Does a Student Health Portal Need a BAA? HIPAA vs. FERPA Explained

Understanding FERPA and Student Health Records

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records at institutions that receive U.S. Department of Education funds. Health and counseling records maintained by a school for students are typically FERPA records, even when they contain highly sensitive information.

Within FERPA, “treatment records” are created or maintained by a health professional solely for treatment and are not shared beyond providers. Although students may not have the same access rights to treatment records as to other education records, these records remain under FERPA’s umbrella, not HIPAA. If treatment records are shared for non-treatment purposes or integrated into the education record, they become standard FERPA education records.

Key takeaway: when a college or K–12 institution maintains student health information, Education Records Privacy under FERPA—rather than HIPAA—usually governs how that information can be used and disclosed.

Overview of HIPAA Privacy Rule

The Health Insurance Portability and Accountability Act Privacy Rule safeguards Protected Health Information (PHI) held by “Covered Entities” (health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions) and their business associates. HIPAA sets standards for uses, disclosures, individual rights, and the Security Rule’s safeguards for electronic PHI.

However, HIPAA expressly excludes from PHI both FERPA “education records” and FERPA “treatment records.” As a result, most student health records kept by educational institutions are not subject to the HIPAA Privacy Rule. HIPAA may apply if a university operates a separate covered health care component (for example, a hospital or clinic that bills private insurance electronically), or if care is delivered by a non-school provider.

In short, apply HIPAA where PHI is handled by a Covered Entity; apply FERPA when the school maintains student records. The regime follows the record holder and the transaction context.

Role of Third-Party Vendors in Student Health Portals

Many schools use third-party vendors to host portals for appointments, immunization uploads, secure messaging, telehealth, and electronic records. These vendors may process highly sensitive data and must be governed by the correct legal framework.

Under FERPA, vendors often operate as “school officials” with a legitimate educational interest. Contracts should require the vendor to use information only for institutional purposes, impose strict redisclosure limits, and support Third-Party Vendor Compliance through security, audit, and breach obligations.

Under HIPAA, if the portal supports a Covered Entity and the vendor creates, receives, maintains, or transmits PHI on its behalf, the vendor is a business associate. In that case, the vendor relationship must be governed by a Business Associate Agreement.

Business Associate Agreements and Their Importance

A Business Associate Agreement (BAA) is a HIPAA-mandated contract between a Covered Entity and a vendor that handles PHI. It requires the vendor to safeguard PHI, use and disclose it only as permitted, report breaches, flow down protections to subcontractors, and return or destroy PHI at termination.

When a BAA is required: if a student health portal supports a HIPAA Covered Entity (for example, a university-run clinic that bills insurers electronically) and the vendor touches PHI, a BAA is essential. Without it, both parties risk HIPAA violations and penalties.

When a BAA is not required: if the portal exclusively houses FERPA education or treatment records maintained by the school, those records are not PHI. In that scenario, a FERPA-focused data protection agreement—not a BAA—should govern, addressing access controls, redisclosure limits, student rights, and security expectations.

Compliance Requirements for Student Health Portals

If FERPA applies

• Define the vendor as a “school official” with a legitimate educational interest and restrict redisclosure.
• Document consent workflows and allowable exceptions (e.g., health or safety emergencies).
• Maintain records of disclosures and support student rights to inspect and request amendments where applicable.
• Implement role-based access, encryption, logging, and incident response aligned to Education Records Privacy.
• Set retention and deletion schedules consistent with institutional policy and state law.

If HIPAA applies

• Confirm Covered Entity status and execute a Business Associate Agreement with the portal vendor.
• Conduct a risk analysis and implement administrative, physical, and technical safeguards under the Security Rule.
• Apply minimum necessary standards, manage authorizations, and publish a Notice of Privacy Practices where required.
• Prepare breach notification processes and workforce training tailored to PHI.

If both may apply

• Segregate systems and data so FERPA records and HIPAA PHI do not commingle without clear legal authority.
• Designate hybrid-entity components as needed and train staff to follow the correct rule set based on context.
• Map data flows to ensure each disclosure aligns to the governing law and contract terms.

Differentiating Between FERPA and HIPAA Protections

• Scope: FERPA covers student education and treatment records maintained by schools; HIPAA covers PHI held by Covered Entities and their business associates.
• Record status: Education and treatment records under FERPA are expressly excluded from HIPAA’s PHI definition.
• Individual rights: FERPA grants parents (for minors) and eligible students rights to access and request amendments to education records; HIPAA grants individuals rights to access, amend, and receive an accounting of disclosures of PHI.
• Disclosures: FERPA allows disclosures with consent or under defined exceptions; HIPAA permits uses and disclosures for treatment, payment, and health care operations, among others, with the minimum necessary standard.
• Enforcement: FERPA is enforced by the U.S. Department of Education; HIPAA is enforced by the U.S. Department of Health and Human Services.

Best Practices for Managing Student Health Information

• Decide the governing law first: identify whether records are FERPA education/treatment records or HIPAA PHI.
• Map data sources, interfaces, and storage to confirm who maintains the record and which transactions occur.
• Use the right contract: FERPA data protection terms for school-maintained student records; a Business Associate Agreement for HIPAA-covered functions.
• Apply security-by-design: strong authentication, encryption, least-privilege access, audit logs, and tested incident response.
• Separate environments when necessary to avoid mixing FERPA and HIPAA data; train staff accordingly.
• Standardize consent and authorization workflows; document disclosures and maintain retention schedules.
• Continuously monitor Third-Party Vendor Compliance with periodic reviews, penetration tests, and clear SLAs.

Bottom line: a student health portal needs a BAA only when it supports a HIPAA Covered Entity and handles PHI. If the school maintains student records subject to FERPA, use FERPA-aligned contracts and controls instead.

FAQs.

When does FERPA apply to student health records?

FERPA applies when an educational institution maintains the record about a student, including most health and counseling records kept by the school. Treatment records created by campus clinicians are also governed by FERPA (though accessed differently) unless shared for non-treatment purposes, in which case they become standard education records.

Does HIPAA require a BAA for third-party health portal vendors?

Yes—if the portal vendor creates, receives, maintains, or transmits Protected Health Information for a HIPAA Covered Entity. If the portal only holds FERPA education or treatment records maintained by the school, those are not PHI and a HIPAA BAA is not required; use FERPA-focused contractual protections instead.

How to determine if a student health portal is a HIPAA-covered entity?

The portal itself is not the Covered Entity; the question is whether the operating clinic or health plan is one. If the clinic conducts standard electronic transactions (e.g., billing insurers) or is part of a designated HIPAA health care component, it is likely a Covered Entity and HIPAA applies to that function. If records are maintained by the school as student records, FERPA typically governs.

What are the risks of not having a BAA for a student health portal?

If HIPAA applies, operating without a BAA is a compliance failure that can trigger enforcement actions, financial penalties, breach liabilities, and mandatory remediation. It also increases operational risk—unclear obligations, weaker safeguards, and exposure in incident response. If HIPAA does not apply, using a BAA can create confusion; the correct approach is a FERPA-aligned data protection agreement.