HIPAA Compliance Guide for College Student Health Clinics: Sharing Counseling Notes with Disability Services

This HIPAA Compliance Guide for College Student Health Clinics: Sharing Counseling Notes with Disability Services explains how federal privacy rules intersect when you coordinate support for students. You will learn when FERPA, not HIPAA, governs records; what “protected health information exclusions” mean on campus; and how to build practical, compliant workflows for sharing only what is necessary.

This guide reflects U.S. federal frameworks and is for informational purposes only. Always consult your institution’s counsel to align with state law and internal policy.

FERPA Applicability to Student Health Records

On most campuses, student health and counseling records are covered by FERPA, not HIPAA. FERPA’s “treatment records” are created or maintained by a health professional, used only for treatment, and are not disclosed to others except for treatment purposes. This FERPA treatment records exclusion means the records are not part of the general education file while they remain solely within the treatment context.

When treatment information is shared beyond treatment—for example, with disability services to support accommodations—it typically becomes an education record under FERPA. Education records may be accessed by school officials with a legitimate educational interest, and students generally have the right to inspect them. Plan ahead so clinicians understand how record classification can change when information leaves the counseling context.

HIPAA Coverage for Postsecondary Institutions

HIPAA privacy rule applicability is limited on campus. Even if your institution operates a HIPAA-covered health service (for example, bills electronically or is part of a hybrid entity), HIPAA specifically excludes from PHI those records that are “education records” or “treatment records” under FERPA. These protected health information exclusions are why most student counseling records are regulated by FERPA instead of HIPAA.

HIPAA may still apply in narrow scenarios—such as services provided to non-students or to the general public by a campus hospital. Clarify your organizational designations (covered entity, business associate, hybrid components) and map which populations and systems fall under HIPAA versus FERPA before setting up data flows with disability services.

Confidentiality of Counseling Records

Counseling notes often contain sensitive reflections, impressions, and process details that go beyond objective diagnosis or functional limitations. Under FERPA, they are protected as treatment records while used solely for treatment. If you share them outside the treatment team, they can convert to education records, increasing student access rights and institutional sharing obligations.

Adopt a “need-to-know” approach. Share concise functional impact statements (for example, concentration limits, attendance variability, testing endurance) rather than raw session notes. Where HIPAA applies, psychotherapy notes receive heightened protection; even when FERPA governs, mirror that higher bar by keeping process notes separate and rarely disclosed.

Obtaining Written Consent for Record Sharing

Because disability services is typically not a treatment provider, student written consent is generally the cleanest and most transparent path for sharing. Document student written consent requirements through a standardized release of information that authorizes counseling to disclose limited data to disability services for the accommodation process.

What a strong release should include

• Specific purpose: accommodation determination and implementation.
• Scope: functional limitations and relevant diagnoses; exclude narrative counseling notes unless expressly authorized.
• Recipients: name disability services and any named coordinators.
• Duration: time-limited authorization with an end date or academic term.
• Revocation: how the student can revoke consent prospectively.
• Format: allow summary letters instead of detailed notes whenever possible.

Use plain language, explain consequences of refusing or revoking consent, and provide a copy to the student. Even where FERPA might allow internal sharing, consent-centered practices build trust and minimize risk.

Exceptions to Confidentiality Rules

Both FERPA and HIPAA (where it applies) recognize situations where disclosure may occur without consent. Anchor your procedures around disclosure exceptions under FERPA while honoring state law and professional ethics.

Common FERPA-grounded pathways

• Health or safety emergency: share necessary information with parties positioned to mitigate an imminent threat.
• School officials with legitimate educational interest: access to education records when needed for job duties; note that treatment records must first become education records to use this pathway.
• Treatment purposes: treatment records may be disclosed to other treating providers without consent.
• Judicial order or subpoena: disclose as required, typically with notice to the student unless prohibited.
• Dependent student disclosures to parents: permitted under FERPA in specific circumstances; confirm dependency status and institutional policy.

Remember that “directory information” is not a vehicle for sharing counseling information. Where HIPAA applies, parallel allowances exist for treatment, certain public-interest disclosures, and emergencies, but student treatment and education records remain primarily FERPA-governed.

Coordination Between Counseling and Disability Services

Design coordination of care protocols that enable accommodations without oversharing. Start with a warm handoff: counseling encourages the student to contact disability services and, with consent, sends a concise functional summary that DS can rely on when evaluating accommodations.

Operational best practices

• Minimum necessary: disclose only what DS needs to validate functional limitations and recommend accommodations.
• Separate files: maintain counseling notes in the counseling record; store DS documentation in the DS system.
• Role clarity: define who is a treatment provider versus an educational official to avoid misclassification.
• Standard templates: use clinician letters that translate clinical findings into functional impacts.
• Feedback loop: DS informs counseling of approved accommodations with student consent to support continuity.

When uncertainty arises, pause and obtain fresh, narrowly tailored consent rather than defaulting to internal sharing.

Institutional Policies on Record Sharing

Strong institutional confidentiality policies reduce ambiguity and protect students and staff. Codify how your institution classifies records (treatment vs. education), when HIPAA components are in play, and which workflows require consent.

Elements to include

• Governance map: document covered components, hybrid designations, and protected health information exclusions.
• Access controls: role-based “need-to-know” standards, audit trails, and break-glass procedures for emergencies.
• Release management: approved forms, identity verification steps, and processes for revocation.
• Training and drills: annual refreshers on FERPA and HIPAA privacy rule applicability; scenario-based exercises.
• Data lifecycle: retention schedules, secure destruction, and separation of counseling and DS systems.
• State law overlay: identify stricter mental health or privilege rules and bake them into procedures.

Conclusion

In practice, most student counseling records are FERPA treatment records. Share the minimum necessary functional information with disability services, rely on clear student consent, and reserve raw counseling notes except in rare, well-justified cases. Align coordination with institutional confidentiality policies, and you will support accommodations while honoring privacy.

FAQs.

When does FERPA apply instead of HIPAA to student health records?

FERPA governs student education records and treatment records maintained by the institution for treatment purposes. Because of the FERPA treatment records exclusion and HIPAA’s protected health information exclusions, most student counseling and health records on campus are not subject to HIPAA. HIPAA may apply to non-student patients or separate covered components, but student records tied to the institution are generally FERPA-controlled.

Is student consent always required to share counseling notes with disability services?

In practice, yes—obtain written consent when sharing with disability services, which is not a treatment provider. FERPA allows limited internal access for officials with a legitimate educational interest once information becomes an education record, but using student written consent requirements preserves trust and keeps disclosures narrowly tailored. Provide functional summaries rather than raw notes unless the student explicitly authorizes more.

What are the legal exceptions to confidentiality in student counseling records?

Key exceptions include health or safety emergencies, disclosures for treatment to other treating providers, compliance with court orders or subpoenas (with required notices), and certain parental disclosures for dependent students. These are disclosure exceptions under FERPA; where HIPAA applies, comparable emergency and treatment pathways exist, though most student counseling records are under FERPA.

How do institutional policies affect sharing counseling information with campus disability offices?

Institutional confidentiality policies determine who may access records, how records are classified, and what approvals are needed. Clear policies define coordination of care protocols, standard release forms, role-based access, and when minimal functional summaries may be shared. Strong policies reduce risk, streamline workflows, and ensure consistent, compliant collaboration with disability services.