HIPAA Training for School-Based Health Center Support Staff

Who needs HIPAA training at a school-based health center?

HIPAA training depends on which organization maintains the health records and whether that organization is covered by HIPAA. A school-based health center may be operated by a school, a health care provider, or a separate organization working with the school. The setting alone does not determine which privacy law applies.

If the health center is a HIPAA-covered entity or business associate, staff members who handle protected health information (PHI) as part of the organization’s workforce need training appropriate to their duties. This can include reception, scheduling, records, billing, interpreter, and administrative staff—not only clinicians. The HIPAA Privacy Rule requires covered entities to train workforce members as necessary and appropriate for their functions. See the HIPAA Privacy Rule training requirement.

When records are governed by FERPA rather than HIPAA, the organization should train relevant staff on applicable school privacy rules and its own procedures. Staff should follow the policies of the organization that employs or supervises them, including any agreements between the health center and school.

How do HIPAA and FERPA apply to student health records?

FERPA education records generally include records directly related to a student that are maintained by a school—or by a party acting for the school. A school nurse or contracted provider acting on the school’s behalf may therefore maintain records governed by FERPA, even when care is provided on school grounds. Student records that qualify as FERPA education or treatment records are excluded from HIPAA’s definition of PHI.

A separate health care provider that serves students directly, rather than acting on behalf of the school, may maintain records outside FERPA. HIPAA may apply to those records if the provider is a covered entity, such as by conducting certain health care transactions electronically. A center’s arrangement and role—not its location—are key. The HHS and Department of Education joint guidance on FERPA and HIPAA explains how to assess these situations.

Some organizations may hold different kinds of records subject to different rules. Staff should confirm which system and record type they are handling before applying a disclosure rule or responding to a request.

What privacy practices should support staff follow?

Use only the information needed for your assigned work, and share it only with people who are authorized to receive it for a permitted purpose. The HIPAA minimum necessary standard generally calls for reasonable limits on access, use, and disclosure; it does not apply to certain disclosures, including provider-to-provider disclosures for treatment. Follow your organization’s stricter role-based access and confidentiality policies as well. See HHS guidance on the minimum necessary standard.

• Verify a person’s identity and authority before discussing or releasing information.
• Keep conversations about students private; avoid discussing health details in hallways, shared work areas, or where visitors can overhear.
• Secure paper files, forms, screens, and devices; do not leave records visible or unattended.
• Use only approved systems and methods to send information. Do not use personal email, messaging, or storage for student records unless your organization authorizes it.
• Do not access a record out of curiosity or share passwords. Report a misdirected message, lost device, or suspected unauthorized access promptly through your organization’s reporting process.

A suspected privacy or security incident should be reported to the designated privacy or security contact right away. Staff should preserve relevant details and let the responsible organization assess whether a breach occurred and whether notification is required. HIPAA breach notification duties apply to covered entities and business associates when the rule’s requirements are met; see the HHS Breach Notification Rule guidance.

What should HIPAA training cover?

Training should match staff members’ roles and the records they handle. For support staff, practical topics may include:

• Whether the records they work with are governed by HIPAA, FERPA, or another applicable rule.
• How to recognize PHI and electronic protected health information (ePHI), and when access or disclosure is allowed.
• Minimum necessary practices, confidentiality, identity verification, and secure handling of paper and electronic records.
• How to route requests involving patient access rights, parents or guardians, school staff, law enforcement, or outside providers to the appropriate privacy contact.
• How to identify and promptly report suspected privacy incidents, security incidents, or breaches under the organization’s procedures.
• Applicable sanctions and the organization’s current privacy, security, retention, and communication policies.

The HIPAA Security Rule also requires regulated organizations to have a security awareness and training program for their workforce. HIPAA does not set a universal annual certificate-renewal requirement; the organization must provide training in accordance with the applicable rules and its policies. The Privacy Rule specifies training for new workforce members within a reasonable period and for affected staff after material policy changes. See 45 CFR § 164.530 and the HHS summary of the HIPAA Security Rule.

How should staff limit access to electronic protected health information?

Access to ePHI should be based on job responsibilities. Use only your own assigned account, lock or log out of a workstation when you step away, and do not view records unrelated to your work. Report access that appears broader than necessary, and ask a supervisor or privacy contact when a task requires information you cannot access.

Covered entities must use safeguards to protect ePHI, including access controls suited to workforce members’ roles. The Security Rule also requires unique user identification so system activity can be associated with an individual user. See HHS guidance on unique user IDs and its technical safeguards guidance.

Do not share login credentials, bypass access controls, or save ePHI to unapproved locations. If your role changes or you no longer need access, follow the organization’s process for adjusting permissions.

When may student health information be shared?

First identify which law governs the record. Under HIPAA, a covered entity may use or disclose PHI for certain purposes without an individual’s authorization, including treatment, payment, and health care operations, and may disclose it in other circumstances permitted by the Privacy Rule. Other disclosures may require authorization. Staff should follow the organization’s procedures rather than deciding on their own that an exception applies.

Under FERPA, schools generally need consent to disclose personally identifiable information from education records unless an exception applies. Exceptions can include disclosures to school officials with a legitimate educational interest and, subject to conditions, disclosures in a health or safety emergency. The Department of Education’s FERPA guidance on student health records describes these rights and exceptions.

Do not assume that a parent, teacher, school administrator, or other person is automatically entitled to information. Under HIPAA, a parent’s access to a minor’s records can depend on applicable law and the circumstances of the care. Route requests to the health center’s privacy contact, who can verify authority and apply the right rule. See HHS guidance on personal representatives and minors.

How do state requirements affect staff training?

State law may provide additional privacy protections, regulate when minors can consent to care, or affect parental access to a minor’s records. HIPAA generally allows more stringent state privacy protections to apply where the laws conflict, and some state requirements can apply alongside federal rules. FERPA and state education or health privacy requirements may also affect school-held records.

Because requirements vary by state and by the health center’s relationship with the school, training should use current employer-specific policies and procedures. Ask the organization’s privacy officer or legal contact when state rules, consent, parent access, or a disclosure request is unclear. HHS explains when a state privacy law may be more stringent in its guidance on HIPAA and state law.

In short, effective training starts by identifying which rules govern each record, then teaches staff to use approved access, disclosure, and incident-reporting procedures—and to seek guidance whenever authority or a permitted disclosure is uncertain.

FAQs

Are student health records covered by HIPAA or FERPA?

It depends on who maintains the records and whether that party acts on behalf of the school. Records maintained by a school or a party acting for it are generally FERPA education records; an independent health care provider’s records may instead be subject to HIPAA if the provider is a covered entity. See the joint HHS and Department of Education guidance.

Do school-based health center support staff need HIPAA training?

Support staff who are members of a HIPAA-covered organization’s workforce and handle PHI need training appropriate to their duties. If the records are governed by FERPA instead, staff still need training on applicable school privacy requirements and employer-specific procedures.

What privacy topics should support staff training include?

Training should cover the rules that apply to the records staff handle, appropriate access and disclosure, minimum necessary practices, secure handling of paper and ePHI, request routing, and prompt incident reporting. It should also explain the organization’s current policies and where to get help.

When can staff share student health information?

Staff may share information only when permitted under the law that applies to the record and the organization’s procedures. HIPAA and FERPA allow some disclosures without individual consent, but the conditions differ. When a request involves a parent, school official, outside provider, or emergency, refer it to the designated privacy contact unless your role and training authorize you to respond.