Here's the core distinction that trips people up: health information kept by a school or school nurse is often an education record protected by FERPA, while records kept by an outside healthcare provider may fall under different rules entirely. Confusing the two leads to real compliance risk.
This article breaks down what qualifies as a protected health record, how consent and disclosure exceptions work, how FERPA differs from HIPAA, and what school health teams can do to build safer, more compliant workflows.
Key Takeaways
- FERPA protects personally identifiable health information maintained in school education records.
- Parents hold FERPA rights for minors; rights transfer at age 18 or college enrollment.
- Schools may share student health records without consent only under a FERPA exception.
- Role-based access, audit trails, and logged disclosures keep school health operations compliant.
What Counts as a Student Health Record Under FERPA?
An education record under FERPA hinges on two conditions: the record must directly relate to a student, and it must be maintained by the school, district, or a party acting on the school's behalf. Meet both, and it's generally protected. Miss either one, and different rules may apply.
The Department of Education's 2023 guidance confirms that student health records maintained by schools or their agents fall within this definition.
Records That Typically Qualify
Most school-maintained health documentation counts as an education record, including:
- Immunization records and health screening results
- Medication authorization forms and administration logs
- Allergy information and emergency care plans
- Nurse visit documentation and chronic-condition notes
- Medical forms submitted through school portals or scanned into student files
Format doesn't determine protection. Paper files, scanned PDFs, portal submissions, and emails incorporated into a student's official record can all qualify if they meet the two-part test above.
Records Treated Differently
A few categories fall outside typical FERPA protection:
- A nurse's personal notes kept solely in their own possession and never shared
- Law-enforcement-unit records maintained by a school's police or security office
- Records maintained by an outside provider not acting on the school's behalf
That last point matters. If a public health nurse administers vaccines on school grounds without acting as the school's agent, those records may not be FERPA-protected at all.
Always verify current facts against Department of Education guidance before making disclosure decisions. A conversation overheard in a hallway isn't automatically a "record," but a document filed in a student's health folder usually is.
FERPA vs. HIPAA and Other Privacy Requirements
A common misconception: HIPAA automatically covers all student health information. It doesn't, and in most K-12 settings, it doesn't even apply.
The joint guidance from the Department of Education and Department of Health and Human Services addresses this directly. According to the 2019 joint guidance on FERPA and HIPAA, most elementary and secondary schools aren't HIPAA-covered entities.
Even when schools handle healthcare data, that information typically lives in FERPA education records, not HIPAA-protected health information.
Why FERPA Usually Governs
- FERPA covers education records maintained by covered schools and districts
- HIPAA generally applies to covered healthcare providers, health plans, and clearinghouses conducting covered transactions
- A provider acting for the school (even if not a school employee) still creates FERPA records
- A provider acting independently of the school (serving students directly) may create HIPAA-governed records instead
The determining factor isn't the type of information. It's who maintains it, why it was collected, and how it's used.
FERPA is rarely the only rule in play. Schools also work with public health agencies, contracted therapists, and third-party vendors, each under different obligations. State student privacy laws, disability confidentiality rules (like IDEA), and district policies add more layers quickly.
This section provides general information, not legal advice. Schools facing fact-specific questions should consult qualified counsel and current U.S. Department of Education guidance.
FERPA Rights, Consent, and Disclosure Exceptions
FERPA does two things: it gives parents and eligible students the right to inspect and correct education records, and it limits disclosure of personally identifiable information unless an exception applies.
Inspection, Amendment, and the 45-Day Rule
Parents of minors and eligible students (age 18+ or enrolled in postsecondary education) can:
- Inspect and review education records, including health records
- Request amendment of information they believe is inaccurate or misleading
- Request a hearing if the school denies the amendment request
Schools generally must comply with inspection requests within 45 days of receiving them, per 34 CFR 99.10. Copying fees and access procedures may vary by district policy, so check local rules before assuming a specific process applies.
Written Consent Requirements
When no exception applies, schools need signed, dated written consent before disclosing personally identifiable health information. That consent should specify:
- The records covered by the disclosure
- The purpose of the disclosure
- The recipient or class of recipients
Electronic consent is acceptable, but the system must authenticate the source and clearly indicate approval.
When Schools May Disclose Without Consent
A handful of exceptions let schools share information without prior written consent:
- Legitimate educational interest — a nurse, administrator, or staff member needs the information to support an approved care plan or respond to documented medical needs
- Health or safety emergency — an articulable, significant threat justifies disclosure to anyone whose knowledge is necessary to protect the student or others
- Transfer or enrollment — sharing with another school where the student is enrolling
- Directory information — but health details should never be casually classified this way; schools must follow their own notice and opt-out procedures
Access should match need, not curiosity. A staff member's general interest in a student isn't the same as a documented, legitimate educational reason to view a full health record.
Before any disclosure, staff should work through this sequence:
- Identify the record
- Identify the requester
- Confirm the purpose
- Check for consent or a valid exception
- Share only what's necessary
- Log the decision
This applies whether the disclosure happens verbally, by email, through a portal, or on a shared screen. The channel doesn't change the obligation.
How Schools Can Protect Student Health Information
Most FERPA violations aren't dramatic data breaches. They're smaller, avoidable moments: a form sent to the wrong recipient, a record left open on an unattended screen, a hallway conversation overheard by the wrong person.
Where Privacy Breaks Down
Common risk patterns include:
- Discussing a diagnosis or medication where others can overhear
- Sending health forms to the wrong staff member or parent
- Leaving records visible on unattended desks or screens
- Allowing staff to browse records without a documented need
- Using personal email, text messages, or shared spreadsheets as informal workarounds
The Department of Education's own guidance on unauthorized disclosure points to exactly these kinds of inadvertent security lapses and unsecured paper records as recurring risk areas.
Building a Secure Workflow
Reducing this risk means moving away from ad hoc processes and toward structured controls:
- Restrict access by role so nurses, administrators, teachers, and vendors see only what their documented duties require
- Log every record access with who viewed it, when, and why
- Replace paper, fax, and email attachments with authenticated digital workflows
- Train staff on realistic scenarios such as misdirected emails, unlocked screens, and hallway conversations
This is where purpose-built systems earn their keep. MyCabinet School Health, for example, centralizes student visits, medications, allergies, and care plans in a single platform with role-based permissions and audit trails, so nurses aren't juggling paper folders and spreadsheets.
Its digital health-form collection lets parents upload immunization and medication forms directly. Nurses review and approve them inside the system, and approved documents attach straight to the student's record.
Technology like this supports a compliant workflow. It doesn't replace the policy decisions, staff training, and legal review that FERPA compliance still requires.
Practical FERPA Implementation Checklist for School Health Teams
Building (or auditing) a compliant school health program comes down to a few concrete steps:
- Inventory your records — document every system, custodian, retention period, and approved disclosure purpose for student health data
- Write down your workflows — consent, access requests, amendments, emergency disclosures, transfers, and vendor access should all have documented procedures, not tribal knowledge
- Apply least-privilege access — strong authentication, secure file exchange, and regular permission reviews when staff roles change
- Train regularly, not once — nurses, office staff, teachers, substitutes, and contractors all need refreshers using real scenarios
- Vet every vendor — confirm contracts address data-use limits, confidentiality, audit capability, and deletion or retention terms
Vendor choices should reinforce those same limits. MyCabinet's digital health-form collection and controlled, one-way parent notifications cut manual follow-up and reduce unnecessary sharing of sensitive details.
No platform independently guarantees FERPA compliance. It still depends on the policies, training, and oversight your district builds around it.
Frequently Asked Questions
How many days must a school comply with a student's request to view their records?
Schools generally must comply within 45 days of receiving the request, per federal FERPA regulations. Districts should also follow their own documented request procedures alongside this timeframe.
What educational records can be released without student consent?
Major exceptions include legitimate educational interest, transfer to an intended school, certain audits or evaluations, court orders, and health or safety emergencies. Each exception has specific conditions that must be met.
What are the privacy rules for students under FERPA?
Parents hold rights for minor students, including access and amendment requests; those rights transfer to the student at 18 or upon postsecondary enrollment. Disclosure generally requires consent unless a specific exception applies.
What are considered educational records under FERPA?
Educational records are records that directly relate to a student and are maintained by the school or a party acting for it. This includes many school-maintained health records like immunization forms, medication logs, and nurse visit notes.
What is an example of a violation of student privacy?
Examples include sending a student's medication information to the wrong recipient or letting unauthorized staff browse a health record without a documented need. The appropriate response includes containing access, notifying the district's privacy contact, and documenting the incident.
