Colorado School Nurse Guide to Student Health Privacy Rules: FERPA, HIPAA, and State Requirements

This Colorado School Nurse Guide to Student Health Privacy Rules: FERPA, HIPAA, and State Requirements explains how to protect student health information while supporting care in K–12 settings. You will learn where FERPA controls, where HIPAA does (and does not) apply, and what Colorado’s state requirements add to your day-to-day data privacy compliance responsibilities.

FERPA Applicability in Schools

What FERPA covers

FERPA is a federal student privacy law tied to federal funding regulations. It protects education records—any records directly related to a student and maintained by the school or a party acting for the school. In practice, most school nurse records (clinic logs, medication administration records, immunization records, care plans, IEP/504 health sections) are education records.

Personally identifiable information

FERPA safeguards students personally identifiable information (PII), including names, ID numbers, and any data that could reasonably identify a student. Health details inside education records are protected PII; treat them as sensitive from creation to disposal. Directory information does not include health conditions or treatment details.

Access and consent

Parents—and students once they become “eligible students”—have the right to inspect education records and request corrections. With limited exceptions, you need written consent to disclose PII from education records. Within school operations, you may share records only with school officials who have a legitimate educational interest and only the minimum necessary.

Implications for school nurses

Because your records are typically education records, FERPA—not HIPAA—controls most day-to-day school nursing information. Keep health data within district-approved systems, apply role-based access, and document parent consents and legitimate educational interest when disclosing.

HIPAA Limitations for Educational Records

Who HIPAA covers

HIPAA applies to covered entities: health plans, health care clearinghouses, and health care providers who transmit health information electronically in standard transactions (such as electronic claims). Business associates of covered entities are also subject to HIPAA through contractual duties.

Why most school nurse records are not HIPAA

HIPAA expressly excludes FERPA-protected education records and certain FERPA “treatment records” from its definition of protected health information. If you are employed by a school or district and maintain student health information for school purposes, that information is generally governed by FERPA, not HIPAA.

When HIPAA may still apply

HIPAA can apply when a student receives services from an external covered entity, such as a hospital- or FQHC-operated school-based health center or a telehealth provider that bills electronically. Records held by that provider are HIPAA records; once information is shared with the school, it becomes an education record under FERPA at the school.

Electronic Health Information Transmission

If you work within or alongside a HIPAA covered entity, electronic health information transmission (e.g., e-prescribing, secure messaging, claims) must meet HIPAA Security Rule safeguards. Even when HIPAA does not apply to the school, mirror those safeguards—encryption, access controls, and audit logs—to strengthen student data security and overall data privacy compliance.

Distinguishing FERPA and HIPAA Coverage

Quick comparison

• Record holder: School/district records are FERPA; external medical provider records are HIPAA.
• Scope: FERPA covers education records with student PII; HIPAA covers PHI held by covered entities and their business associates.
• Consent: FERPA requires parent/eligible student consent for most disclosures; HIPAA requires patient authorization unless an exception applies.
• Internal sharing: FERPA allows sharing with school officials with legitimate educational interest; HIPAA allows sharing for treatment, payment, and operations within covered entity rules.
• Enforcement: FERPA is enforced via federal funding regulations; HIPAA via federal civil and, in some cases, criminal penalties.

Common school scenarios in Colorado

• District-employed nurse documenting a medication dose: FERPA.
• Hospital-run school-based health center treating a student: HIPAA at the clinic; if the clinic shares a note with the school, that copy becomes FERPA at the school.
• Community provider emailing a care plan to the nurse: HIPAA at the provider; once received and maintained by the school, the document is FERPA.
• Athletic trainer employed by the district: FERPA; a private clinic’s athletic training notes remain HIPAA until shared with the school.

Colorado Student Data Transparency Act

What the Act adds

Colorado’s Student Data Transparency and Security framework strengthens student data security and transparency across K–12. It emphasizes clear data governance, public-facing transparency about data elements collected, and strong vendor oversight for school service providers handling student information.

District and school responsibilities

• Maintain a data inventory describing what education records are collected, why they are collected, and how they are protected.
• Use contracts with school service providers that restrict secondary uses of PII, prohibit selling student PII, set security standards, and require timely breach notification and data destruction at contract end.
• Align local policies with FERPA and district procedures so health data practices are consistent system-wide.

Vendors and school service providers

Before sharing student health data with any vendor (for example, an EHR module, screening tool, or messaging app), confirm the tool is district-approved and subject to a signed agreement that addresses security, data minimization, data retention, and incident response. Do not sign HIPAA Business Associate Agreements on behalf of the district unless the district is acting as or on behalf of a covered entity.

Electronic exchanges and interoperability

When arranging electronic health information transmission with outside providers, prefer secure, auditable channels approved by the district. Limit the data set to the minimum necessary for the educational purpose and record the legal basis for each exchange (consent, health/safety exception, or other applicable rule).

Practical Compliance Strategies

A quick decision path for disclosures

1. Classify the record: Is it a school-maintained education record (FERPA) or an external provider record (HIPAA)?
2. Identify the requester: Parent, eligible student, teacher, administrator, provider, law enforcement, or public health.
3. Check authority: Do they have a legitimate educational interest (FERPA) or a valid consent/exception?
4. Limit scope: Share only what is necessary to meet the stated purpose.
5. Choose a secure channel: Use district-approved systems; avoid texting or personal email for PII.
6. Document: Note the request, legal basis, data shared, and method of transmission.

Everyday safeguards

• Lock screens and cabinets; never leave records unattended.
• Use strong passwords and multifactor authentication for electronic systems.
• De-identify data for staff trainings and reports whenever possible.
• Provide regular refreshers on FERPA, HIPAA distinctions, and state requirements to all health room staff and substitutes.

Partnering with families and providers

• Explain why the school needs specific health details and how they will be protected.
• Use clear, FERPA-compliant consent forms to authorize exchanges with outside providers.
• Set expectations with providers about the school’s FERPA status and preferred secure messaging routes.

Health Records Management

Organizing records

Segment records by purpose: daily clinic visits, medication administration, individualized health plans, emergency action plans, and screenings. Keep incident reports and nursing notes in the official system of record; avoid shadow files that are outside district oversight.

Electronic systems and access control

Store health data in district-approved student information systems or health record platforms with role-based access and audit logging. Ensure vendors meet student data security requirements and support secure electronic health information transmission when exchanging with external providers.

Retention and secure destruction

Follow your district’s records retention schedule and state archiving rules. When the retention period ends, securely destroy records to prevent reconstruction, and obtain certificates of destruction from vendors where applicable.

Data quality and minimum necessary

Collect only what you need, keep it accurate and current, and remove outdated items during periodic reviews. Use de-identified or aggregate data for program evaluation and public reporting.

Reporting and Disclosure Requirements

Mandatory reports and emergencies

Comply with state-mandated reports such as suspected child abuse or neglect and communicable disease control in coordination with your district and local public health. Under FERPA’s health or safety emergency exception, share only what is necessary to protect the student or others, and document the rationale.

Court orders, subpoenas, and law enforcement

If you receive a subpoena or court order, promptly involve your district’s records or legal office. FERPA generally requires reasonable effort to notify parents or eligible students before compliance unless the order prohibits notice. Law enforcement unit records maintained by a designated school law enforcement unit are not education records, but copies kept in the health record are.

Breach response

Suspected unauthorized access or disclosure triggers your incident response: contain the issue, notify your supervisor and the district privacy lead, preserve evidence, and follow vendor and district notification procedures. Provide families with clear, timely information and remediation steps when required.

Key takeaways

• In K–12 settings, most school nurse records are FERPA education records, not HIPAA.
• HIPAA applies to external providers (and their health care clearinghouses); once info reaches the school, FERPA governs.
• Colorado’s transparency and security rules add vendor oversight, data inventory, and breach obligations that you should build into daily workflows.
• Use the minimum necessary standard, secure systems, and precise documentation for every disclosure.

FAQs.

What records does FERPA protect in schools?

FERPA protects education records—records that are directly related to a student and maintained by the school or its agents. For school nurses, that includes clinic logs, medication administration records, care plans, immunization documentation, screening results, and health-related sections of IEP/504 plans, all of which contain student PII.

How does HIPAA apply to school nurses?

HIPAA usually does not apply to school nurse records because they are education records under FERPA. HIPAA applies when care is provided by a covered entity (such as a hospital- or FQHC-run clinic or telehealth provider). Those provider-held records are HIPAA, but copies maintained by the school are FERPA.

What are Colorado's specific student data privacy laws?

Colorado’s student data transparency and security requirements enhance FERPA by mandating strong vendor contracts, public transparency about data collected, security controls, and breach procedures for student information handled by or for schools. They reinforce data minimization, oversight of school service providers, and clear incident response.

How do FERPA and HIPAA differ in school health settings?

FERPA governs student education records maintained by schools and is enforced through federal funding regulations. HIPAA governs protected health information held by covered entities (health plans, health care clearinghouses, and certain providers). In practice: district-held health records are FERPA; external provider records are HIPAA—until they are shared with and maintained by the school, at which point FERPA applies.