Introduction
A student's health information rarely stays in one place. It moves from the school nurse's office to administrators, from parents to healthcare providers, and increasingly through digital platforms that touch all three. A student's health information rarely stays in one place. It moves from the school nurse's office to administrators, from parents to healthcare providers, and increasingly through digital platforms that touch all three.
Many districts assume one privacy law covers all of it. That assumption is usually wrong.
HIPAA and FERPA serve different purposes, and the law that applies depends on the specific record, who holds it, and the context in which it was created. A vaccination record kept by a school nurse isn't automatically governed by the same rules as the same record sitting in a pediatrician's office.
This article breaks down how HIPAA and FERPA actually apply to K-12 school health data, where the common exceptions live, and how districts can build safer, more defensible health data workflows without guessing.
Key Takeaways
- FERPA generally governs health information a school maintains as part of a student's education record.
- HIPAA applies to covered healthcare entities and business associates, not automatically to every organization holding health data.
- Classify each record and disclosure scenario individually rather than assuming a blanket rule.
- Role-based access, documented consent, vendor oversight, and staff training all strengthen privacy in practice.
- Compliant technology supports these efforts but doesn't replace district policy, contracts, or legal review.
What HIPAA and FERPA Protect
What is FERPA?
FERPA (the Family Educational Rights and Privacy Act) is the federal law governing student education records at schools and institutions that receive funding through a U.S. Department of Education program. Under 34 CFR 99.3, an education record is any record directly related to a student and maintained by the school or a party acting on its behalf.
For parents and eligible students, FERPA grants specific, practical rights:
- Review education records maintained by the school
- Request amendments to inaccurate or misleading information
- Control disclosure of records, except where a defined exception applies
In a school health context, FERPA typically covers:
- Nurse visit logs
- Medication administration records
- Immunization data the school receives and keeps
- Health forms filed in the student's record
If a school nurse documents a visit in a student's chart, that entry is generally a FERPA education record, not a HIPAA record.
What is HIPAA?
HIPAA's Privacy Rule doesn't apply to every organization that touches health data. It applies to covered entities and their business associates.
Covered entities include:
- Health plans
- Healthcare clearinghouses
- Healthcare providers that transmit health information electronically in a standardized transaction
Business associates handle protected health information on a covered entity's behalf.
Per HHS guidance on covered entities and business associates, a business associate agreement is required whenever a covered entity outsources a function involving PHI, and business associates carry direct liability for certain HIPAA obligations.
Here's the nuance districts often miss: a healthcare provider's own record can remain subject to HIPAA even after information from that record is shared with the school. The provider's chart stays HIPAA-governed; the copy the school receives and files becomes part of the education record under FERPA. Two rules, same underlying facts, different documents.
Which Law Applies to a School Health Record?
Start with the general rule
A health record maintained by a school as part of a student's education record is generally governed by FERPA rather than HIPAA. That is how the federal joint guidance from HHS and the Department of Education frames the distinction.
Treat that as a starting point, not a final answer. You still need to check the specific institution, who holds the record, and how it was shared.
Apply the record-holder and purpose test
Ask five questions for any given record:
- Who created it?
- Who maintains it now?
- Why was it created?
- Is it integrated into the student's education record?
- Is the holder a HIPAA-covered entity?
The same student's flu shot information might be treated differently depending on whether it sits with the school nurse, an independent pediatrician, a school-operated clinic, or a hospital system. Same data, different custodian, different rule.
Cover important school health scenarios
These scenarios commonly cause misclassification:
- An independent immunization provider or public health nurse may keep the original record under HIPAA (if they are a covered entity), while the copy the school files becomes a FERPA education record.
- College health clinics and records for students 18 or older can fall out differently than K-12 cases. Do not treat age or setting as an automatic answer. Check current HHS and ED guidance for the specific situation.
- FERPA generally covers institutions that receive Department of Education funding. Many private and parochial K-12 schools do not, so they may fall outside FERPA. Separately assess whether the private school itself is a HIPAA-covered entity; the two determinations are independent.
Give readers a repeatable decision process
Instead of reworking this for every record, use a short checklist:
- Identify the record.
- Identify who holds it.
- Identify why it was created.
- Determine whether FERPA or HIPAA coverage applies.
- Document consent requirements or the permitted disclosure basis.
When a case doesn't fit neatly into this process, escalate it. Send it to the district privacy officer or legal counsel before sharing anything sensitive. Guessing wrong here carries real consequences.
HIPAA vs. FERPA: The Practical Differences
Scope and covered organizations
FERPA centers on education records and educational institutions. HIPAA centers on protected health information held by covered entities and their business associates. The table below summarizes the core contrast:
| Issue | FERPA | HIPAA |
|---|---|---|
| Covered organizations | Schools receiving ED funding, and parties acting for them | Health plans, clearinghouses, covered providers, and business associates |
| Typical school health records | Nurse visits, medication logs, immunization files kept by the school | Records held independently by a covered healthcare provider |
| Individual rights | Inspect, review, request amendment | Access, amend, request accounting, restrict, request confidential communication |
| Enforcement | Department of Education's Family Policy Compliance Office | HHS Office for Civil Rights |
Access, correction, and disclosure rights
FERPA gives parents and eligible students the right to inspect records and request amendments. Schools must respond to those requests within a reasonable time. HIPAA's access and amendment rights work similarly in concept, but add mechanics such as a six-year accounting of disclosures and the option to request restrictions on certain uses. Neither law is universally "stronger." Which one applies, and what rights come with it, depends entirely on the facts of the specific record and request.
Consent and permitted disclosures
Both laws default to consent but carve out exceptions relevant to schools:
- FERPA's school official exception permits sharing with staff (or contractors acting for the school) who have a legitimate educational interest.
- FERPA's health or safety emergency exception permits, but doesn't require, disclosure without consent when necessary to protect a student or others.
- HIPAA's treatment exception allows covered entities to share PHI for care coordination without prior authorization. Always verify these against current agency guidance before relying on them for a specific disclosure.
State and other federal requirements
State laws often add obligations HIPAA and FERPA don't cover. New York's Education Law 2-d, for example, requires third-party contractors to report data breaches to the district "without unreasonable delay," and requires districts to notify affected families within 60 calendar days. Other states impose similar or additional requirements around breach notification, medical privacy, and records retention. Apply the most protective standard available, but get jurisdiction-specific legal guidance rather than assuming federal law is the ceiling.
Privacy versus security
Privacy rules govern when information can be collected, used, or shared. Security controls protect it from unauthorized access, alteration, or loss. A district can be perfectly compliant on paper and still suffer a breach if permissions, encryption, and audit logging aren't actually in place operationally.
How Schools Can Protect Student Health Data
Build a data governance process
Document your student health data inventory end to end:
- What you collect
- Why you collect it
- Where it is stored
- Who can access it
- When it is destroyed
Practice data minimization: collect only what is needed for student safety, care coordination, or a defined school health function.
Control access and sharing
Role-based access should limit visibility by job function, not by convenience:
- Separate permissions for nurses, administrators, teachers, parents, and vendors
- Unique accounts with strong authentication
- Timely removal of former staff and periodic access reviews
- Audit logs that show who viewed or changed a record
Parent communication belongs in controlled channels. Sensitive health details shouldn't travel through personal email or unapproved messaging apps.
Manage consent and disclosures
Standardize how your district handles consent collection, identity verification, and emergency access. For every disclosure, log:
- What was shared
- With whom
- For what purpose
- Under which authority
- When it happened
That record protects the district if a disclosure is questioned later.
Protect paper and digital workflows
Secure both formats:
- Locked storage and clean-desk practices for paper forms
- Screen privacy, device management, and timely patching for digital systems
- Secure disposal procedures for records no longer needed
Train nurses, office staff, teachers, and substitutes with real scenarios—medication handoffs, absence notes, emergency care, and parent requests—not generic slideshows.
Prepare for incidents and third-party risk
Build an incident response process that covers detection, containment, internal escalation, and decisions on whether regulatory notification is required. For vendors, evaluate:
- Security controls and data location
- Subcontractor use and breach reporting terms
- Data return or deletion upon contract end
- Access controls and auditability
Don't take a vendor's compliance claims at face value. Validate them against your district's actual contract requirements.
Day to day, schools operationalize these controls faster when health records live in systems with role-based permissions, audit trails, and FERPA-aligned access—not scattered across paper, shared drives, and personal inboxes.
Technology and Vendor Considerations for School Health Workflows
Evaluate technology against school-specific needs
A school health platform should support:
- Role-based access and structured records
- Audit trails and controlled sharing
- Administrative oversight of who can see what
Ask vendors directly how they separate nurse documentation, parent access, administrative visibility, and their own support-staff access to your data.
How workflow design reduces risk
Digital health-form collection, nurse review and approval, medication expiration tracking, and structured visit documentation cut down on paper handling and manual follow-up.
MyCabinet School Health is one example of a platform built this way, connecting a Nurse Portal with parent access through both a mobile app and browser-based web portal. Its task lists organize incomplete visits, rechecks, and medication expirations in one place. Parent notifications stay controlled and one-way—clinic visit updates and medication expiration alerts—so outreach is documented and limited to what is necessary.
None of this replaces district responsibility. Configuration, permissions, and policy decisions still sit with the school, regardless of the platform.
Ask vendors the right questions
Before implementation, run vendors through a short checklist:
- Is the platform SOC 2 Type II certified or equivalent?
- How is data encrypted, at rest and in transit?
- What do audit logs capture, and who can review them?
- What's the incident response and breach notification process?
- How long is data retained, and what happens at contract end?
- Which subcontractors touch the data, if any?
Follow this with a security and privacy review that includes a data-flow map: where student health information enters the system, where it moves, where it's stored, and how it leaves.
Frequently Asked Questions
Does FERPA or HIPAA apply to school health records?
FERPA applies when a school keeps health information in a student's education record. HIPAA applies when a covered healthcare entity maintains the record on its own. Who creates and holds the record determines which law applies.
What is GDPR in schools in the UK?
GDPR is a UK/EU data protection framework, separate from U.S. HIPAA and FERPA. It is not the primary compliance framework for U.S. K–12 schools.
What are the 7 GDPR requirements?
There is no official "seven requirements" list under GDPR. U.S. schools should prioritize FERPA, any applicable HIPAA duties, and state student-privacy laws.
What are 10 examples of sensitive personal information?
Examples include health data, diagnoses, medications, biometrics, genetic data, disability status, financial data, government IDs, precise location, and login credentials. Legal definitions vary by law.
How can schools protect student health data?
Use least-privilege access, secure systems, documented consent processes, staff training, vendor due diligence, and a tested incident response plan. Update policies as workflows and regulations change.
