Introduction
A single student's health file might include a nurse visit note, a medication authorization form, an immunization record, a screening result, and an emergency action plan. Each piece gets created in a different place, by a different person, at a different time.
Keeping that information accessible to the right staff while blocking unnecessary disclosure is where many districts struggle. Locking files in a cabinet or dropping them into a shared cloud folder isn't a compliance strategy. Real FERPA compliance requires:
- Record classification
- Role-based access
- Controlled sharing
- Audit trails
- Clear retention rules
This article breaks down how FERPA applies to school-maintained health records, what secure storage actually requires, and how a purpose-built school health platform can support safer daily workflows for nurses, administrators, and families.
Key Takeaways
- FERPA covers student-identifying education records maintained by the school or anyone acting on its behalf
- Secure storage requires least-privilege access, identity verification, audit trails, and documented retention—not encryption alone
- No single federal retention period exists; districts must check state, special-education, and litigation-hold requirements
- Purpose-built school health technology helps nurses safeguard records while handling forms, medications, and parent communication
What FERPA Means for K-12 Student Health Data
FERPA's definition of an "education record" comes down to two questions: does the information directly relate to a student, and is it maintained by the school or a party acting for the school? If both are true, it's generally covered under FERPA's definitions in 34 CFR 99.3.
For school health offices, that typically includes:
- Nurse visit documentation
- Medication authorizations and administration logs
- Immunization records
- Screening results (vision, hearing, scoliosis)
- Emergency action plans
- Parent-submitted health forms
- Records of services delivered through the school
Classification Depends on Context, Not Just Content
Not every scrap of paper mentioning a student becomes an education record. A nurse's personal note kept solely for her own memory, never shared with another staff member, generally falls outside FERPA's scope. The moment that note gets incorporated into a student's file or shared with another employee, it's a different story.
Parent and Student Rights
Parents and eligible students can:
- Inspect and review the records
- Request correction of information they believe is inaccurate or misleading
- Control disclosure of personally identifiable information, subject to FERPA's listed exceptions
When a student turns 18 or enrolls in a postsecondary institution, these rights transfer from parent to student. Schools should confirm the specific circumstances rather than assuming a blanket rule applies.
FERPA and HIPAA Aren't Automatically Interchangeable
Whether FERPA or HIPAA governs a specific health record depends on the entity, the record type, and the service involved. According to joint guidance from HHS and the Department of Education, student health records maintained by a school nurse acting on behalf of the school are generally FERPA records, not HIPAA records.
A healthcare provider not acting for the school may fall under different rules entirely. Unusual cases deserve a look from district counsel, not a guess.
How those records are stored and who can access them also shapes classification in practice. A platform like MyCabinet School Health documents health office visits, medication administration, care plans, and emergency action plans in one system and can support this work. No software replaces district policy, legal review, and staff training.
How Schools Should Store Student Health Data Securely
Technical safeguards only protect student health data when every school applies them the same way. The Privacy Technical Assistance Center's data security checklist lists the core controls every district should have in place.
Digital safeguards should include:
- Unique user accounts with strong authentication
- Role-based permissions built on least-privilege access
- Encryption for data in transit and at rest
- Session timeout limits
- Restrictions on unauthorized export or download
- Secure, tested backups
Match Access to Roles, Not Job Titles
A district-wide "everyone sees everything" approach creates unnecessary risk. Nurses, administrators, teachers, counselors, office staff, parents, and vendors each need different visibility levels based on legitimate educational interest.
MyCabinet School Health applies this directly: parents see only their own child's information, nurses and approved staff see only what's needed for care, and the technical support team accesses records only when required for system maintenance, under strict controls.
Why Audit Trails Aren't Optional
Every access, edit, export, and disclosure should generate a log entry. When a parent asks how a medication record was shared, or auditors request proof of compliance, that log is what you produce. MyCabinet's audit logs and activity records are built to support that level of accountability.
Paper Records Still Need Physical Controls
Most districts still handle some paper. That means:
- Locked cabinets or rooms with limited key or badge access
- Clean-desk practices in health offices
- Secure transport procedures between buildings
- Documented destruction once records are eligible for disposal
Secure Intake Matters as Much as Storage
Storage controls fail if health data arrives through weak channels. Email wasn't built for medication details or diagnosis information, and unencrypted messages create exposure you can avoid.
Authenticated parent portals with identity verification close that gap. MyCabinet's account activation, for example, requires an activation code plus a second verification code sent to the same verified email. Only the enrolling parent gets access to the child's records.
Building a FERPA-Aligned Student Health Records Workflow
Storage is only half the equation. Districts also need a repeatable process for how health information moves through the system.
Start With a Data Inventory
Before building workflows, map out:
- What types of health information the district creates or receives
- Where each record type lives
- Who uses it and how it's shared
- Which policy or law governs its retention
Define Access and Disclosure Rules
An effective process spells out legitimate educational interest, required consent elements, identity verification steps, and approved recipients, plus what gets logged for every release. Under 34 CFR 99.31, disclosure without prior consent is permitted only under specific listed conditions, such as:
- Sharing with school officials who have legitimate educational interests
- Transferring records to a school where the student intends to enroll
- Certain authorized audits or evaluations
- Health or safety emergencies involving an articulable and significant threat
These exceptions aren't automatic. Districts should route unusual disclosure requests through compliance review rather than assuming an exception applies.
Build Around the Actual Health Lifecycle
A workflow that mirrors how health information really moves looks like this:
- Parent submits a form through a secure portal
- Nurse reviews the submission for completeness
- Nurse approves or rejects, with the decision logged
- Approved documents attach directly to the student profile
- Visit documentation, medication tracking, and follow-ups happen inside the same record
- Expiration reminders and parent notifications trigger automatically
MyCabinet's Nurse Portal handles this exact sequence: parents upload forms, nurses review and accept them inside the system, and approved documents attach to the student record without a separate filing step.
Correct Records, Then Manage Retention
When a parent requests a correction:
- Authenticate the requester's identity
- Preserve the original record and its audit history
- Route the request through the district's established process
- Document the final decision
Retention is a separate control from where files are stored. FERPA doesn't set a universal retention period for education records, so districts need a schedule based on state law, district policy, and any special-education, medical, or litigation-hold requirements that apply.
When records reach the end of their retention period:
- Review them against the approved schedule
- Confirm no hold applies
- Obtain authorization
- Securely destroy both paper and electronic copies
- Retain proof of disposition
What to Look for in a School Health Data Platform
Not every EHR built for hospitals or clinics translates well into a school health office. The workflow is different, and the security expectations are non-negotiable.
A buyer's checklist should cover:
- Role-based access controls and audit trails
- Secure, authenticated parent access
- Digital health-form intake with nurse review and approval
- Medication oversight, including dosage tracking and expiration alerts
- Configurable workflows for visits, screenings, and follow-ups
- Documented backup and vendor security practices
- Reporting that supports state and district compliance needs
Workflow Fit Matters as Much as Storage
A platform that stores records securely but still leaves nurses toggling between spreadsheets, fax machines, and binders hasn't solved the actual problem. MyCabinet School Health organizes incomplete visits, recheck visits, medication reminders, and screening tasks into a single task list, so nothing gets tracked on paper on the side.
How MyCabinet School Health Fits the Picture
Those checklist items are easier to meet when storage, nurse workflow, and parent access live in one system. MyCabinet School Health connects a Nurse Portal, Parent App, and Parent Web Portal so records and daily tasks stay aligned.
Capabilities that map directly to the criteria above include:
- Controlled one-way parent notifications for clinic visits and medication expirations
- Digital health-form collection with in-system nurse review and approval
- Medication tracking with dosage visibility and automated expiration alerts
- Role-based access and audit trails across nurse and parent touchpoints
MyCabinet identifies its platform as FERPA compliant, HIPAA compliant, and AICPA SOC 2 Certified. Certification covers the technology. Schools still configure access correctly, train staff, and maintain their own compliant policies.
When you evaluate vendors, weigh secure storage and compliance posture alongside whether the platform removes side processes—paper forms, faxes, and spreadsheet tracking—rather than sitting beside them. MyCabinet School Health is built around that connected workflow.
Frequently Asked Questions
What protects the confidentiality of student records?
A combination of FERPA-aligned access and disclosure controls, least-privilege permissions, authentication, encryption, audit trails, and staff training. Schools protect records when these controls work together, not when any one safeguard stands alone.
What are the exceptions to FERPA?
Common exceptions include disclosures to school officials with legitimate educational interest, transfers to another school, certain audits or evaluations, and health or safety emergencies. Always verify the exact conditions and documentation requirements before relying on an exception.
What is not considered an education record?
Not every document mentioning a student qualifies. A teacher's sole-possession note kept only as a personal memory aid, or an observation never incorporated into the official file, typically falls outside FERPA's definition. How the record is maintained determines its status.
