But here's the reality: most student health records maintained by a school are actually governed by FERPA, not HIPAA. That misunderstanding creates confusion for school nurses, administrators, and healthcare providers who need to know exactly which rules apply before sharing information.
That's why the U.S. Department of Education and the U.S. Department of Health and Human Services jointly issued guidance clarifying which framework applies and when. The official Joint Guidance on the Application of FERPA and HIPAA to Student Health Records walks through exactly this distinction.
This article breaks down record classification, consent requirements, sharing exceptions, school-to-provider communication, and the technology safeguards that support compliant workflows. Note that state laws, IDEA, and district policies may layer on additional requirements beyond what's covered here.
Key Takeaways
- FERPA covers school-maintained education records, including most nurse-created student health records
- HIPAA covers providers, plans, and clearinghouses, but excludes FERPA education records from PHI
- Which law applies depends on who maintains the record, the provider’s school relationship, and purpose of use
- Use documented access controls, consent procedures, and audit trails, not assumptions about each record
What the FERPA-HIPAA Joint Guidance Clarifies
Schools and healthcare providers exchange student health information constantly. A pediatrician calls the school nurse. A nurse documents a diabetes care plan. A school-based clinic bills Medicaid. Each of these touches different privacy frameworks, which is why HHS and the U.S. Department of Education issued joint guidance.
The Joint Guidance, last updated in December 2019, states a clear rule: FERPA-covered education records are specifically excluded from HIPAA's definition of protected health information. That exclusion applies to the HIPAA Security Rule as well, not only the Privacy Rule.
The Four-Question Decision Framework
Before assuming a health record falls under one law or the other, ask:
- Who created or maintains the record? A school employee, an outside provider, or a contractor?
- Is that party acting for the school under its direct control, or operating independently?
- Is it an education record, or a separate clinical record kept by a healthcare provider outside the school's system?
- How will the information be used—for an educational purpose, or for treatment, billing, or clinical operations?
Here's the part that trips people up: FERPA and HIPAA are not automatically cumulative. One framework can govern a specific record while another governs a different record about the same student. A school nurse's visit note and an outside specialist's treatment file can sit side by side, each under entirely different rules.
This article is educational, not legal advice. State privacy laws, IDEA, public health reporting rules, and district policy may impose additional requirements beyond FERPA and HIPAA.
When FERPA Applies to Student Health Records
FERPA applies to public schools and other educational agencies that receive applicable federal funding. Under 34 CFR § 99.1, the regulation covers agencies that control public elementary, secondary, or postsecondary institutions. It also covers institutions that provide educational services when program funds flow to them.
Private and religious school applicability can differ based on funding structure, so verify coverage with district or school counsel.
What Counts as a FERPA Health Record
Under 34 CFR § 99.3, education records are records directly related to a student and maintained by the school or a party acting for it. In practice, this includes:
- School nurse visit documentation
- Medication administration records
- Immunization and screening information
- Individualized health plans and care plans
- Forms collected and maintained by or for the school
The School Nurse Role Matters
When a nurse is employed by the school, or works under the school's direct control as a contracted service, the records that nurse creates are generally analyzed under FERPA. Under the Joint Guidance, that analysis applies whether care happens on or off school grounds. FERPA's general rule: written consent is required before disclosing education records, with defined exceptions including:
- School officials (including contractors) with legitimate educational interests
- Health or safety emergencies presenting an articulable, significant threat
- De-identified information with personal identifiers removed
- Other applicable law requiring or permitting disclosure A quick scenario: A district-employed school nurse documents a student's asthma action plan in the school's system. That record is FERPA-governed. The student's outside pediatrician, meanwhile, keeps a separate clinical chart at the practice. That record may be HIPAA-governed. Same student, two records, two frameworks. The custodian and purpose differ.
When HIPAA Applies in School Health Settings
HIPAA covered entities fall into three categories, per HHS: healthcare providers that conduct standardized electronic transactions, health plans, and healthcare clearinghouses.
Situations Where HIPAA May Apply
- An independent healthcare provider treating a student outside the school's education-record system
- A hospital-operated school-based health center maintaining its own clinical records
- A healthcare organization transmitting protected health information electronically for standardized transactions, such as billing a health plan
Here's a common misconception: Medicaid billing or electronic claims submission does not automatically convert every school-maintained health record into a HIPAA record. The Joint Guidance is explicit that a school employing nurses or physicians isn't a HIPAA covered entity merely because those staff exist — the covered-transaction trigger is what matters, not the job title.
Schools shouldn't classify a record as HIPAA-governed just because it contains medical information. Instead, evaluate:
- Who is the record custodian?
- What's the provider relationship to the school?
- What system of record holds the document?
- What was the original purpose of collection?
When a school-based clinic, third-party contractor, health plan, or shared-services arrangement is involved, consult district counsel or a qualified privacy officer. Mixed arrangements are exactly where classification errors happen.
How Schools May Share Student Health Information
Sharing rules diverge sharply depending on which framework governs the record. FERPA requires written, signed, and dated consent unless an exception applies. Electronic consent can qualify if it properly identifies and authenticates the person.
HIPAA, by contrast, permits covered entities to use or disclose protected health information for treatment, payment, and healthcare operations without separate authorization. Payment and operations disclosures still face a minimum-necessary standard; treatment does not.
Common School-to-Provider Scenarios
- A school nurse contacts a pediatrician for care coordination: check whether consent or a legitimate-educational-interest exception applies first
- A provider sends medication instructions to the school: confirm which system will store that instruction and under which framework
- A school responds to an emergency: verify the threat is articulable and significant before invoking the health/safety exception
Legitimate educational interest means access limited to staff who need the information to perform an assigned school function, not open access because someone works at the school. Reasonable methods should restrict access accordingly.
Parent and Student Rights
FERPA rights include inspection, review (generally within 45 days of a request), and the ability to request amendment of inaccurate records. When a student turns 18 or enrolls in postsecondary education, these rights transfer from parent to student.
Districts using MyCabinet School Health, for example, match students to an "enrolling parent" on file. Once rights transfer, sharing health information with a parent requires the student's written consent or a specific exception.
Recommended disclosure workflow:
- Verify the requester's identity
- Document consent or the applicable exception
- Limit sharing to the minimum necessary for the purpose
- Confirm the recipient before transmission
- Use secure transmission methods
- Log the disclosure in an audit record
Practical Safeguards for School Health Records
Legal classification only helps if your systems actually enforce it. The Department of Education's Data Security Checklist outlines the operational baseline schools should maintain:
- Role-based, least-privilege access controls
- Unique user accounts and multi-factor authentication for remote or privileged users
- Encryption for stored data and electronic transfers
- Secure backups and defined retention rules
- Incident response procedures and periodic independent access reviews
Applying This to Nurse Workflows
For school nurses specifically, safeguards should:
- Limit chart visibility by role and assignment
- Maintain audit trails for every access and edit
- Track medication authorizations and flag expirations
- Keep parent communication separate from unrestricted record access
Those technical controls only hold if staff know how to use them. Staff training needs to cover more than "don't share records." Cover:
- FERPA/HIPAA distinctions
- Phishing awareness and verbal disclosure risks
- Personal device use and secure messaging
- Escalation procedures for emergencies
Districts should also keep a documented data inventory of where student health information is collected, stored, transmitted, exported, and shared with vendors or outside providers. Without that map, you can't verify who actually has access to what.
Platforms built for school health workflows—with role-based permissions, audit trails, and controlled parent communication—make these safeguards easier to sustain day to day.
Using Technology to Support Compliant School Health Workflows
No software makes legal determinations or guarantees compliance on its own. Technology's job is to help a district consistently apply its own privacy policies and document the decisions it has already made. A platform enforces access rules; it does not decide which law applies to a given record.
What to Evaluate in a School Health Platform
Prioritize platforms that offer:
- Role-based access and controlled sharing
- Audit trails covering every record touch
- Structured visit documentation
- Medication oversight with expiration tracking
- Digital form collection with parent authentication
- Secure notifications and configurable retention
- Administrative reporting for compliance dashboards
MyCabinet School Health was built for this workflow: a nurse-centered EHR connecting the Nurse Portal, Parent App, and Parent Web Portal. It brings records, visits, medications, and allergies into one system with role-based visibility.
Core capabilities include:
- Structured visit types with built-in audit trails
- Medication administration records, care plans, and emergency action plans in one place
- Parent access limited to their own child's information
- Nurse views limited to what care requires
Neither MyCabinet School Health nor any certification automatically makes a district compliant. SOC 2 Type II certification and FERPA-aligned design support good practice, but districts still need to validate configurations, vendor contracts, staff training, and legal obligations with qualified advisors.
Vendor Review Checklist
Before adopting any school health platform, review:
- Data ownership terms
- Subcontractor and business-associate arrangements
- Breach response procedures
- Access management controls
- Audit-log availability
- Data export, deletion, and retention terms
- Support-staff access limits
- Liability, indemnification, and related contract terms
Frequently Asked Questions
Does HIPAA apply to student health records?
HIPAA can apply when a covered provider keeps records outside the school's system. Most health records a school or district maintains are FERPA education records and fall outside HIPAA.
What is the difference between HIPAA and FERPA?
HIPAA primarily regulates covered healthcare entities and protected health information they hold. FERPA regulates education records maintained by covered educational institutions or parties acting on their behalf.
What student records are protected under FERPA?
FERPA protects education records directly related to a student and maintained by the school or a party acting for the school. This includes many health and medical records kept by school nurses, including visit notes and medication logs.
Where can I find the answers to the FERPA assessment questions?
Refer to the U.S. Department of Education's official FERPA training modules, district-approved resources, and the current Joint Guidance. Avoid relying on unverified answer keys circulating online.
When can a school share student health information without parent consent?
Limited exceptions exist, including disclosures to school officials with legitimate educational interests and qualifying health or safety emergencies. Always confirm the specific facts and check applicable state rules before relying on an exception.
How should schools determine whether FERPA or HIPAA applies to a health record?
Check who maintains the record, whether the provider acts for the school, and whether it is a separate clinical file held by a HIPAA-covered entity. When arrangements are mixed, consult district counsel.
