HIPAA vs. FERPA Compliance for School-Based Health Centers

Which law applies to school-based health center records?

The answer depends on who maintains the records and whether that person or organization acts on behalf of the school. FERPA generally applies to education records maintained by a school that is subject to FERPA, or by a party acting for that school. HIPAA may apply to records maintained independently by a healthcare provider that qualifies as a HIPAA covered entity.

FERPA education records are records directly related to a student and maintained by a covered school or by someone acting for it. HIPAA’s definition of protected health information excludes education records covered by FERPA and certain FERPA treatment records. That HIPAA Privacy Rule exclusion means the same student health record is not automatically governed by both privacy rules. FERPA’s definitions in 34 CFR § 99.3 and HIPAA’s definitions in 45 CFR § 160.103 describe these categories.

Start by identifying the record holder, the provider’s relationship with the school, and the provider’s billing and data practices. A school-based health center may handle FERPA records, HIPAA records, or both laws across separate records and patient groups. The federal agencies’ joint FERPA and HIPAA guidance explains how to assess the distinction.

When does FERPA cover student health records?

FERPA generally covers a student’s health record when a FERPA-subject school maintains it, or when a provider maintains it on the school’s behalf. The record does not have to be created on school premises: the key issue is the relationship between the record holder and the school, not simply where care takes place.

For example, records created by a school nurse or by a clinic contracted to provide services for the school may be FERPA education records if the school maintains them or the clinic acts on the school’s behalf. A clinic’s independent records do not become FERPA records merely because the clinic serves students at school. The HHS explanation of school student health records distinguishes school-directed services from independent care.

FERPA applies to educational agencies and institutions that receive funding under programs administered by the U.S. Department of Education. Private and religious K–12 schools generally are not subject to FERPA unless they meet the law’s applicability requirements. When FERPA applies, the parent’s rights generally transfer to the student at age 18 or upon attendance at a postsecondary institution, making the student an “eligible student.” Check the school’s status and the student’s age or enrollment before deciding whose permission is required.

When does HIPAA apply to an independent healthcare provider?

An independent provider’s records may be subject to HIPAA when the provider is a covered entity. A healthcare provider generally meets that definition when it transmits health information electronically in connection with a transaction for which HIPAA has adopted a standard, such as submitting claims electronically to a health plan. A provider that bills health plans electronically may therefore be a HIPAA covered entity; being located at a school does not by itself change that analysis.

HIPAA generally does not apply to records that are FERPA education records or qualifying FERPA treatment records, even if a provider or school also meets the definition of a covered entity. Conversely, if an independent provider creates and maintains records outside the school’s control and the provider conducts covered electronic transactions, HIPAA may govern those records. See the HHS guidance on providers who are not employed by a school and the HIPAA definitions in 45 CFR § 160.103.

How do provider contracts and school control affect compliance?

A contract is important evidence of the parties’ roles, but signing a school agreement does not alone decide which law governs each record. Consider what the provider actually does: whether it performs a school function, whether the school directs or controls how records are used and maintained, and whether the provider separately operates a healthcare practice and keeps independent clinical records.

A provider performing an institutional service for the school may qualify as a school official under FERPA’s school official exception, if the regulatory conditions are met. These include the school’s direct control over the provider’s use and maintenance of education records and limits on how the provider may use or redisclose personally identifiable information. The exception is not a blanket permission for any outside clinician to access a student’s school file. Review the conditions in 34 CFR § 99.31 and the Department of Education’s guidance for school officials.

Contracts should clearly describe which party maintains each record set, the purpose of access, permitted uses and disclosures, security responsibilities, retention and return or destruction of records, and how the parties will respond to access requests or incidents. Treat these provisions as an operational way to document responsibilities; a contract cannot replace the requirements of the law that applies to a particular record.

What consent is required to share student health information?

Under FERPA, a school generally must obtain prior written consent before disclosing personally identifiable information from a student’s education records, unless a FERPA exception applies. Consent must identify the records to be disclosed, state the purpose of disclosure, and identify the party or class of parties receiving the records. In K–12 settings, the parent generally exercises FERPA rights until they transfer to the eligible student. See 34 CFR § 99.30.

That rule matters when a school shares school-held records with an independent outside provider: the provider’s presence on campus does not itself authorize the school to release the student’s records. The school needs valid FERPA parental consent or consent from the eligible student, unless a specific exception permits the disclosure.

For records governed by HIPAA, a provider may disclose protected health information without an authorization in some situations, including certain treatment, payment, and healthcare operations disclosures. Other disclosures generally require a valid HIPAA authorization unless another permission or requirement applies. HIPAA treatment permissions do not override FERPA requirements for school-held education records. When both a school and provider will disclose information from their respective record systems, assess each disclosure separately and obtain the applicable FERPA consent, HIPAA authorization, or both when required. See 45 CFR § 164.506 and 45 CFR § 164.508.

State laws may give minors independent rights to consent to particular services or limit parental access to related records. Check applicable state law and the center’s policies before treating parent consent as sufficient or assuming a parent may access all records.

Which FERPA exceptions may permit disclosure without consent?

FERPA allows, but generally does not require, a school to disclose personally identifiable information without consent when a specific exception applies. Commonly relevant exceptions include:

• School official exception: The school may disclose records to a school official with a legitimate educational interest. A contractor, consultant, or other outside party may qualify when it performs an institutional service the school would otherwise use employees to perform, is under the school’s direct control regarding use and maintenance of records, and meets the applicable redisclosure conditions.
• Health or safety emergency: The school may disclose information to appropriate parties when an articulable and significant threat to a student or another person exists, and the recipient needs the information to protect health or safety. The school must follow FERPA’s emergency conditions and recordkeeping requirements. See 34 CFR § 99.36.
• Other defined exceptions: Depending on the circumstances, FERPA may permit disclosure to comply with a lawful subpoena or court order, to authorized representatives conducting an audit or evaluation, or for qualifying studies. Each exception has its own conditions; the school should confirm that the particular disclosure fits the rule before sharing information.

An exception is not a general authorization to share a student’s full file. The school should document the basis for disclosure and limit the information to what is appropriate for the exception and purpose. The joint HHS and Department of Education guidance discusses consent and exceptions for student health information.

How should centers separate and manage records governed by different laws?

Begin with a written record map that identifies who creates and maintains each record, whether the provider acts on the school’s behalf, whether the information is part of a FERPA education record, and whether the provider is a HIPAA covered entity for its independent records. Revisit the map when contracts, billing arrangements, or clinic operations change.

Where the center handles separate FERPA and HIPAA record sets, use clear procedures to keep roles and permitted disclosures distinct. Depending on the center’s systems, this may include separate records or clearly marked record segments, role-based access, staff training, distinct consent and authorization forms, and procedures for routing requests to the appropriate custodian. These are practical safeguards for implementing the applicable rules, not a universal federal requirement to use physically separate databases.

Train staff to recognize which rules apply before they disclose information. FERPA rights and school policies govern the school’s education records; HIPAA policies govern protected health information held by a covered provider. For example, an independent provider may be permitted under HIPAA to disclose information for treatment, while the school still needs FERPA consent or a valid FERPA exception to release its own records to that provider.

In short, determine who maintains each record and whether the provider acts for the school or independently. Apply FERPA to school-controlled education records, HIPAA to eligible independent-provider records, and use written workflows and access controls to prevent one record set’s permissions from being mistaken for the other’s.

FAQs

Are health records from care delivered at school automatically covered by FERPA?

No. The location of care alone does not determine whether FERPA applies. Records generally fall under FERPA when a FERPA-subject school maintains them or a provider maintains them on the school’s behalf. An independent provider’s records do not automatically become FERPA records because care occurs on campus.

Can a school-based health center be subject to both HIPAA and FERPA?

Yes, a center or its affiliated organizations may handle different records governed by different laws. For example, school-maintained student education records may be governed by FERPA, while an independent provider’s separate records for covered services may be governed by HIPAA. FERPA education records and qualifying treatment records are excluded from HIPAA’s definition of protected health information.

Does HIPAA apply to an independent provider that bills health plans electronically?

Often, if the provider electronically transmits health information in connection with a HIPAA-standard transaction, such as submitting claims to a health plan, and the records are not excluded as FERPA records. The provider should assess its actual billing and transaction practices and the relationship between its records and the school.

When can a school share student health information with an outside provider without parental consent?

A school may share personally identifiable information from education records without parental consent only when a FERPA exception applies. Potentially relevant exceptions include disclosure to a qualifying school official with a legitimate educational interest or disclosure to appropriate parties during a qualifying health or safety emergency. An independent provider’s campus location alone is not an exception.