HIPAA Compliance Checklist for Clinical Boarding School Programs

Clinical boarding school programs may handle student health information through school records, an on-campus clinic, independent clinicians, or a mix of these arrangements. The right privacy and security steps depend on who maintains each record, whose behalf they act for, and whether the organization meets HIPAA’s covered entity or business associate criteria.

Use this checklist to map those relationships, set disclosure procedures, and identify the duties that apply to your program. It is general information, not a substitute for legal advice about your state’s laws or a specific student’s records.

Determine whether HIPAA or FERPA applies to student health records

Start by confirming whether the school is subject to FERPA. FERPA applies to educational agencies and institutions that receive funds from programs administered by the U.S. Department of Education. Private and parochial elementary and secondary schools generally do not receive those funds and therefore generally are not subject to FERPA. Check the school’s funding and placement arrangements rather than assuming FERPA applies because the organization is a school. See the Department of Education’s guidance on which institutions FERPA covers.

When FERPA applies, health information directly related to a student and maintained by the school—or by a party acting on its behalf—generally qualifies as an education record. Those records are excluded from HIPAA’s definition of protected health information (PHI). As a result, a school’s student health records are often governed by FERPA, not HIPAA. The Departments of Education and Health and Human Services explain this distinction in their joint guidance on FERPA and HIPAA.

• Document whether the school receives applicable Department of Education funds and whether another public agency maintains records or has privacy responsibilities for students placed at the program.
• Identify which records are held by the school, by a clinician acting for the school, and by a provider treating students independently.
• For students who turn 18, account for FERPA’s transfer of rights to the eligible student, subject to applicable exceptions. The Department of Education explains this in its eligible student guide.
• Check state laws, licensing rules, contracts, and funding requirements that may apply even when HIPAA or FERPA does not govern a particular record.

Do not label all student health information “HIPAA-protected” or “FERPA-protected” without identifying the record and its custodian. A single program may handle both FERPA education records and separate provider records subject to HIPAA.

Identify covered entities and business associates

Determine covered entity status separately for the school, clinic, and each independent provider. Under HIPAA, covered entities are health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a transaction for which HHS has adopted a standard. Electronic email or use of an electronic health record alone does not make a provider a covered entity. Review HHS’s covered entity and business associate guidance when making this assessment.

A business associate is generally a person or organization that performs certain functions or services on behalf of a HIPAA covered entity involving PHI. If a covered entity engages a business associate, the parties generally need a written business associate agreement (BAA) that sets out permitted uses and disclosures and safeguards for PHI. HIPAA also applies to qualifying subcontractors. HHS describes these duties in its business associate guidance.

• List each clinician, clinic, pharmacy, laboratory, billing service, electronic records vendor, cloud service, and other party that may access health information.
• For each relationship, record who controls the records, what services the party provides, and whether it is acting for the school or for a HIPAA covered entity.
• Put a BAA in place when required for a HIPAA business associate relationship; do not treat a BAA as a universal substitute for FERPA-compliant agreements or other contracts.
• For school contractors handling FERPA education records, confirm the requirements of the applicable FERPA exception and written agreement. A school contractor is not automatically a HIPAA business associate merely because it handles student health information.

Use the program’s actual workflows—not job titles or contract labels—to determine each party’s legal role. A provider’s covered entity status and the status of a particular student record are related but separate questions.

Separate school-maintained records from independent provider records

Map where each type of record is created, stored, and used. A clinician or nurse who provides services on behalf of a FERPA-covered school, such as under contract or under the school’s direct control, may create records that qualify as FERPA education records. By contrast, records created and maintained by a provider treating students independently and not acting on the school’s behalf generally are not FERPA education records just because the provider works on campus. The HHS guidance on student health records maintained by outside providers discusses this distinction.

• Keep school incident reports, attendance information, accommodation plans, medication administration records, and education records in clearly identified school systems.
• Keep an independent provider’s clinical chart in the provider’s own system, with access limited to authorized clinical staff.
• Define what information the school may receive for operational or safety needs, how it will be transmitted, and who may access it.
• Train staff not to assume that access to a school record gives them access to a provider’s chart—or that a clinician’s access to a student makes the school a HIPAA covered entity.

Separation can be operational as well as technical: use role-based permissions, separate record locations where practical, and documented processes for requests to transfer information between the school and a provider. Do not copy an entire clinical chart into a school file when a narrower, authorized communication will serve the purpose.

Review consent requirements and permitted disclosures

For FERPA education records, the general rule is that a school needs written consent from the parent or eligible student before disclosing personally identifiable information. FERPA has exceptions, including certain disclosures to school officials with a legitimate educational interest and disclosures needed to address a qualifying health or safety emergency. The emergency exception is limited to the emergency; it is not a general permission for ongoing or blanket sharing. Review the Department of Education’s guidance on FERPA emergency disclosures.

For HIPAA-covered records, a covered entity may disclose PHI without an individual’s authorization in certain circumstances, including for treatment, payment, and health care operations, subject to the Privacy Rule’s requirements. Other permissions may apply in specific situations, such as an appropriate disclosure to lessen a serious and imminent threat. These HIPAA permissions are not interchangeable with FERPA exceptions. See HHS’s guidance on treatment, payment, and health care operations.

• For each routine exchange—such as a clinician sharing care instructions with the school—identify the applicable law, the purpose, the authorized recipient, and any consent or authorization required.
• Use the FERPA health-or-safety-emergency exception only when its conditions are met, document the basis for the decision, and limit the disclosure to information relevant to the emergency.
• For minor patients’ HIPAA records, verify who may act as the student’s personal representative. State law may allow a minor to consent to certain services without parental consent, affecting a parent’s access to those records. HHS explains these exceptions in its guidance on minors and personal representatives.
• For students who are 18 or older, do not assume that a parent has authority to access FERPA records or clinical records; verify the applicable rights, consent, and exceptions.

Build a disclosure log or other recordkeeping process appropriate to the applicable rules and program policies. When a disclosure is permitted without consent, share only what the recipient needs for the allowed purpose as a prudent privacy practice, and document the decision when appropriate.

Complete an electronic protected health information risk analysis

If the program, clinic, or provider is subject to the HIPAA Security Rule, it must conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of its electronic protected health information (ePHI). The HIPAA Security Rule risk analysis is not a one-time technology scan: it should account for the organization’s environment and the ePHI it creates, receives, maintains, or transmits. HHS provides Security Rule guidance and risk-analysis resources.

• Inventory the systems and devices that store or access ePHI, including electronic health records, medication systems, messaging tools, laptops, mobile devices, backups, and vendor-hosted applications.
• Map how ePHI moves between clinical staff, schools, pharmacies, laboratories, families, and service providers.
• Assess risks tied to the program’s residential setting, such as shared work areas, misplaced devices, printed medication lists, conversations within hearing range, and staff access beyond job needs.
• Evaluate likely threats and vulnerabilities, their potential impact, and the safeguards already in place.
• Record the analysis, prioritize remediation, assign owners and deadlines, and revisit the assessment when systems, services, staffing, or risks change.

Use the results to select and maintain reasonable and appropriate safeguards, such as access controls, staff training, secure transmission, backup and recovery procedures, and device protections. HHS distinguishes risk analysis—the process of identifying and assessing risks—from risk management, the process of implementing measures to address them, in its risk analysis and risk management explanation.

This HIPAA analysis requirement applies to HIPAA-regulated entities and ePHI; it should not be presented as a HIPAA duty for every school simply because the school maintains student health information. FERPA-covered programs should still use appropriate data-security practices and comply with other applicable obligations.

Establish breach assessment and notification procedures

Prepare a written response process before an incident occurs. Make sure staff know how to report a lost device, misdirected email, inappropriate chart access, ransomware event, or other suspected impermissible use or disclosure immediately. First secure affected systems and records, preserve relevant evidence, and notify the designated privacy or security lead.

For a suspected HIPAA incident, determine whether the information is PHI, whether it was unsecured, whether the use or disclosure was impermissible, and whether an exception applies. An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate can demonstrate a low probability that the PHI was compromised based on the required assessment. HHS describes the assessment factors and exceptions in its Breach Notification Rule guidance.

• Assess the nature and extent of the information, including identifiers; who received or used it; whether it was actually acquired or viewed; and what steps reduced the risk.
• Document the facts, the risk assessment, the decision about whether notification is required, and the actions taken to contain and mitigate the incident.
• If a business associate discovers a breach of unsecured PHI, ensure it notifies the covered entity under the HIPAA rule and the applicable BAA. The agreement may set a faster reporting deadline than HIPAA’s outside limit.
• If HIPAA notification is required, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. HHS notification is also required; for breaches affecting fewer than 500 individuals, reporting to HHS may be made annually within the rule’s deadline. Breaches affecting 500 or more residents of a state or jurisdiction also require notice to prominent media serving that area.
• If the affected records are governed by FERPA rather than HIPAA, do not automatically apply HIPAA’s breach-notification process. Check applicable state breach-notification laws, contracts, and other requirements.

Maintain a response log that records discovery dates, decisions, notices, and follow-up actions. Review the procedure with school leadership, clinical staff, information technology, and counsel so the team can quickly determine which law and notification duties apply to each affected record set.

In short, an effective checklist begins with record-by-record classification, then assigns clear roles for providers and vendors, limits disclosures to those permitted, and supports any HIPAA-required risk analysis and breach response. Revisit these decisions whenever the program changes its clinical services, contracts, systems, or student population.

FAQs

Are student health records at a boarding school covered by HIPAA or FERPA?

It depends on the school, the record, and who maintains it. Health records maintained by a FERPA-covered school or by a party acting on its behalf generally qualify as FERPA education records and are excluded from HIPAA’s Privacy Rule. Records maintained by an independent provider not acting for the school may instead be subject to HIPAA if that provider is a covered entity, and the records are not automatically covered by FERPA.

When can a school share student health information without consent?

If FERPA applies, a school may disclose personally identifiable information from education records without consent only when a FERPA exception applies. Examples include certain disclosures to school officials with a legitimate educational interest and disclosures to appropriate parties in connection with a qualifying health or safety emergency. The emergency exception is limited to the circumstances of the emergency. For records governed by HIPAA, a covered entity may disclose PHI without authorization for certain permitted purposes, including treatment, payment, and health care operations, or under other specific HIPAA permissions.

Does an independent healthcare provider serving students need to comply with HIPAA?

Not automatically. A provider generally is a HIPAA covered entity if it transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as certain electronic billing transactions. A provider may also have HIPAA obligations if it acts as a business associate of a covered entity. Separately, records of a provider treating students independently and not acting on the school’s behalf generally are not FERPA education records merely because the provider serves students at school.

What steps are required after a suspected breach of unsecured protected health information?

Contain the incident, preserve evidence, and promptly notify the responsible privacy or security lead. Determine whether the data is unsecured PHI and assess the incident under HIPAA’s breach rules, including the type of information involved, who received it, whether it was acquired or viewed, and what mitigation occurred. Document the decision and, if notification is required, meet the applicable deadlines for affected individuals, HHS, and—when required—the media. A business associate must notify the covered entity under the applicable HIPAA requirements and agreement.