends on governance, training, and vendor oversight—not a "compliant" software label alone
HIPAA and FERPA: The Two Privacy Frameworks Most Relevant to School Health Records
Most confusion around school health records starts here. People assume HIPAA automatically covers anything labeled "health information." It doesn't. Whether HIPAA or FERPA applies depends on who holds the record and why.
What HIPAA Requires
HIPAA applies to covered entities — health plans, clearinghouses, and healthcare providers that transmit information electronically in standard transactions — along with their business associates. A school district is not automatically a covered entity simply because it employs a nurse or keeps health records (HHS guidance on covered entities).
When HIPAA does apply, three rules matter:
- Privacy Rule — governs use and disclosure of protected health information (PHI)
- Security Rule — requires safeguards specifically for electronic PHI (ePHI)
- Breach Notification Rule — sets timelines for notifying individuals and regulators after a breach
The Security Rule requires three safeguard categories:
- Administrative — risk analysis, workforce training, incident response planning
- Physical — secured devices, controlled facility access, workstation policies
- Technical — unique user accounts, role-based access, audit logs, encryption, backups
If a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity, that relationship generally requires a business associate agreement (BAA) before any PHI changes hands (HHS business associate guidance).
Whether a specific school-vendor relationship needs a BAA depends on the facts. Confirm against current HHS guidance rather than assuming.
FERPA and the Education-Record Distinction
FERPA protects personally identifiable information in education records maintained by a school, district, or a party acting on its behalf. A student health record kept by the school nurse is typically an education record under FERPA, not PHI under HIPAA, because the school itself isn't functioning as a HIPAA-covered healthcare provider for that student.
Here's a side-by-side comparison:
| Factor | HIPAA | FERPA |
|---|---|---|
| Who's covered | Health plans, clearinghouses, providers, business associates | Schools and districts receiving federal funding |
| What's protected | PHI / ePHI | Personally identifiable info in education records |
| Access rights | Individual/personal representative access | Parent or eligible student access |
| Oversight | HHS Office for Civil Rights | U.S. Department of Education |
These frameworks are not interchangeable. The same student's health information could sit under FERPA while in the school's care and shift to HIPAA the moment it's held by an outside clinic or hospital that treats that same student as a patient.
Joint guidance from the Department of Education and HHS confirms this: records maintained by a school about its own students are generally FERPA records (or FERPA "treatment records"), which are specifically excluded from the HIPAA definition of PHI.
A school can still be a HIPAA covered entity for non-student patients (staff, family members, or the public) even while FERPA governs its student records (joint ED/HHS guidance on FERPA and HIPAA).
Applying Both Frameworks in Real School Workflows
Consider a few everyday scenarios:
- Medication administration by the school nurse: typically a FERPA education record
- Immunization forms submitted by parents: typically FERPA-governed
- Referral to an outside physician: the physician's resulting record is usually HIPAA-governed, separate from the school's FERPA record
- Emergency disclosure during a medical event: FERPA's health-or-safety exception may permit disclosure without prior consent
The record's custodian and purpose, not just the subject matter, determine which rules apply. Districts should avoid blanket assumptions and instead check each workflow against current ED and HHS guidance. State privacy laws, district policy, and special education obligations may layer on additional requirements beyond the federal floor.
HITECH and the 21st Century Cures Act: Adoption, Security, Access, and Interoperability
Two later laws expanded on HIPAA's foundation, with different goals.
HITECH's Contribution to EHR Compliance
The HITECH Act, enacted in 2009, made business associates directly liable for specific HIPAA obligations, including Security Rule compliance and breach notification duties. It also strengthened enforcement across the board, so penalties became steeper and more actively enforced.
HITECH created the EHR Incentive Program formerly called "meaningful use." That terminology has since evolved. CMS now uses Promoting Interoperability to describe its current programs.
These federal incentive programs target eligible hospitals and clinicians rather than school districts directly. Still, the push toward certified EHR adoption shaped the broader health IT market school vendors operate in.
Practically, HITECH raised the stakes for:
- Documented workforce training
- Written security policies
- Timely breach response
- Regular risk assessments
- Vendor oversight and BAA management
The 21st Century Cures Act and Information Exchange
The Cures Act shifted focus toward interoperability: making sure health information can move where it needs to go. Its core provisions cover patient access, standardized data exchange (including APIs), and restrictions on information blocking.
Information blocking, in plain terms, is a practice by a health IT developer, health information exchange, or healthcare provider that is likely to interfere with access, exchange, or use of electronic health information. The practice is barred unless required by law or covered by a recognized exception (ONC's information blocking framework).
For school health platforms, this connects to:
- Exchanging records with outside healthcare providers when authorized
- Supporting legitimate parent and family access requests
- Avoiding uncontrolled exports or unauthorized disclosures
Applicability, exceptions, and penalties vary significantly depending on the actor type, so districts and vendors should check current ONC rules rather than relying on older summaries.
What Certified Technology Does — and Does Not — Mean
ONC certification confirms that a health IT product meets specific technical criteria tested by an authorized lab. It's a useful signal during procurement.
What certification does not do:
- Guarantee HIPAA compliance
- Guarantee FERPA alignment
- Replace an organization's own legal responsibilities
- Substitute for a SOC 2 audit or independent security assessment
Certification, HIPAA compliance, FERPA alignment, and SOC 2 reporting are four distinct things. A district should understand which claims a vendor is actually making before treating any single label as sufficient.
Practical Compliance Controls for a School Health EHR
Buying compliant software is only step one. Compliance lives in daily operations.
Governance and Accountability
Assign clear ownership across:
- District leadership and privacy/security officers
- School health administrators and nurses
- IT teams
- Vendors and their subcontractors
Build a data inventory and flow map covering collection, storage, sharing, parent access, provider exchange, archival, and deletion. Document which records are education records, which may be PHI, and which legal authority permits each recurring disclosure.
Access, Authentication, and Auditability
Every user should have a unique login. Never share credentials. From there:
- Apply least-privilege, role-based access (a substitute nurse shouldn't see the same scope as a full-time staff nurse)
- Use multi-factor authentication where appropriate
- Set automatic session timeouts
- Offboard departing staff immediately
- Review access permissions periodically
Audit trails should record who accessed a record, what they changed, what they exported, and when. Those logs let administrators investigate an incident or demonstrate oversight during a review.
Secure Communication and Data Handling
Encryption matters for data both in transit and at rest. Build on that baseline:
- Use secure parent portals instead of unencrypted email for sensitive updates
- Control what gets included in push notifications
- Set policies for screenshots, downloads, and printed records
- Ensure digital form uploads route through authentication, nurse review, approval, and correct attachment to the right student record
Incident Response, Training, and Continuous Review
An incident response process typically includes:
- Reporting — a clear, known channel for staff to flag concerns
- Triage and containment — stopping further exposure quickly
- Investigation and documentation — recording what happened and when
- Notification analysis — determining who must be told, and by when
- Remediation and follow-up — closing gaps and updating training
Retention periods and breach notification deadlines are governed by specific federal and state rules. Districts should confirm current timelines through official sources rather than relying on general assumptions.
Training closes the loop. Make it role-specific and recurring, covering phishing awareness, minimum-necessary handling, and reporting procedures for nurses, administrators, and any staff with system access.
Choosing and Governing a Compliant School Health EHR
Vendor selection deserves the same scrutiny as any other compliance decision. A useful due-diligence checklist covers:
- Applicable HIPAA or FERPA responsibilities and business associate terms
- Security documentation and independent assessments (SOC 2 Type II reports, for example)
- Incident history and subcontractor relationships
- Data location, retention, deletion, and portability
- Support access controls and breach cooperation commitments
During a demonstration, ask direct questions:
- Can administrators configure role-based permissions themselves?
- Are access and disclosure events logged automatically?
- Can the system distinguish between record types?
- How are parent permissions managed and updated?
- How are medication records, form corrections, and data exports documented?
MyCabinet School Health is one example of a platform built specifically around these questions. It combines:
- Nurse-centered workflows
- Role-based permissions
- Audit trails
- Digital form collection with in-system review and approval
- Medication expiration tracking
- Controlled (not open-ended) parent notifications
Its architecture is HIPAA- and FERPA-aligned, and it's independently audited under SOC 2 Type II.
That said, no platform label replaces a district's own responsibility. Configuration choices, staff training, access policies, and day-to-day use ultimately determine whether a district's compliance posture holds up. Vendor claims are worth checking against actual contract terms, technical documentation, and the district's own risk assessment rather than accepted at face value.
Make EHR Compliance an Ongoing School Health Practice
Federal EHR compliance is a continuous process. It combines the correct legal framework with secure technology, documented governance, trained staff, and controlled information sharing.
A practical next step is to work through your current setup in order:
- Inventory your health records and workflows
- Identify the federal and state rules that govern each one
- Assess existing controls against that list
- Build a prioritized remediation plan with legal and technical input
Frequently Asked Questions
What are the key standards for electronic health records?
Key standards cover privacy, security, interoperability, patient or family access, auditability, and data integrity. Exact requirements depend on the organization and record type under HIPAA, FERPA, HITECH, ONC rules, and the Cures Act.
Does HIPAA apply to student health records in schools?
Not automatically. It depends on who holds the record, why it exists, and whether that holder is a HIPAA covered entity. Many school-held student health records fall under FERPA instead.
How is FERPA different from HIPAA for school health information?
FERPA protects education records maintained by schools and districts; HIPAA protects PHI held by covered entities and business associates. The specific facts of who holds a record and why determine which law applies.
What did HITECH change for electronic health records?
HITECH strengthened HIPAA enforcement and extended direct liability to business associates. It also accelerated adoption of certified EHR technology through federal incentive programs, now known as Promoting Interoperability.
What does the 21st Century Cures Act require from EHR users and vendors?
It requires interoperability, patient access to health information, standardized data exchange, and limits on information blocking. Exceptions and penalties vary by organization type, so current ONC rules should guide the details.
Can an EHR vendor guarantee that a school district is compliant?
No single vendor label guarantees compliance. Vendors provide security features, documentation, and contractual commitments, but districts remain responsible for lawful configuration, access management, staff training, and daily oversight.
