That volume of sensitive information creates real exposure. A 2023 U.S. Department of Education guidance document confirms that student health records maintained by a school, or by someone acting for it, generally qualify as education records under FERPA.
The central question districts face: when health information sits in a nurse's office, a filing cabinet, or a cloud platform, how should the school protect it, use it internally, and decide when disclosure is appropriate? The answer depends on the type of record, who maintains it, why it exists, and the specific circumstances of each request. This article breaks down that framework. It is not legal advice — confirm current requirements with qualified counsel and official federal guidance before finalizing district policy.
Key Takeaways
- Student health records often qualify as education records when they relate to the student and the school maintains them.
- FERPA restricts personally identifiable information disclosure without consent, an exception, or an authorized school purpose.
- Role-based access, audit trails, and training support compliance; they do not replace district FERPA policy or legal review.
- Map health data flows among nurses, administrators, families, vendors, and responders before adopting new technology.
How FERPA Applies to Student Health Information
FERPA does two things. First, it gives parents and eligible students (18+) the right to inspect and review education records. Second, it limits who can access personally identifiable information from those records without consent.
The Two-Part Education Record Test
A record qualifies as an education record when it meets both conditions:
- Directly related to a student — identifiable information about that specific student, not general policy or statistics
- Maintained by the school or a party acting for it — district staff, contracted vendors, and technology providers processing records on the school's behalf
Applied to health information, this framework typically covers:
- Nurse encounter notes and clinic visit documentation
- Medication administration records
- Individualized health plans (IHPs) and 504-related care plans
- Health-office referrals to counselors or administrators
- Screening results (vision, hearing, scoliosis)
- Completed immunization and medical forms submitted by families
Not every document that mentions a student is automatically protected. A nurse's personal scratch notes—kept outside the official student-health workflow and never shared with the school—may fall outside the education-record definition.
That line is what districts use when deciding what belongs in a formal record system versus a private working file.
Vendors, Access Rights, and Contracted Providers
When a technology provider stores health records for the school, those records remain education records under FERPA. The school still owns the compliance duty.
Districts should define the following in writing:
- Permitted use of the data
- Access limits by role
- Retention timelines
- Redisclosure restrictions
Parents and eligible students keep the right to inspect, review, and request amendment of these records. A clear request-routing process prevents confusion when a parent asks for a medication log or care plan:
- Who receives the request
- How identity is verified
- How quickly the school must respond
Context decides the classification. A screening result filed in the student's official health record is likely an education record. The same observation on a coach's unshared sticky note probably is not. Build your health-office workflow so protected records land in the system of record—not in scattered notes.
FERPA vs. HIPAA: Which Privacy Rule Applies?
Parents and even school staff frequently assume HIPAA governs student health data because it's medical information. That assumption is usually wrong.
The joint guidance from the Department of Education and HHS clarifies that records maintained by a school, or by a party acting for the school, are generally covered by FERPA — not HIPAA's covered-entity framework.
HIPAA typically applies to a different set of organizations: healthcare providers, health plans, and clearinghouses that electronically transmit protected health information for standard transactions.
Key Questions to Ask
Instead of defaulting to a "FERPA or HIPAA" either/or framing, districts should ask:
- Who controls the record? School-maintained records generally fall under FERPA.
- Why was it created? A form used for school athletics eligibility differs from a record created by an outside clinician for treatment purposes.
- Who maintains it? A vendor acting for the school inherits FERPA obligations for that data.
- What disclosure is being considered? The applicable rule shapes what consent or exception is required.
Other laws layer on top of this analysis. Additional obligations can come from:
- State student privacy statutes
- Disability-related confidentiality rules (including those tied to IDEA)
- Public health reporting requirements
- District policy
A district's compliance approach needs to account for all of them, not just the federal baseline.
When Schools Can Share Student Health Information
The default rule is restrictive: schools shouldn't disclose personally identifiable information from education records without valid consent, unless a FERPA exception applies.
Consent Requirements
Valid written consent must:
- Identify the specific records or information being disclosed
- State the purpose of the disclosure
- Name the recipient
- Come from the appropriate parent or eligible student
- Be retained according to district recordkeeping policy
School Officials and Legitimate Educational Interest
Schools can disclose records without consent to school officials, including contracted vendors, who have a legitimate educational interest in the information. Common examples include:
- A nurse sharing medication instructions with a classroom aide
- An administrator reviewing documentation to arrange student support
- A platform processing records for an approved school function
Access must stay limited to what each role actually needs.
Emergency Disclosures
Health or safety emergencies permit disclosure to appropriate parties when the information is necessary to protect the student or others. Schools should confirm a genuine, articulable threat, share only with people who need to know, and document what was disclosed and why.
Before sharing anything, run through this sequence:
- Identify the specific record involved
- Verify the requester's identity and authority
- Establish the legal or policy basis for disclosure
- Disclose only what's appropriate to the request
- Document the decision and rationale
Directory Information
Designating basic details like name or grade level as "directory information" does not make health details freely shareable. Combining seemingly harmless data points can still re-identify a student, so treat routine disclosures with the same care.
Safeguards for FERPA-Protected Health Records
FERPA doesn't specify exact security controls schools must adopt. The Department of Education's data security guidance directs institutions to take "appropriate" steps. That flexibility puts real weight on district judgment.
Administrative and Technical Layers
Strong programs typically combine:
- Administrative safeguards: written privacy policies, defined roles, annual notices, staff training, incident-response plans, and vendor agreements
- Technical safeguards: unique user accounts, role-based permissions, multifactor authentication, encryption in transit and at rest, audit logs, and timely account deprovisioning
- Workflow safeguards: structured documentation, medication expiration tracking, controlled parent notifications, and separation of draft vs. finalized records
Platforms like MyCabinet School Health support this structure by centralizing records, applying role-based access, and maintaining audit trails so nurses can track who viewed what and when. Using any platform does not automatically make a district compliant. Configuration choices, staff practices, vendor contracts, and district governance still carry the weight.
When Safeguards Fail
Weak access controls and delayed response are not theoretical risks. In December 2025, the FTC took action against an education technology provider after a breach exposed data for more than 10 million students, including medical diagnoses. The complaint cited inadequate access controls, plain-text storage of sensitive data, and notification delays of nearly two years for some districts. The remedy required a full information-security program overhaul and a public data-retention schedule.
That case shows what happens when safeguards are treated as optional. A breach-response plan should:
- Contain access immediately and preserve logs
- Notify designated privacy and security staff
- Assess legal obligations and correct permissions
- Document every step as it happens
Districts should also review on a set cadence:
- Who can view health records
- What data gets exported
- Which integrations remain active
- Whether retained records are still necessary
A Practical FERPA Student Health Information Compliance Checklist
Before evaluating or adjusting school-health technology, map the full data journey: from parent form submission or nurse entry through storage, sharing, notifications, exports, and eventual deletion or archival.
Core checklist items:
- Record classification (which documents qualify as education records)
- Consent and exception tracking for each disclosure type
- Access permissions tied to specific roles, not blanket accounts
- Vendor oversight, including written data-use agreements
- Secure communication channels for parent-facing messages
- A defined process for parent access requests and amendments
- Retention schedules with clear archival or deletion timelines
- An incident-response plan ready before an incident occurs
When evaluating school-health technology, ask:
- Does it support role-based access and audit trails?
- Can families upload documents securely?
- Is parent access controlled and one-way where appropriate?
- Does it track medication expirations and dosage details?
- Does it offer export and retention controls that match district policy?
Assign clear responsibility so nurses, IT, vendors, and families each own defined tasks. That keeps privacy decisions consistent across every school building in the district, not just the ones with the most experienced staff.
Frequently Asked Questions
Should I say yes or no to FERPA?
FERPA is a federal privacy law schools must follow. Each access request or disclosure is evaluated against the applicable rule or exception, not handled as a simple yes-or-no opt-in.
What qualifies as an educational record under FERPA?
An education record directly relates to a student and is maintained by the school or someone acting for it, such as a nurse's medication log kept in the official student-health file.
What cannot be shared under FERPA?
Schools generally cannot disclose personally identifiable information from education records without valid consent or an applicable exception. Limited exceptions include documented health or safety emergencies and certain authorized school purposes.
How does FERPA apply to school nurse records?
Nurse records maintained as part of the school's official student-health program often qualify as education records. Districts should confirm treatment of specific records under current federal and state guidance.
Can a school share student health information with a parent?
Parents and eligible students generally have the right to access their child's education records, subject to identity verification and the district's established request process. After age 18, those rights typically shift to the student.
Can schools use a third-party platform to store student health information?
Yes, provided the vendor operates under a written agreement defining permitted use, retention, and redisclosure limits. The district remains responsible for configuration, oversight, and role-based access controls.
