That creates real risk. Whether a district falls under HIPAA, FERPA, or both, mishandled student health data means breach exposure, improper disclosures, and hours of administrative cleanup nobody has time for.
This article breaks down what compliant storage actually requires, where HIPAA and FERPA diverge, the must-have features for any platform you're evaluating, and how purpose-built tools like MyCabinet School Health address these gaps.
Key Takeaways
- Most K-12 health records fall under FERPA, not HIPAA (unless the school bills insurance)
- Compliant storage needs encryption, role-based access, audit trails, and parent controls
- Retention varies by state; some districts keep records 8+ years after last visit
- Purpose-built school health platforms cut risk vs. spreadsheets, paper, or generic drives
Understanding HIPAA vs. FERPA for K-12 Student Health Data
Here's the confusion most administrators run into: they assume "health records" automatically means HIPAA. It doesn't. Not in a school setting.
FERPA covers records maintained by a school as part of a student's education record, including health data collected by school nurses.
According to the 2019 joint guidance from the U.S. Department of Education and HHS, most elementary and secondary schools aren't HIPAA-covered entities. Their health staff typically don't conduct HIPAA-covered electronic transactions, such as billing a health plan.
The FERPA "School Official" Exception
Districts can share student health data with nurses, counselors, and administrators — and even outside vendors — without separate parental consent under FERPA's school-official exception. This applies only when the vendor:
- Performs a service the school would otherwise handle with its own employees
- Stays under the district's direct control regarding use and maintenance of records
- Uses the data solely for the disclosed purpose (no improper redisclosure)
- Meets the district's legitimate-educational-interest criteria
When HIPAA Enters the Picture
Districts operating school-based health centers that bill Medicaid or private insurance electronically may trigger direct HIPAA obligations. That creates dual compliance: FERPA for the education record, HIPAA for the billing-related health information. Districts should evaluate this record by record, not assume "school-based" automatically resolves the question.
Even where FERPA is the primary law, HIPAA-style safeguards (encryption, access controls, audit logs) remain best practice. Both frameworks exist to protect the same sensitive information; the labels just determine which legal remedy applies if something goes wrong.
HHS issued a proposed 2025 update to the HIPAA Security Rule that would tighten multi-factor authentication, encryption, asset inventories, and disaster recovery. It is not final law yet, but it is a useful benchmark when evaluating any health IT vendor.
That same bar is why platforms like MyCabinet School Health align with FERPA's education-record framework while maintaining HIPAA compliance and SOC 2 Type II certification, so districts stay covered regardless of which regulatory path applies.
Core Requirements for Compliant Storage of Student Health Records
The current HIPAA Security Rule requires administrative, physical, and technical safeguards to protect health data confidentiality and integrity. These same categories translate directly into FERPA-governed environments as best practice.
Administrative Safeguards
- Written policies defining who can access student health data and why
- Regular staff training on privacy obligations
- A designated privacy or security officer within the district
Technical Safeguards
- Encryption at rest and in transit
- Unique user IDs (never shared logins)
- Role-based access control tied to job function
- Automatic session logoff for nurse portals
Physical Safeguards
- Secured devices in the health office
- Controlled access to computers holding student records
- Locked storage for paper files and controlled handling of portable media Audit logging is required for defensibility. Tracking who viewed or edited an immunization record, medication log, or visit note is what makes a district prepared for an OCR complaint or state audit. MyCabinet builds audit trails into its structured visit documentation and reporting tools, giving administrators centralized dashboards for oversight. Verizon's 2025 Data Breach Investigations Report found miscellaneous errors accounted for 29% of education-sector breaches, with misdelivery alone responsible for 17%. Most incidents stem from misaddressed emails and unsecured spreadsheets, not sophisticated hacks. Any time a district hands student health data to a third-party vendor, a Business Associate Agreement (or equivalent data-sharing agreement under FERPA) is required. That agreement should cover purpose limitation, breach notification, subcontractor terms, and data return or deletion obligations.
How Long Should Student Health Records Be Kept?
HIPAA doesn't set a universal retention period for clinical records. It does require Security Rule documentation (policies, risk assessments, training logs) to be kept a minimum of six years under 45 CFR 164.316.
Student health records themselves follow state education retention schedules, which vary widely:
| State | Record Type | Retention Period |
|---|---|---|
| Washington | Health services / medical records | 8 years after last service |
| Texas | Cumulative health card | Withdrawal + 7 years, or age 21 |
| Missouri | Health records, treatments, evaluations | Until student turns 23 |
Immunization and medication records sometimes carry separate, longer retention rules. Districts should check their state's specific K-12 schedule and consult legal counsel rather than assume.
Digital platforms make long-term retention far more manageable than paper files, which routinely go missing when students transfer schools or districts consolidate offices.
Choosing a HIPAA/FERPA-Aligned School Health Platform
Not every "cloud-based" health tool is built for schools. Evaluate any platform against these criteria:
- Encryption and access control — protects data at rest and in transit, with role-based permissions
- Audit trails — documented history of who accessed or changed a record
- Controlled parent communication — visibility without unmanaged messaging
- Secure document workflows — upload, review, and approval in one system
Those controls matter most when the platform is built around nurse workflow, not static storage.
Workflow-First Design Beats Simple Storage
School nurses don't need another filing cabinet. They need a system that flags what's incomplete. MyCabinet's Nurse Portal organizes:
- Incomplete visits awaiting documentation
- Recheck visits requiring follow-up
- Medication expirations needing parent outreach
- Pending screening tasks
Color-coded task lists let nurses triage at a glance instead of hunting through binders or spreadsheets.
A Connected Parent Experience
Families get visibility into clinic visits, medications, and expiring health forms through MyCabinet's Parent App and Parent Web Portal, without losing data control. Forms move through a closed loop: parents upload documents digitally, nurses review and approve them in-system, and approved records attach to the student profile.
District dashboards make gaps obvious. One student might sit at 36% form completion with medications pending; another at 70% with an asthma action plan still due. That transparency replaces paper packets and email guesswork.
Cobb County School District Superintendent Chris Ragsdale described the shift during a 2025 school board meeting: the platform "digitized and makes documentation easier." He pointed to parents seeing when their child was seen and given medication as "a win for the parents and a win for the district."
Common Storage Mistakes School Districts Should Avoid
Even well-intentioned districts fall into familiar traps:
- Shared spreadsheets and personal devices. No encryption, no access controls, no audit trail. A single lost laptop becomes a reportable incident.
- Generic cloud storage without agreements. Google Drive or Dropbox folders might feel secure, but without a signed data-protection agreement and folder-level permissions, they don't meet HIPAA or FERPA expectations.
- Fragmented systems. Immunization records in one tool, medication logs in another, and visit notes in a third leave nothing aligned for an audit, and leave nurses without the full picture in an emergency.
School health documentation has historically lived in binders and disconnected spreadsheets. Consolidating into one auditable system strengthens compliance and lets a nurse pull a complete student record in seconds instead of toggling between tools.
Frequently Asked Questions
What are the requirements for HIPAA-compliant data storage?
Compliant storage needs administrative safeguards (policies, training), physical safeguards (secured devices, controlled facility access), and technical safeguards (encryption, access controls, audit logs). The same principles apply to school health data even when FERPA is the primary framework.
How long should HIPAA records be kept?
HIPAA requires Security Rule documentation to be retained for a minimum of six years. Student health record retention usually follows state K–12 schedules, which can run longer—sometimes until a student turns 21 or 23.
What is the new HIPAA rule in 2026?
HHS proposed a 2025 Security Rule update requiring multi-factor authentication, stronger encryption, asset inventories, and tested disaster recovery plans. It is not final law yet, but it shows where compliance expectations are headed for schools and the health IT systems they use.
Does FERPA or HIPAA apply to school nurse records?
FERPA generally applies to records maintained by school nurses as part of the education record. HIPAA may also apply if the school or a school-based health center bills insurance electronically as a covered healthcare provider.
Can parents access their child's school health records digitally?
Yes. FERPA gives parents the right to review education records, and platforms like MyCabinet's Parent App and Parent Web Portal let families see clinic visits, medications, and pending health forms securely.
What happens if a school district experiences a student health data breach?
Districts face state-specific breach notification rules; New York, for example, requires reporting within 60 days of discovery. Breaches also erode family trust and can trigger costly incident response, audits, and long-term reputation harm.
