Introduction
A student tells the school counselor they've been having suicidal thoughts. A parent calls asking why the nurse won't share details about a therapy referral. A school-based mental health provider needs to loop in an outside psychiatrist for medication management. Each moment asks the same question: what can actually be shared, with whom, and why?
Getting this wrong cuts both ways. Share too little, and a student in crisis falls through the cracks. Share too much, and you've violated a family's trust and possibly federal law.
This guide explains how the HIPAA Privacy Rule and FERPA apply to student mental health information in K-12 schools. It covers psychotherapy notes, school nurses and counselors, outside providers, and parent access.
The right answer depends on who holds the record, why it's being shared, the student's age, and what state law requires.
Key Takeaways
- School-held student records are usually governed by FERPA, not HIPAA
- HIPAA may still apply to outside providers, school-based health centers, or certain billing transactions
- Psychotherapy notes get extra protection and almost always require written authorization
- Emergency disclosures are permitted, not mandatory, and must be documented
- Share only what the recipient's role requires, and always keep a record of the decision
HIPAA vs. FERPA in School Settings
Here's the distinction that trips up most school staff:
- HIPAA regulates protected health information (PHI) held by covered entities and their business associates
- FERPA governs personally identifiable information in education records maintained by schools or districts
Most schools are not HIPAA covered entities. Employing a nurse, psychologist, or counselor doesn't automatically pull a school into HIPAA's jurisdiction. According to the joint HHS and Department of Education guidance on FERPA and HIPAA, in most K-12 cases HIPAA simply doesn't apply — either the school isn't a covered entity, or the health information lives only in a FERPA-protected education record.
The same type of information can fall under four different scenarios:
- School nurse clinic notes — usually a FERPA education record
- School counselor files — usually a FERPA education record
- Outside therapist treatment notes — HIPAA if the therapist is a covered entity, unless acting for the school
- Hospital discharge summaries — HIPAA until the school files its copy in the student's education record
That last shift matters. Once an outside HIPAA-covered provider sends records and the school incorporates them into the student's education file, the school's copy generally becomes a FERPA record. The hospital's original stays under HIPAA.
Questions Staff Should Ask Before Sharing
- Who created or maintains this record? Custody usually decides whether FERPA or HIPAA controls.
- What is the purpose of this disclosure? Purpose drives whether consent or an exception is required.
- Is consent required, or does an exception apply? Map the request to a specific permission path before releasing anything.
- Is a health or safety emergency in play? Emergency exceptions are narrow and should be documented.
- Does state law set a stricter standard? Follow the tighter rule when state privacy law goes beyond federal baseline.
FERPA is not open sharing, and “not HIPAA” does not mean “no privacy rules.” Confirm record custody and disclosure purpose first, then share only what the applicable framework allows.
When Schools May Share Mental Health Information
Coordinated care requires sharing something. The standard is still the minimum necessary: the right amount, to the right person, for the right reason.
Treatment coordination is the clearest permission. Under 45 CFR 164.506, a HIPAA-covered provider can disclose PHI to another provider for treatment without a separate authorization.
HHS applies that rule in school settings too: a covered provider may share a student's PHI with a school nurse or physician for treatment, without prior student or parent authorization.
That permission is not a green light to release a full mental health file. Limit the disclosure to what the recipient’s role requires:
- School nurse carrying out a safety plan: the plan details, not the full therapy transcript
- Teacher supporting a return-to-class plan: behavioral triggers, not diagnostic details
- Athletic trainer watching medication side effects: dosing information, not counseling notes
Consent, Authorization, and Minor Status
When formal authorization is required, state the information covered, the recipient, the purpose, and an expiration date. Requirements vary by state, so confirm current HHS guidance and your state rules before you draft forms.
Parent access adds another layer. Under HIPAA, a parent is generally the "personal representative" for an unemancipated minor and can access the child's PHI. But there are real exceptions:
- The minor legally consented to care on their own (state-dependent)
- A court directed the care independently of the parent
- The provider and minor agreed to confidentiality
- The provider believes the parent may pose a safety risk to the child
Access should stay limited inside the school as well. A student's mental health information should not move informally among staff without a treatment, safety, or administrative need to know.
A front-office assistant does not need clinical details to process an early dismissal.
Emergency Disclosures and Special Protections
Crisis situations are where "may disclose" and "must disclose" get confused most often — and the distinction matters.
Under 45 CFR 164.512(j), a covered entity may disclose PHI, in good faith, when necessary to prevent or lessen a serious and imminent threat to health or safety. The recipient has to be someone reasonably able to act on that threat — a parent, an emergency responder, law enforcement, or another provider. It's not a green light to tell everyone.
FERPA has a parallel provision. Under 34 CFR 99.36, schools can disclose education record information during a health or safety emergency to anyone whose knowledge is necessary to protect the student or others. Schools using this exception must document the specific threat and who received the information.
Neither law forces disclosure in every risky situation. Both permit it under specific conditions. State duty-to-warn statutes and mandated-reporting laws — not HIPAA or FERPA — usually determine when disclosure becomes mandatory, particularly for suspected abuse or neglect. Check your state's rules rather than assuming a single national standard applies.
When a student can't meaningfully consent or object — due to age, crisis state, or incapacity — providers use professional judgment to decide whether limited disclosure serves the student's best interest. Those judgment calls still need a clear record. Use the checklist below whenever an emergency disclosure is made.
Emergency Documentation Checklist
- What was observed or reported?
- Who made the disclosure decision?
- What specific information was shared?
- Who received it, and why were they appropriate?
- What time did the disclosure occur?
- What follow-up actions were taken?
Emergency permission is narrow. Outside a serious and imminent threat, mental health information often carries extra limits—such as psychotherapy notes under HIPAA and tighter consent rules for counseling records—so share the minimum necessary and follow the more protective standard when HIPAA, FERPA, and state law overlap.
What Records Are Covered and Which Receive Extra Protection
Not all mental health information sits in the same legal bucket. Diagnoses, symptoms, treatment plans, medication instructions, and progress summaries are typically part of the standard "designated record set" — accessible for treatment purposes under normal HIPAA rules.
Psychotherapy notes are different. Under 45 CFR 164.501, they're defined narrowly: a therapist's personal notes analyzing a counseling conversation, kept physically separate from the rest of the medical record. This definition excludes:
- Medication prescribing and monitoring
- Session start and stop times
- Treatment modalities and frequency
- Test results
- Diagnosis, prognosis, and treatment plan summaries
So a routine progress note isn't a psychotherapy note just because it touches on mental health. It has to be the therapist's separately maintained session analysis.
That separation carries real weight. Under 45 CFR 164.508, disclosing psychotherapy notes — even to another treating provider — generally requires a signed authorization. Narrow exceptions include:
- Legal defense
- Oversight activities
- Training
- Other legal requirements
- The same serious-threat provision covered above
HIPAA's right of access also doesn't extend to psychotherapy notes. A parent or student generally can't demand a copy of them the way they could request other treatment records.
A caution for school teams: state confidentiality laws, substance use disorder rules, and professional ethics codes can all layer additional protection on top of HIPAA and FERPA. Don't assume federal law sets the ceiling — check your state's requirements too.
Building Safer School Information-Sharing Workflows
Good intentions don't prevent bad disclosures. Written procedures do.
At minimum, schools need separate workflows for:
- Routine care coordination between school staff
- Parent requests for information
- Requests from outside providers
- Emergency disclosures
Each workflow should specify who can request, approve, send, and receive mental health information, and who documents the decision.
Technical Safeguards That Support Compliance
For electronic records, HIPAA's Security Rule (45 CFR 164.312) outlines specific technical safeguards:
- Access controls limited to authorized users
- Unique user credentials
- Audit controls that track system activity
- Transmission security
FERPA's school-official exception similarly requires "reasonable methods" to ensure staff only access records tied to their legitimate educational role.
This is where a lot of schools still lean on paper files, shared spreadsheets, and email threads, none of which hold up well against these standards. A school health EHR built specifically for this purpose can close that gap.
MyCabinet School Health, for instance, structures documentation around role-based access, audit trails, and controlled parent communication. Nurses can record what was shared, why, and with whom, without relying on fax machines or informal email chains.
That said, software supports policy. It doesn't replace legal review or staff judgment on any individual disclosure decision.
Vendor Evaluation Checklist
Before adopting any school health platform, confirm it addresses:
- HIPAA and FERPA alignment claims
- Access controls and audit logging
- Data retention policies
- Breach response procedures
- Parent permission settings
- Business Associate Agreement terms, where applicable
- District contract requirements
A Practical Decision Process for School Staff
When a disclosure question comes up, work through it in order:
- Identify the record type. Is this a school education record, a provider's HIPAA record, psychotherapy notes, or substance use disorder information?
- Identify the parties. Who's requesting it, who's receiving it, and what's the purpose? Has the student consented, objected, or are they unable to decide?
- Check the legal basis. Valid consent, treatment coordination, personal-representative rights, a safety exception, mandated reporting, or legal process?
- Limit and secure the disclosure. Share only what the recipient's role requires, use a secure channel, verify identity, and document the decision.
- Escalate uncertainty. When state law, minor-consent rules, psychotherapy notes, or imminent safety concerns are involved, loop in the district privacy officer or legal counsel.
Treat documentation as part of step four, not an afterthought. Platforms with built-in audit trails let administrators see what was disclosed, when, and to whom, which simplifies follow-up and lowers liability risk.
Frequently Asked Questions
What circumstances can mental health professionals break confidentiality?
Confidentiality can be limited by a serious and imminent safety threat, mandated reporting duties, legal requirements, incapacity, or another recognized exception. Only the information necessary for the situation should go to appropriate recipients.
How does HIPAA apply to mental health information in schools?
School-held education records are usually governed by FERPA, not HIPAA. HIPAA may apply to outside covered providers or certain business associates connected to school-based care. Check who maintains the record and what service is involved.
Can a school share a student's mental health information with a parent?
Generally yes, since parents typically hold personal-representative rights for minors. Exceptions exist for confidential minor consent, state law limits, and psychotherapy notes, which get separate protection from general treatment records.
Can schools share mental health information during a safety emergency?
Yes, both HIPAA and FERPA include emergency provisions allowing limited disclosure to prevent or lessen a serious, imminent threat. This still requires professional judgment, appropriate recipients, and documentation of what was shared and why.
Are psychotherapy notes treated differently from other mental health records?
Yes. Psychotherapy notes are the therapist's separately maintained session notes and generally require signed authorization for disclosure. Ordinary treatment records (diagnoses, medications, progress summaries) follow different, less restrictive rules.
