Michigan Mental Health Code Privacy Overlay for School-Linked Therapists: HIPAA vs FERPA Explained

Working inside a school while affiliated with a healthcare organization creates a unique “privacy overlay.” This guide clarifies how Health Information Privacy Laws apply to school-linked therapists in Michigan, distinguishing when FERPA or HIPAA controls and how the Michigan Mental Health Code adds stronger protections.

FERPA Privacy Requirements in Schools

FERPA protects education records that contain Personally Identifiable Information (PII) about a student. In K–12 settings, most counseling, behavioral, and special education documents maintained by the district are education records, making Educational Records Confidentiality the default rule for school-held information.

“Sole possession” notes used only as a personal memory aid and not shared are outside the education record. The moment a note is shared with another school official or stored where others can access it, it becomes an education record subject to FERPA.

FERPA generally requires prior Written Authorization from a parent (or the eligible student) before disclosing education records, with narrow exceptions. Common exceptions include disclosure to school officials with a legitimate educational interest and limited releases during a health or safety emergency.

Parents and eligible students have the right to inspect and request amendment of education records. If a community clinician sends a care summary to the school, the copy in school custody becomes a FERPA education record while the clinician’s copy remains governed by the clinician’s own rules.

HIPAA Privacy Standards for Healthcare Providers

HIPAA protects a patient’s Protected Health Information (PHI) held by covered entities (providers, health plans, clearinghouses) and their business associates. HIPAA does not apply to FERPA education records, but it does apply to a community mental health clinic’s records created for treatment—even if services occur on a school campus.

Under HIPAA, PHI may be used or disclosed for treatment, payment, and healthcare operations without a Written Authorization. The “minimum necessary” standard applies to most disclosures, but not to disclosures between providers for treatment. De-identified data and limited data sets support coordination when full PHI is not necessary.

Psychotherapy notes kept separate from the medical record receive heightened protection and typically require explicit Written Authorization for disclosure. Routine progress notes in the medical record are PHI and follow HIPAA’s standard rules.

School districts are usually not HIPAA covered entities. A school-linked therapist employed by a hospital or community mental health agency follows HIPAA for the clinic record; anything the school stores about the student remains under FERPA.

Michigan Mental Health Code Confidentiality Provisions

Michigan’s Mental Health Code adds stricter confidentiality for “recipients” of mental health services. It requires Behavioral Health Consent that is specific, time-limited, and informed before most Mental Health Record Disclosure to third parties.

Valid consent typically identifies the disclosing provider, the recipient of the information, the purpose of disclosure, the exact information to be shared, the expiration date/event, and the right to revoke. Disclosures are usually accompanied by a notice against redisclosure to preserve confidentiality down the line.

The Code recognizes limited disclosures without consent (for example, internal care coordination, mandated reporting, court orders, or to prevent or lessen a serious threat). When the Code is more protective than HIPAA, Michigan providers follow the stricter state rule.

When a minor lawfully consents to certain services, the minor often controls disclosure for those services. Where a parent or guardian consents to care, they generally act as the personal representative, subject to specific exceptions designed to protect the minor’s safety and privacy.

Interaction Between HIPAA and FERPA in Educational Settings

Which law applies turns on three variables: who created the record, who maintains it, and why it is used. Education records maintained by a school fall under FERPA and exclude HIPAA. Clinical records maintained by an outside provider are PHI under HIPAA and can be stricter still under the Michigan Mental Health Code.

• School-employed counselor or psychologist: records kept by the district are FERPA education records (PII), not HIPAA.
• Community provider on campus: the provider’s chart is HIPAA PHI; any summary sent to the school becomes a FERPA education record in the school’s custody.
• Hospital-run school-based health center: clinic records are HIPAA PHI; documents the school keeps are FERPA.
• Teletherapy arranged by the school: the vendor’s treatment record is HIPAA PHI; information the school stores is FERPA.

Apply the “most protective rule wins” approach: if the Michigan Mental Health Code or 42 CFR Part 2 (for substance use disorder programs) is more restrictive than HIPAA, follow the stricter requirement in addition to FERPA’s limits on the school side.

Behavioral Health Information Sharing Protocols

Build a practical overlay that maps record origin, custodian, and purpose to the controlling law for each data element. Label segments clearly (PII under FERPA, PHI under HIPAA, psychotherapy notes, and any substance use disorder data with heightened protection).

• Governance: establish a written matrix describing when FERPA, HIPAA, the Michigan Mental Health Code, and other Health Information Privacy Laws apply. Name decision-makers for close calls.
• Consent management: standardize Written Authorization forms that capture all legally required elements and include no-redisclosure notices for mental health and substance use information.
• Access controls: under FERPA, share only with school officials who have a legitimate educational interest; under HIPAA and the Code, use role-based access and the minimum necessary principle (recognizing the treatment exception under HIPAA).
• Data segmentation: keep psychotherapy notes and any specially protected behavioral health content in separate sections so you can disclose precisely what consent covers.
• Secure exchange: use encrypted channels and approved portals. Avoid email or shared drives for sensitive Behavioral Health Consent–governed data.
• Break-the-glass: define emergency workflows that allow time-limited access, capture rationale, and trigger post-incident review.
• Documentation and training: record the legal basis for each disclosure, track expirations of consent, and train staff annually on the overlay.

Consent Requirements for Mental Health Records

Under FERPA, disclosure of education records requires prior Written Authorization from a parent or eligible student, unless a specific exception applies. Authorizations should name the recipient, describe the records, state the purpose, and be signed and dated.

Under HIPAA, you need a valid authorization for uses and disclosures beyond treatment, payment, and healthcare operations. Psychotherapy notes almost always require explicit authorization. For routine coordination with a school, obtain consent unless another concrete HIPAA permission clearly applies—and remember, once the school holds a copy, FERPA governs that copy.

Under the Michigan Mental Health Code, most Mental Health Record Disclosure requires Behavioral Health Consent that is specific and time-limited. Include the elements of a valid release, the right to revoke, and a prohibition on redisclosure. Where a minor has the legal right to consent to a service, the minor typically controls release of that related information.

Practical tip: design forms that clearly explain what will be shared (for example, attendance, diagnosis, treatment plan summaries) so families can make informed choices and you can honor the minimum necessary principle.

Emergency Disclosure Exceptions

FERPA allows disclosure of PII from education records without consent during a health or safety emergency to parties whose knowledge is necessary to protect the student or others. Schools should document the threat, recipients, and rationale immediately after the event.

HIPAA permits disclosures to prevent or lessen a serious and imminent threat to health or safety, consistent with professional judgment. Providers may also share limited PHI with parents or caregivers involved in the student’s care when it is in the student’s best interest.

Michigan’s Mental Health Code authorizes narrowly tailored disclosures to protect the recipient or others from a serious threat and to comply with mandates such as abuse or neglect reporting. Share only what is necessary, record the basis for disclosure, and follow up with standard consent workflows once the emergency passes.

Conclusion

For school-linked therapists in Michigan, start with custody and purpose to decide whether FERPA or HIPAA applies, then layer on the Michigan Mental Health Code for added confidentiality. Use precise Written Authorization, segment sensitive content, and document your legal basis so Behavioral Health Information Sharing is both safe and lawful.

FAQs.

How does FERPA protect student mental health records?

FERPA safeguards education records containing PII, which include most school-maintained counseling and behavioral records. Disclosure generally requires Written Authorization from a parent or eligible student, with limited exceptions such as a health or safety emergency or access by school officials who have a legitimate educational interest.

When does HIPAA apply to school-linked therapists?

HIPAA applies to the therapist’s clinical record when the therapist works for a HIPAA-covered provider (such as a hospital or community mental health agency), even if services occur on school grounds. However, once information is placed in the school’s custody, that copy is a FERPA education record and no longer HIPAA PHI.

What are the consent requirements under Michigan Mental Health Code?

The Code generally requires Behavioral Health Consent before disclosing mental health information. A valid consent specifies the recipient, purpose, exact information, expiration, and the right to revoke, and it typically includes a prohibition on redisclosure. When legally permitted, a minor may control disclosure for services the minor consented to receive.

Can schools disclose mental health information without consent in emergencies?

Yes. FERPA allows disclosure of relevant PII from education records during a health or safety emergency to parties who need the information to protect the student or others. Disclose only what is necessary, and document the threat, recipients, and rationale immediately after the event.