K-12 school health records aren't one uniform category. They include education records, treatment documentation, medication logs, immunization data, screening results, and everyday communications with parents and outside providers. Each type can trigger different obligations.
This article breaks down how FERPA and HIPAA actually interact in a school setting, where HITECH and the 21st Century Cures Act fit into the picture, and what a school health EHR needs to support to keep your district on solid ground.
Key Takeaways
- No federal law mandates a specific EHR for K-12 schools, but privacy and security rules still apply
- FERPA typically governs student health records maintained by schools
- HIPAA applies to specific covered entities, not automatically to every school with health data
- Compliant school health EHRs need role-based access, audit trails, encryption, consent workflows, and incident response
Which Laws and Regulations Apply to K–12 School Health Records?
K–12 student health documentation is primarily governed by FERPA, not HIPAA. HIPAA applies only in narrower cases, and districts still need to layer in IDEA, Section 504, and state privacy or retention rules.
FERPA Covers Most School-Maintained Health Records
FERPA governs education records: records directly related to a student and maintained by a school or a party acting on its behalf.
According to the U.S. Department of Education's 2023 guidance, health records maintained by school staff for students under 18 in elementary or secondary schools generally count as education records, not a separate category exempt from FERPA.
That's a critical distinction. FERPA's "treatment record" exception is narrow. It only applies to records made by a physician, psychiatrist, psychologist, or similar recognized professional, used solely for treatment, and limited to students who are 18 or older or enrolled in postsecondary education. A school nurse's clinic visit notes for a 10-year-old don't qualify.
HIPAA Applies to Specific Entities, Not Schools by Default
Here's where a lot of confusion happens. Joint guidance from HHS and the Department of Education clarifies that HIPAA generally does not apply to elementary or secondary schools because the school isn't a HIPAA-covered entity, or because the health information already qualifies as a FERPA education record and is therefore excluded from HIPAA's definition of protected health information.
HIPAA becomes relevant when a genuine covered entity, such as a healthcare provider, health plan, or clearinghouse, is the one creating or transmitting the records. A school-based health clinic run by an outside hospital system, for instance, may be operating under HIPAA even while sitting inside a public school building.
FERPA vs. HIPAA at a Glance
| Factor | FERPA | HIPAA |
|---|---|---|
| Who's covered | Schools and districts receiving federal funds | Healthcare providers, health plans, clearinghouses |
| What's protected | Education records (can include health info) | Protected health information held by covered entities |
| Access rights | Parents, then student at 18 or postsecondary enrollment | The individual patient, or personal representative |
| Disclosure rule | Written consent or a specific exception | Authorization or a permitted use/disclosure |
Other Requirements Districts Should Assess
Beyond FERPA and HIPAA, districts often need to layer in additional rules:
- IDEA requires confidentiality protections for personally identifiable information tied to special education services (34 CFR 300.610)
- Section 504 requires notice and record-review procedures connected to evaluation and placement decisions (34 CFR 104.36)
- State privacy laws set rules for student medical records and immunization reporting; confirm what applies in your state with district counsel
- Record-retention schedules (often state-level) dictate how long health documentation must be kept
Because state requirements differ so widely, districts shouldn't assume a neighboring state's rules apply to them.
Why These Regulations Matter in School Health Operations
For a school nurse, compliance isn't an abstract legal concept. It's baked into every part of the job: documenting a clinic visit, logging a medication dose, reviewing a health form a parent submitted, or calling a pediatrician about a student's asthma action plan.
Fragmented documentation creates real gaps: paper files in one cabinet, spreadsheets on a shared drive, faxed consent forms, and text messages between staff.
Common risks with fragmented systems:
- Inconsistent or incomplete documentation across visits
- Unauthorized disclosure when information travels through unsecured channels
- Missed medication updates buried in email threads
- Missing audit trails when a parent or regulator asks who accessed a record
A 2022 study of school-nurse EHR access across three urban districts found that when nurses gained direct visibility into hospital records, emergency department visits dropped 34% and hospitalizations dropped 44% among the students tracked. Connected access changed clinical outcomes, not just paperwork.
The same rules that enable that access also limit disclosure. A nurse shares information with a coach or teacher only when there is a legitimate need, which protects student dignity instead of treating health details as default staff knowledge.
What Compliance Requirements Should a School Health EHR Support?
A school health EHR needs to do more than store records. It needs to enforce the rules around who sees what, when, and why.
Role-Based Access and Audit Trails
Permissions should map to actual job responsibilities, not blanket access for anyone with a login. That means:
- Nurses see clinical documentation relevant to their assigned students
- Administrators see summary or compliance-level data, not necessarily clinical notes
- Parents see only their own child's information
- Access changes automatically when someone's role or employment status changes
Every meaningful action (logins, record views, edits, exports, and disclosures) should generate an audit trail. The federal Privacy Technical Assistance Center (PTAC) recommends periodic audits and independent assessments of these data-protection capabilities, not just a one-time setup.
Security Safeguards That Hold Up
Baseline security expectations include:
- Encryption for data in transit and at rest
- Unique user accounts with strong authentication (two-factor where possible)
- Automatic session timeouts
- Secure, tested backups and disaster-recovery procedures
- A documented incident-response plan written before an incident, not during one
Consent, Disclosure, and Record Lifecycle
Routine parent communication is different from a disclosure that needs specific authorization. Districts need documented workflows for both, plus clear processes for:
- Correction requests
- Retention schedules
- Secure destruction when records reach end of life
MyCabinet School Health supports these controls with role-based permissions, action-level audit trails, and parent access limited to each guardian’s own child. It is SOC 2 Type II audited and maintains FERPA-aligned and HIPAA-aligned practices. Software alone does not guarantee legal compliance—policies, training, and governance still matter.
How Schools Can Implement an EHR Compliance Program
Rolling out a compliant school health program takes more than buying software. Schools need a clear process covering data, people, procedures, and testing.
- Start with a data inventory. Identify what student health information you collect, where it lives, who can access it, and which law (FERPA, HIPAA, state law, or some combination) governs each type.
- Build a governance team. Include district leadership, school nurses, IT, legal counsel, special education staff, and procurement. Assign clear ownership for policy updates, access reviews, and vendor oversight.
- Write down your procedures. Cover secure documentation, parent request handling, consent, medication workflows, device use, phishing awareness, and lost-device reporting. Then train staff on them on a recurring basis.
- Test workflows before rollout. Run through realistic scenarios: a medication change, a parent submitting a health form, an emergency disclosure, a staff role change, a records-correction request.
This is where a school-health-specific platform helps. MyCabinet School Health, for example, can:
- Centralize nurse documentation with automatic audit trails
- Track medication expiration dates
- Route digital health forms through review-and-approval workflows
That reduces the manual burden of spreadsheets and paper files, but it does not replace the governance work above.
How to Evaluate a K–12 School Health EHR
Choosing a school health EHR means looking past the sales pitch and testing workflow fit, security evidence, contract terms, and day-to-day practicality.
Workflow Fit
Does it match how your nurses actually work? Prioritize tools built for school clinic flow, not a generic records database:
- Structured visit documentation
- Medication management
- Screening and recheck task lists
- Digital form collection
- Parent access tied to student records
Privacy and Security Evidence
Ask vendors to show, not just tell:
- Independent security reports, such as SOC 2 Type II certification
- Encryption practices and authentication controls
- Access logs and backup/recovery procedures
- A documented breach-response commitment
- Clarity on which vendor personnel can access student data, and under what circumstances
Contractual FERPA and HIPAA Terms
Beyond marketing claims, the contract is the control surface. Confirm clear terms on:
- Data ownership
- Retention and deletion schedules
- Subcontractor use
- Breach notification duties
- District control over permissions and disclosures
Practical Fit
Finish with operational fit across your schools:
- Accessibility for staff and families
- Training and implementation support
- Data migration help
- Uptime expectations
- Mobile and browser access across sites
MyCabinet School Health connects a Nurse Portal, Parent App, and Parent Web Portal, with SOC 2 Type II audited status and design aligned to FERPA and HIPAA expectations. Even so, districts should independently verify current features, contract language, and security documentation with their own counsel before signing anything.
Risks, Responsibilities, and Ongoing Compliance
Noncompliance doesn't usually show up as a dramatic headline. More often, it's a privacy complaint, an unauthorized disclosure, a corrective action plan, or simply a family that loses trust in the school's handling of their child's information.
HIPAA enforcement at the national level is substantial. As of October 2024, OCR reported more than 374,000 HIPAA complaints and 152 settlements or civil penalties totaling roughly $144.9 million across covered entities generally, not schools specifically.
The most common issues were impermissible disclosures, inadequate safeguards, and lack of patient access.
Compliance responsibility is shared, not centralized:
- Districts and administrators set policy and oversee vendors
- Nurses and staff follow documented procedures day to day
- Technology vendors secure the platform and honor contract terms
- Healthcare partners handle their own HIPAA obligations where applicable
Keep compliance current with:
- Recurring access reviews (quarterly or at role changes)
- Policy updates as laws or district needs shift
- Regular workforce training refreshers
- Vendor security assessments
- Incident-response drills, not just a written plan
Regulations don't stay static. FERPA guidance, state privacy laws, and health IT rules under HITECH and the 21st Century Cures Act evolve. A standing review cycle—not a one-time project—keeps a district protected over the long run.
Frequently Asked Questions
Are electronic medical records mandatory for K-12 schools?
No single federal law requires every school or district to adopt a specific EHR system. Schools still must protect, manage, and appropriately disclose student health information under FERPA and any applicable state or district rules.
Does FERPA or HIPAA apply to school health records?
FERPA typically applies to health information maintained by schools as part of a student's education record. HIPAA applies when a separate covered entity, like an outside healthcare provider, is involved. Who maintains the record determines which law governs.
Do school nurses have to use an electronic health record system?
There's no blanket legal mandate requiring a specific technology. Secure, accurate, and auditable recordkeeping is still a practical necessity, and some states or districts impose their own documentation requirements.
What should a compliant school health EHR include?
At minimum, it needs role-based access controls, audit trails, strong authentication, encryption, and secure backups. It should also support consent and disclosure workflows, medication tracking, defined retention schedules, and an incident-response plan.
Can parents access their child's electronic school health records?
Generally yes, though access depends on FERPA, the student's age, custody arrangements, and the type of record. Districts should use a documented identity-verification and request-handling process for these requests.
