HIPAA Compliance Guide for Sports Concussion Baseline Testing Programs

When HIPAA applies to concussion baseline testing data

Whether concussion baseline results are protected health information (PHI) depends on who creates or holds the records and in what capacity—not simply on whether the information is medical. HIPAA applies to covered entities, such as qualifying health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically, and to their business associates handling PHI on their behalf.

For most K–12 schools, student health information kept as an education record under FERPA is not PHI under HIPAA. A school may also not be a HIPAA covered entity at all. However, a separate clinic or health care provider involved in testing may be covered by HIPAA, depending on its activities and records. Review how each organization handles the data rather than assuming one privacy law governs every copy. See the HHS guidance on HIPAA and schools and the joint HHS and Department of Education guidance on FERPA and HIPAA.

A vendor is not automatically a HIPAA business associate just because it sells or administers a testing product. If a HIPAA-covered provider engages a vendor to create, receive, maintain, or transmit PHI on the provider’s behalf, the vendor may be a business associate and a business associate agreement (BAA) may be required. A vendor handling school education records may instead have obligations under FERPA and its agreement with the school. HHS explains the business associate relationship in its business associate guidance.

What information baseline testing collects and how it supports post-injury comparison

The specific data depend on the program and assessment. A baseline record may include identifying details, symptoms, relevant health history, and results from cognitive, balance, or other evaluations. Keep an inventory of the fields collected, who administers each assessment, where the record is stored, and whether results are shared with a clinician or school.

A clinician may compare a post-injury assessment with an athlete’s pre-injury information to help understand changes in symptoms or performance. A comparison is one source of information, not a diagnosis by itself: concussion assessment also considers the injury, symptoms, and clinical evaluation. The CDC overview of mild TBI and concussion notes that neurocognitive tests can help assess effects on areas such as memory and concentration, but a normal test result does not rule out concussion.

Baseline testing also has limits. For children, CDC guidance reports insufficient evidence that baseline testing better identifies mild traumatic brain injury than post-injury scores alone. Programs should explain the test’s purpose and limits and should not treat a baseline score as a stand-alone clearance or return-to-play decision. See the CDC pediatric mTBI diagnostic recommendations.

Who may access or receive an athlete’s baseline results

Access depends on the record’s legal status, the organization holding it, and the person’s role. For a HIPAA-covered organization, the Privacy Rule’s minimum necessary standard generally calls for reasonable limits on many uses and disclosures of PHI. It does not apply to every situation—for example, HIPAA exempts disclosures to or requests by a health care provider for treatment. See HHS guidance on the minimum necessary standard.

For school education records, FERPA generally allows access without parent or eligible-student consent only to school officials the school has determined have a legitimate educational interest. A school should define that interest and use reasonable methods to limit access accordingly. Coaches and other staff may need information relevant to safety or participation, but that does not automatically mean they need the full assessment or raw results. See the Department of Education’s FERPA FAQs.

Decide in advance who needs access for clinical care, school administration, or athletics operations, and share only what is appropriate for that purpose. Keep clinical records separate from school records where appropriate, and make clear which organization is responsible for each record and disclosure.

How consent and disclosure forms should address athletes and minors

Do not treat consent to participate in testing as blanket permission to distribute results. Explain what information is collected, who will receive it, why it may be shared, how long the permission lasts, and how to ask questions or withdraw permission when applicable. Make the form understandable to the athlete and, where appropriate, the parent or guardian.

When HIPAA requires an authorization for a disclosure, the form must meet HIPAA’s requirements. These include describing the information and purpose, identifying the person or class of persons authorized to disclose and receive it, and stating an expiration date or event. It must also address revocation and the potential for redisclosure. A notice of privacy practices does not replace an authorization when one is required. See HHS’s Summary of the HIPAA Privacy Rule and its explanation of when written authorization is required.

For school records, FERPA consent for disclosure generally must be signed and dated, specify the records to be disclosed, state the purpose, and identify the recipient or class of recipients. FERPA rights generally belong to a parent until they transfer to the student—usually when the student turns 18 or attends a postsecondary institution. HIPAA’s rules about a parent acting as a minor’s personal representative are separate and have exceptions, including under applicable state law. Confirm the correct rule for the organization and the athlete’s circumstances using the joint HHS and Department of Education guidance and the Department of Education’s FERPA FAQs.

How to safeguard and log access to testing records

Start by identifying where paper and electronic records are stored, which systems transmit them, and who is responsible for each safeguard. HIPAA-covered organizations must conduct a risk analysis and implement reasonable and appropriate administrative, physical, and technical safeguards for electronic PHI. The Security Rule includes an audit-controls standard for systems that contain or use electronic PHI. See the HHS Summary of the HIPAA Security Rule.

Use role-based access control as a practical way to match system permissions to job duties: give each authorized user an individual account, limit access to the records needed for that role, and remove access when duties change. Protect records in storage and transit, secure paper files, and establish procedures for reporting suspected loss or inappropriate access. These are safeguards to assess through the organization’s risk analysis; no single technology or vendor claim proves that a program is compliant.

Maintain and review an audit log that can help identify who accessed a record and when, and investigate unusual activity under written procedures. For records covered by FERPA, schools generally must keep a record of requests for and disclosures of personally identifiable information, subject to exceptions such as some disclosures to school officials with a legitimate educational interest. See the Department of Education’s guidance on FERPA disclosure records.

Which school, state, and sports-organization rules may affect testing requirements

HIPAA governs privacy and security for covered entities and business associates; it does not establish a universal requirement that every athlete receive baseline concussion testing. School policies, state or local requirements, and sports-organization rules may separately address concussion education, removal from play, evaluation, clearance, documentation, or testing. Check the rules that apply to the athlete’s school, sport, and jurisdiction rather than relying on a general assumption.

The CDC advises health care professionals to learn the applicable state, league, and sports-governing-body concussion laws or policies before the season. Its guidance notes that some policies may require training or written clearance during return to play. See CDC HEADS UP clinical guidance.

For NCAA member schools, current NCAA materials require a concussion management plan that includes an updated concussion safety protocol; requirements should be checked against the current checklist and applicable divisional rules. That does not by itself establish that every athlete must undergo baseline testing. Review the NCAA concussion safety and management resources and confirm local obligations with the appropriate school officials.

What policies and staff training help document program compliance

Written policies should identify the purpose of testing, the record owner, permitted users, disclosure process, retention and disposal practices, vendor responsibilities, and the response to suspected unauthorized access. If a HIPAA-covered entity uses a vendor as a business associate, the BAA should define permitted uses and disclosures, safeguards, incident reporting, and other required terms. HHS provides sample BAA provisions.

Train staff on the policies that apply to their roles: how to handle results, verify a recipient’s authority, use secure systems, report incidents, and avoid unnecessary sharing. HIPAA requires covered entities and business associates to implement security awareness and training for workforce members; it does not establish a universal annual certificate-renewal requirement. Keep records of the training provided, participants, dates, and any employer-specific policy acknowledgment. See the HHS Security Rule summary.

In summary, determine whether each record is governed by HIPAA, FERPA, or another applicable rule; define appropriate access and disclosures; safeguard and log records; and document the policies and training that support the program. Recheck state, school, and sports-organization requirements as they apply to each season and setting.

FAQs

Are concussion baseline test results protected health information under HIPAA?

Sometimes. Results may be PHI when held by a HIPAA covered entity or business associate and not subject to an exception. Student health information held as a FERPA education record is generally excluded from HIPAA’s PHI definition. The answer depends on who holds the record and in what capacity. See the HHS guidance on HIPAA and schools.

Can a school receive an athlete’s baseline results without written consent?

It depends on which law applies and the circumstances. Under FERPA, a school may disclose education-record information without consent in certain circumstances, including to school officials with a legitimate educational interest. A covered health care provider disclosing HIPAA-protected results to a school may need a valid authorization unless another HIPAA permission applies. Confirm the record’s status and the specific disclosure basis before sharing. See the joint HHS and Department of Education guidance.

Does HIPAA apply to a concussion testing vendor?

It may. A vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity may be a business associate and may need a BAA. A vendor working with a school’s FERPA education records is not automatically a HIPAA business associate; the school’s FERPA obligations and its contract with the vendor may apply instead. See HHS business associate guidance.

Is baseline concussion testing required for every athlete?

No universal federal requirement requires baseline concussion testing for every athlete. Requirements may differ under state or local rules, school policies, or sports-organization requirements. Baseline tests also have limitations and should not replace evaluation by a health care professional. Check the rules for the relevant sport and setting, and see the CDC guidance on applicable concussion policies and CDC pediatric mTBI diagnostic recommendations.