Instead, this data lives under FERPA, the federal law governing education records. Many districts still juggle paper logs, shared spreadsheets, and fax machines to manage it. That approach creates compliance risk and buries nurses in administrative work.
This guide breaks down what FERPA actually requires for health records, the software features that matter most, and how purpose-built platforms like MyCabinet help schools manage this responsibility without adding chaos.
Key Takeaways
- Student health records kept by school nurses generally fall under FERPA, not HIPAA
- FERPA-ready software requires role-based access, audit trails, encryption, and controlled parent communication
- Purpose-built school health platforms cut compliance risk versus spreadsheets or generic file sharing
- Select software on features, vendor agreements, and total cost of ownership—not sticker price alone
Understanding FERPA and Student Health Records
FERPA (20 U.S.C. § 1232g) covers "education records," meaning records directly tied to a student and maintained by a school or a party acting on the school's behalf. Health records kept by school-based clinics and nurses' offices fit squarely into that category.
Where the FERPA/HIPAA Line Falls
Most schools aren't HIPAA "covered entities." According to the Department of Education and HHS joint guidance on FERPA and HIPAA, student health records maintained by a K-12 school are typically education or treatment records under FERPA, not PHI under HIPAA.
The exception: if an outside provider treats a student but isn't acting on the school's behalf, that provider's records may fall outside FERPA entirely.
What Student Health Records FERPA Protects at School
- Immunization records
- Medication administration logs
- Clinic visit and treatment notes
- Screening results (vision, hearing, scoliosis, etc.)
- Allergy and chronic condition documentation
Who Must Comply, and What Vendors Are Allowed to Do
The school or district is the FERPA-covered entity. That responsibility doesn't transfer to a software vendor, even a good one.
The "school official" exception (34 CFR § 99.31):
Vendors can access student health records without separate parental consent only if they:
- Perform a service the school would otherwise handle with its own employees
- Remain under the school's direct control regarding data use
- Follow the redisclosure limits under 34 CFR § 99.33
In plain terms: your software vendor doesn't get free rein over student data. They can use it only for the purpose you've authorized, and they can't pass it along elsewhere.
A critical point districts often miss: using compliant software doesn't outsource accountability. If a vendor mishandles data, the district still answers to the Department of Education.
Risks of Getting It Wrong
School districts are attractive targets. The Department of Education's K-12 Cybersecurity page reports that districts face an average of five cyber incidents per week.
The PowerSchool breach disclosed in January 2025 shows how large that exposure can get. EdWeek reported the incident may have touched students and staff across more than 30,000 schools, given PowerSchool's footprint of over 16,000 customers and 50 million students nationwide.
Confirmed totals were never released, but the potential scope alone should concern any district still relying on fragmented, unsecured systems.
Consequences of FERPA violations can include:
- Department of Education investigations
- Mandated corrective action plans
- Loss of federal funding (in serious, unresolved cases)
- Reputational damage with families and the community
Core Features FERPA Compliance Software Must Have
Not all school health software is built the same. Here's what actually matters for FERPA alignment.
- Role-based access control: Only nurses, administrators, and designated staff should see specific student health data, and only what their role requires. Least-privilege access isn't optional; it's the baseline regulators expect.
- Audit logs and activity tracking: Timestamp every access, edit, or share and attribute it to a specific user. That trail supports internal audits and answers parents who ask who viewed their child's file.
- Encryption in transit and at rest: Protect records in storage and in motion. Per CoSN's K-12 risk assessment, fewer than 35% of surveyed districts encrypt both ways, leaving many exposed.
- Secure, controlled parent communication: Give parents visibility into care without open-ended messaging that risks unauthorized disclosure. One-way, permissioned notification channels strike the right balance.
- Structured documentation: Predefined visit types and consistent workflows reduce errors and keep records defensible if questioned later.
- Digital consent and form management: Collect and approve health forms with a documented consent trail, replacing the paper stacks most school clinics still handle.
How MyCabinet Supports FERPA-Compliant Health Records
MyCabinet School Health is built specifically around K-12 nurse workflows — not adapted from a generic medical records system. It's FERPA- and HIPAA-compliant, and SOC 2 Type II audited.
Task lists organize incomplete visits, medication reminders, and screening follow-ups with color-coded prioritization. Documentation stays structured instead of scattered across sticky notes and memory.
A connected system ties everyone together:
- Nurse Portal — where staff record visits, medications, and health plans
- Parent App — delivers one-way alerts on clinic visits and medications
- Parent Web Portal — browser-based access for families
The Parent App stays one-way on purpose: families get clinic and medication updates without open messaging back, which limits exposure while keeping them informed.
Access controls reinforce that boundary:
- Parents see only their own child's records
- Nurses access what they need for care
- District administrators get centralized reporting and audit trails — without unrestricted access
Health forms run through a digital workflow. Parents submit emergency contacts, medications, and physicals in the app's "To Do's" section, and nurses track completion in one place.
That model is already live in Cobb County School District. Superintendent Chris Ragsdale said the platform "digitized and makes documentation easier," citing electronic paperwork and parent visibility into visits and medication administration — "a win for the parents and a win for the district."
Implementation Best Practices for Schools and Districts
Rolling out new health record software works best with a clear plan.
- Designate a compliance coordinator. Someone, often a lead nurse or administrator, should own oversight of health record practices district-wide.
- Conduct a data inventory first. Find out where health information currently lives: paper files, shared drives, personal email. You can't migrate what you haven't mapped.
- Finalize vendor agreements. Define data use limits, access boundaries, and breach notification expectations in writing before you sign anything.
Cost Considerations for FERPA Compliance Software
FERPA-compliant student health software pricing varies more than most administrators expect. Some vendors, like SchoolDoc, publish a starting point (around $425 per month), with final pricing tailored to district size and complexity. Others, such as SNAP Health Center, work from consultation and custom quotes with no public price list.
MyCabinet School Health also uses a customized, quote-based model rather than a flat per-student rate, with pricing shaped by district needs and what’s included—such as parent app and portal access, onboarding, and ongoing support.
When comparing quotes, factor in total cost of ownership:
- Reduced administrative time for nurses
- Fewer errors from paper-based tracking
- Avoided legal and breach-response costs
Confirm what’s included before you compare base price:
- Parent app or portal access
- Onboarding and training
- Ongoing support (and who carries it—vendor vs. your IT team)
Don’t judge vendors on base price alone. A cheaper platform that skips parent access or shifts support onto your IT staff often costs more over the life of the contract.
Frequently Asked Questions
What is FERPA compliance software?
FERPA compliance software helps schools manage, secure, and document access to education records, including health records, in line with FERPA's access control, audit, and consent requirements.
How much does FERPA compliance software cost?
Costs vary by vendor and scope, often priced per student annually or through platform licensing. Total cost should account for efficiency gains and reduced risk, not just the software fee.
Is student health data covered by HIPAA or FERPA?
School-maintained health records are typically covered by FERPA, not HIPAA, unless the school itself operates as a HIPAA-covered entity. Most K–12 schools are not HIPAA-covered entities.
Who is responsible for FERPA compliance when using third-party software?
The school or district remains ultimately responsible. Vendors must follow contractual safeguards and qualify under the "school official" exception to access data at all.
What happens if a school violates FERPA with student health records?
Potential consequences include Department of Education investigations and required corrective action plans. In rare, unresolved cases, a district could lose federal funding.
Can parents access their child's school health records?
Yes. FERPA gives parents the right to inspect and review their child's education records, including health records, within 45 days of a request.
