HIPAA Compliance Checklist for Children’s Vision Screening Programs

When you organize a children’s vision screening program, first identify who is conducting the screening, who maintains the records, and whether the screener is acting on the school’s behalf. Those details help determine whether the HIPAA Privacy Rule, FERPA, or another applicable privacy requirement governs the information.

Use this checklist to plan how you document screening results, protect student health information, communicate with families, and handle referrals. It is a general guide; check current state law, district policy, and program agreements for requirements that apply to your location.

When HIPAA applies to school vision screening programs

In most elementary and secondary school settings, student health records maintained by the school are governed by FERPA, not the HIPAA Privacy Rule. HIPAA generally applies to covered entities, including certain health care providers that conduct specified electronic transactions, but FERPA education records are excluded from HIPAA’s definition of protected health information. See HHS guidance on HIPAA and elementary or secondary schools.

The arrangement with an outside screening organization matters. If a provider is under contract with or otherwise acting on behalf of the school, records it maintains for the school generally qualify as FERPA education records. If a provider independently offers services and is not acting for the school, its records may fall outside FERPA; the HIPAA Privacy Rule applies to those records only if the provider meets HIPAA’s covered-entity requirements. See HHS guidance on records held by health care providers outside a school.

• Identify which organization conducts the screening and which organization maintains the records.
• Clarify in writing whether an outside screener is acting on the school’s behalf and what information it may collect, access, and share.
• Do not assume that a program is subject to HIPAA simply because it involves health information. Determine which privacy rules apply to each record holder and each copy of the record.

How FERPA governs student vision screening records

For a FERPA-covered school, a student’s vision screening record that is directly related to the student and maintained by the school—or by a third party acting for it—generally counts as an education record. FERPA also applies to personally identifiable information in those records. FERPA coverage depends on the institution and the records involved; for example, private and faith-based K–12 schools are generally not subject to FERPA. See the U.S. Department of Education’s overview of FERPA protections for student health records.

As a general rule, a school must obtain prior written consent before disclosing personally identifiable information from an education record to an outside party. FERPA consent must be signed and dated, identify the records that may be disclosed, state the purpose of the disclosure, and name the recipient or class of recipients. Exceptions can apply, including certain disclosures to school officials with a legitimate educational interest or to appropriate parties during a qualifying health or safety emergency. See the Department of Education’s FERPA consent and disclosure guidance.

When a contractor qualifies as a school official under FERPA, the school may be able to share relevant information without separate written consent, subject to FERPA’s conditions, including the school’s direct control over the contractor’s use and maintenance of the records. Do not treat every vendor or community organization as a school official; confirm that the arrangement satisfies the applicable requirements.

FERPA rights generally belong to a student’s parent until those rights transfer to the student. They transfer when the student turns 18 or attends a postsecondary institution at any age. See the Department of Education’s FERPA regulations and guidance.

What information to document after a screening

Federal privacy rules do not provide one universal checklist of clinical fields for every school vision screening. As a practical program measure, record enough information to accurately document what happened, communicate the result, and support any referral—without collecting details that are unnecessary for those purposes.

• Student identification: Use the school’s approved identifier and only the identifying details needed to match the screening record to the right student.
• Screening details: Record the date, screening method or tool, and the person or program that performed the screening.
• Results: Document the result for each eye when applicable, whether the student wore corrective lenses during the screening, and whether the screening was completed, could not be completed, or resulted in a referral recommendation.
• Communication: Record when and how the parent or guardian was notified, using the communication method allowed by school policy.
• Referral tracking: If the program tracks referrals, document the recommendation and any follow-up information the family chooses to share or the program is authorized to receive.
• Disclosures: Follow school procedures for recording disclosures when FERPA requires it, including applicable disclosures under the health or safety emergency exception.

Keep referral documentation factual and neutral. For example, record that the student did not meet the program’s screening criteria and was advised to receive a comprehensive eye examination, rather than recording a diagnosis the screening cannot establish.

How to protect privacy during vision screening

Limit access to identifiable screening records to people whose roles require the information. FERPA permits a school to disclose records to school officials with a legitimate educational interest when the relevant conditions are met; schools must use reasonable methods to ensure access is limited appropriately. See the Department of Education’s guidance on access to education records.

• Use a private screening area and avoid announcing individual results where classmates or unauthorized staff can hear them.
• Keep paper forms secured and digital records in school-approved systems with access limited to authorized users.
• Use secure, school-approved methods to send results or referral notices; check recipient details before sharing identifiable information.
• Share only the information needed for the stated purpose, and do not include student names in public or general program reports.
• Set expectations with outside screeners about confidentiality, access, storage, permitted use, and secure return or disposal of records.

These are privacy-protective practices, not a claim that every school must use a particular technology or procedure under HIPAA. Follow the privacy and security requirements that apply to the actual record holder, along with district policy and any applicable state law.

How to notify parents and guardians and manage opt-outs

Before screening begins, give families a clear notice describing the purpose of the program, who will conduct the screening, what information may be recorded, how results will be shared, and whom to contact with questions. Explain the district’s process for declining participation, including any deadline and how to submit an opt-out request.

Do not assume that one federal rule creates the same parental permission or opt-out process for every school vision screening. The federal PPRA provision concerning certain non-emergency, invasive physical examinations or screenings does not apply to hearing, vision, or scoliosis screening. State law, district policy, program rules, or other requirements may still call for notice, consent, or an opt-out process. See the Department of Education’s PPRA notice, including the vision-screening exception.

Keep screening participation separate from permission to disclose records. A family’s permission to screen a child does not automatically authorize sharing personally identifiable information with an outside provider. When FERPA requires written consent for a disclosure, the consent must identify the records, purpose, and recipient; an exception may apply in specific circumstances.

• Use a consistent method to receive, date, and acknowledge parent or guardian opt-out requests.
• Tell screening staff how to confirm opt-out status before calling a student for screening.
• Record the participation decision according to school policy, without adding unnecessary sensitive details.
• Check state and district requirements before finalizing notices, deadlines, or consent forms.

How to communicate screening results and referrals

Send each result directly to the parent or guardian using a private, school-approved channel. Use plain language to distinguish among a result that met the screening criteria, a result that warrants follow-up, and a screening that could not be completed. Avoid presenting a referral recommendation as a medical diagnosis.

When a screening indicates that follow-up may be appropriate, explain that the family should arrange a comprehensive eye examination with an eye care professional. Include the reason for the referral, any relevant screening result, and practical information about how to seek care, if your program can provide it. A screening result alone should not be used to label a student as having an eye condition.

Share identifiable results with an outside eye care provider only when the disclosure is permitted under FERPA—for example, with the required written consent or under an applicable exception. If written consent is required, make sure it specifies the records, purpose, and recipient. See the Department of Education’s guidance on FERPA written consent for disclosures to community organizations.

What vision screening can and cannot determine

A vision screening is intended to identify children who may need additional eye care; it is not the same as a comprehensive eye examination and cannot establish a diagnosis. A child who does not meet the screening criteria should be referred for further evaluation, while a result that meets the criteria does not guarantee that the child has no vision or eye-health concern. The CDC explains the difference between vision screening and a comprehensive eye exam.

Describe results as screening outcomes, not diagnoses. If a family or school staff member remains concerned about a child’s vision—even after a result that meets screening criteria—the appropriate next step is to consult an eye care professional.

Conclusion

A well-run children’s vision screening program identifies which privacy framework applies, limits access to student information, documents results and referrals carefully, and communicates clearly with families. Treat screening as an initial check—not a diagnosis—and follow FERPA, applicable HIPAA requirements, state law, and district procedures for the records and disclosures involved.

FAQs

Are school vision screening records protected by HIPAA or FERPA?

When a FERPA-covered school maintains a student’s screening record, or a contractor maintains it on the school’s behalf, the record generally is an education record protected by FERPA rather than by the HIPAA Privacy Rule. Records kept by an independent outside provider may be treated differently; HIPAA applies to that provider’s records only if the provider is a HIPAA covered entity. See HHS’s joint HIPAA and FERPA guidance.

When is written consent needed to disclose a child’s vision screening records?

For a FERPA-covered school, written consent is generally needed before disclosing personally identifiable information from an education record to an outside party, unless a FERPA exception applies or the recipient qualifies under an applicable exception, such as the school-official exception. Required consent must be signed and dated and identify the records, purpose, and recipient. Check the school’s privacy procedures before sending results to an outside provider.

What details should a vision screening program document?

Document the student identifier needed to match the record, screening date and method, screener or program, relevant results for each eye, whether corrective lenses were worn, whether the screening was completed, and any referral recommendation. Also follow school procedures for recording parent or guardian notification and applicable disclosures. Collect only information needed for the program’s purpose.

Does a vision screening diagnose an eye condition?

No. A vision screening helps identify children who may need additional eye care; it does not diagnose an eye condition. A comprehensive eye examination by an eye care professional is needed to evaluate concerns and diagnose a medical or vision problem.