Add to this the confusion between HIPAA and FERPA, and it's easy to see why compliance mistakes happen. Many school health staff assume HIPAA governs everything with the word "health" in it. It doesn't.
This guide breaks down which law actually applies to your records, what documentation you're required to keep, and how to build a workflow that holds up to scrutiny.
Key Takeaways
- Most school health records fall under FERPA, not HIPAA, unless the school bills insurance electronically as a healthcare provider
- Compliant documentation needs standardized forms, defined retention periods, and controlled access—not ad-hoc processes
- Digital, purpose-built systems cut admin work and make audits simpler than paper or spreadsheets
Understanding HIPAA vs. FERPA in School Health Settings
Here's the rule most people get wrong: campus location doesn't determine which law applies. What matters is who controls the record and whether the provider meets HIPAA's covered-entity criteria.
According to joint guidance from HHS and the Department of Education, when a school nurse or staff member acting on the school's behalf creates a health record, that record is a FERPA "education record": not HIPAA-protected PHI. This holds true even though the record documents a medical condition.
When HIPAA Actually Applies
There's a narrow exception. If a school-based health center:
- Operates as a separate entity from the school (not employed or contracted to act for it), and
- Conducts a HIPAA transaction electronically, such as billing insurance
When both conditions are met, that provider may be a HIPAA covered entity, and HIPAA governs those specific records.
What FERPA Requires Instead
For the vast majority of school nurses, FERPA sets the rules:
- Written consent specifying the exact records disclosed, the purpose, and the recipient — a generic release form isn't enough
- Inspection and amendment rights for parents/eligible students, with requests answered within 45 days
- A disclosure log tracking every request for or release of personally identifiable information, kept for as long as the record exists
Even where HIPAA doesn't technically apply, HIPAA-grade security discipline on every student health record is still good practice. It protects families and protects your district if the legal line ever gets blurry.
What Counts as School Health Documentation
School health records aren't one uniform file type. Common categories include:
- Immunization records
- Medication authorization forms
- Health screenings (vision, hearing, scoliosis)
- Individualized health plans (IHPs) for chronic conditions
- Incident and clinic visit logs
- Parental consent forms
Document type drives retention and disclosure rules under state and district policy. Texas, for example, keeps cumulative health records until the student's 21st birthday or seven years after withdrawal, whichever comes later. Florida uses a flat seven-year clock from the last student contact.
There's no single national standard, so check your state's records schedule before you lock in a retention policy.
Required Elements of Compliant School Health Records
Regardless of which law technically governs your records, a defensible school health file should include:
- Student identifying information — name, DOB, guardian, and emergency contacts
- Purpose of each visit or intervention — date, time, staff member, and reason for the visit
- Medication details — dosage, frequency, administration log, and expiration tracking
- Parental authorization — signed and dated consent for treatment, medication, or disclosure
- Audit trail — a record of who accessed or modified the file, and when
Audit trails are often the weakest link in paper files and shared drives. Retention is another frequent gap: periods are typically tied to state education record laws, not HIPAA's six-year minimum. HHS itself confirms the Privacy Rule doesn't set a general medical-record retention period—that's a state law question, and states differ significantly.
Building a Compliant Documentation Workflow
Good documentation comes down to consistency, not more paperwork.
Standardize Intake
Whether a form arrives on paper, through a portal, or via a parent app, it should follow the same review-and-approval path. Inconsistent intake is where forms get lost, duplicated, or filed against the wrong student.
Use Structured Visit Types
Free-text nurse notes vary wildly in quality and completeness. Structured visit types and task lists push nurses toward consistent documentation instead of relying on memory or shorthand.
Control Access by Role
Role-based permissions ensure only authorized staff can view or edit sensitive records. Not every staff member needs to see a student's medication history, and FERPA's "legitimate educational interest" standard backs that up.
Enable One-Way Parent Notifications
Parents need visibility into medication expirations and clinic visits, but that doesn't require an open messaging channel. A one-way alert (for example, "your child's EpiPen expires in 14 days") gives families what they need without creating a support inbox.
This is the workflow gap MyCabinet School Health was built to close. The platform centralizes digital form collection, nurse review and approval, and student-profile documentation in place of fragile paper trails and spreadsheets.
Cobb County School District is one district using this approach. Parents submit paperwork electronically, and Superintendent Chris Ragsdale has described the shift as making documentation "easier." Families can see when their child was seen and given medication, without nurses fielding a flood of follow-up calls.
Common Compliance Mistakes to Avoid
Even well-intentioned districts fall into predictable traps:
- Shared spreadsheets and unsecured email threads. Convenient, but they lack access controls, audit trails, or encryption — a liability if a device is lost or an account is compromised.
- Missed expiration tracking. Medication authorizations and consent forms lapse silently when no one's watching the clock, leaving students without valid authorization.
- Mixing FERPA and HIPAA data without segregation. When a HIPAA-covered health center sits alongside standard school nursing records, blending systems muddies who can access what—and under which rule.
State guidance flags the same pattern in another form. Iowa's Department of Education has called out personal devices used to text or download student health information—efficient in the moment, but a clear exposure risk.
Frequently Asked Questions
What is an example of HIPAA-compliant documentation?
A signed authorization form that lists the individual's details, disclosure purpose, recipient, expiration date, and an access audit trail. In schools, a completed medication authorization form with that same detail is the closest equivalent.
What are the three main rules of HIPAA?
The Privacy Rule, Security Rule, and Breach Notification Rule. Most K-12 school health records aren't governed by these, since they typically fall under FERPA instead.
How do I send HIPAA-compliant documentation?
Use secure, encrypted transmission methods, never standard email or fax. If you're working with a third-party platform that handles PHI, you'll need a Business Associate Agreement in place.
Does FERPA or HIPAA apply to my school's health records?
If your school nurse or staff acting for the school creates the record, FERPA applies. HIPAA only comes into play if a separate provider bills insurance electronically as its own covered entity.
How long should schools retain student health records?
Retention is typically governed by state education record laws, not HIPAA's six-year minimum. Some states, like Texas, tie it to a student's age; others use a flat number of years after last contact. Check your state's schedule directly.
