Security Risk Analysis for School‑Based Health Center EHRs: A Step‑by‑Step HIPAA/FERPA Compliance Guide

HIPAA Security Rule Requirements

A security risk analysis is the foundation of HIPAA compliance for school‑based health center EHRs. Your goal is to protect the confidentiality, integrity, and availability of electronically stored protected health information (ePHI), including data in EHR modules, patient portals, telehealth platforms, lab interfaces, and backups.

The Security Rule organizes safeguards into three categories: administrative, physical, and technical. Some implementation specifications are “required,” while others are “addressable,” meaning you must implement them if reasonable and appropriate, or document equivalent measures. Either way, you need clear justification and thorough compliance documentation.

Scope your program beyond the EHR screen. ePHI also resides in imaging attachments, export files, mobile devices, shared workstations in school clinics, and integrations with immunization registries. Covered entities and their business associates must maintain policies, workforce training, and ongoing evaluations to keep controls effective as technology and school operations change.

Risk Assessment Process

Step‑by‑Step Approach

• Define scope and objectives: include the EHR, telehealth tools, messaging, e‑prescribing, interfaces, on‑site and remote devices, and third‑party services that create, receive, maintain, or transmit ePHI.
• Inventory assets and map data flows: document where ePHI is created and stored, who accesses it, and how it moves between systems and locations across the campus and partner sites.
• Identify threats and vulnerabilities: consider phishing, lost laptops, weak access controls, improper disclosures to school staff, shared nurse workstations, substitute staff, and after‑hours access.
• Assess existing controls: policies, authentication, encryption, logging, device management, vendor safeguards, and procedures for downtime and emergency mode operations.
• Analyze likelihood and impact: rate each risk, calculate a risk level, and prioritize remediation using a clear methodology that leadership understands.
• Select and plan mitigations: assign owners and dates, define configuration changes, training, contracts (e.g., BAAs), and budget items, and set measurable success criteria.
• Validate controls: perform access reviews, configuration baselines, vulnerability scans, phishing tests, and tabletop exercises for incident response and recovery.
• Create compliance documentation: maintain the risk register, remediation plan, management sign‑offs, and evidence (screenshots, logs, reports) supporting every control.
• Monitor and reassess: track metrics, review audit logs, and re‑run the analysis after major changes, incidents, or at least annually.

Using a security risk assessment tool

A security risk assessment tool can streamline data collection, standardize scoring, and generate exportable reports for auditors. Use it to centralize your asset inventory, risk register, control testing evidence, and remediation tracking across administrative safeguards, physical safeguards, and technical safeguards.

Common SBHC risk scenarios to test

• Shared workstation in a nurse’s office without automatic logoff or privacy screens.
• Provider texting PHI to school staff instead of using secure messaging.
• Telehealth conducted from a classroom without acoustic privacy.
• Chromebooks used to access the EHR without device encryption or MDM.
• Interface sending data to the student information system that inadvertently exposes ePHI.

Administrative Safeguards

Governance and roles

• Designate a security official and privacy lead for the health center component; define decision rights, escalation paths, and meeting cadences.
• Adopt risk management and change management procedures so security is considered in every new tool, integration, or workflow.

Policies, procedures, and training

• Document acceptable use, remote access, telehealth privacy, secure messaging, email encryption, media disposal, and incident response.
• Deliver role‑based training at hire and annually; include phishing awareness, minimum necessary use, and data handling in mixed FERPA/HIPAA environments.
• Maintain training rosters, attestations, and quiz results as compliance documentation.

Workforce security and access management

• Provision unique user IDs with role‑based access; require supervisor approval and periodic access recertification.
• Establish rapid offboarding for departing staff and substitutes; prohibit credential sharing and shared “nurse” logins.
• Enforce the minimum necessary standard for all uses and disclosures of ePHI.

Incident response and breach handling

• Create a playbook for detection, containment, investigation, notification, and post‑incident review.
• Define who investigates when PHI crosses from a HIPAA‑covered component to education records protected by FERPA, and how to coordinate remedial actions.

Contingency planning

• Maintain data backups, disaster recovery procedures, and emergency mode operations for clinical continuity during power or network outages.
• Test downtime workflows for the EHR and prescriptions; log test outcomes and corrective actions.

Vendor and third‑party management

• Screen vendors for security posture; execute business associate agreements when they create, receive, maintain, or transmit ePHI on your behalf.
• Define service levels for security events, breach reporting, and audit support.

Administrative evidence to keep

• Risk analysis and risk management plan, management approvals, and progress reports.
• Policies, procedures, and version history; workforce training logs and sanctions applied.
• Access reviews, incident reports, DR/BCP test results, and vendor assessments.

Physical Safeguards

Facility access and workstation security

• Restrict clinic spaces with keyed or badge access; maintain visitor sign‑in and escort policies.
• Use privacy screens and automatic session lock on shared nurse stations; position monitors away from student traffic.
• Secure paper intake forms and label printers; store records in locked cabinets when not in use.

Device and media controls

• Tag and inventory laptops, tablets, and removable media; require full‑disk encryption and cable locks where devices are left unattended.
• Implement a check‑in/out process for mobile carts; keep chain‑of‑custody logs.
• Sanitize or shred media before reuse or disposal; document every disposition.

Environmental and operational practices

• Plan for after‑hours clinics, school breaks, and multi‑purpose rooms that double as exam spaces.
• Audit for printed ePHI left at printers or whiteboards; remove and destroy promptly.
• Coordinate with facilities on alarms, cameras, and maintenance access to clinical areas.

Technical Safeguards

Access control

• Require unique user IDs, strong authentication, and multi‑factor authentication—especially for remote access and privileged roles.
• Configure role‑based access in the EHR; enable emergency (“break‑glass”) access with enhanced logging and justification prompts.
• Set automatic logoff and session timeouts on all clinical workstations and kiosks.

Encryption, integrity, and transmission security

• Encrypt ePHI at rest on servers, laptops, and mobile devices; enforce TLS for all data in transit, including APIs and patient portals.
• Use integrity controls such as checksums, secure backups, and tamper‑evident logs.
• Standardize secure interfaces (e.g., for immunization registries) and validate configurations after updates.

Audit controls and monitoring

• Enable comprehensive EHR audit logs (user, patient, action, time, source); regularly review high‑risk events and run “snooping” reports.
• Centralize system logs; alert on anomalous access, failed logins, and data exports.
• Retain logs per policy to support investigations and compliance documentation.

Endpoint and network protection

• Use mobile device management to enforce encryption, screen locks, patching, and app controls on laptops and tablets used in the clinic.
• Segment clinical networks from student and guest networks; apply firewalls and web filtering to block risky destinations.
• Run vulnerability management: scheduled scans, timely patching, and verification.

Data minimization and secure communications

• Disable unneeded EHR modules and suppress PHI fields from routine school communications.
• Adopt secure messaging within the EHR or a compliant platform; prohibit plain‑text email or SMS for PHI.
• Use DLP rules to detect and prevent unauthorized exports of electronically stored protected health information.

FERPA vs. HIPAA Applicability

When FERPA governs

• Education records maintained by an educational agency or institution, including records kept by school‑employed nurses and counselors, are generally subject to FERPA and excluded from HIPAA.
• Parents (or eligible students) typically have access rights under FERPA; disclosures require consent unless an exception applies.

When HIPAA governs

• If the school‑based health center is operated by a healthcare provider (e.g., hospital or FQHC) that bills electronically and maintains its own records, those records are usually HIPAA‑covered.
• The HIPAA‑covered provider must implement safeguards, provide a Notice of Privacy Practices, and manage business associate relationships for its operations.

Mixed environments and practical rules

• Copies of clinic records shared with the school become education records governed by FERPA, while the provider’s originals remain HIPAA‑covered.
• HIPAA permits disclosures for treatment, payment, and healthcare operations; FERPA sets separate rules for education records—apply the stricter rule for each dataset you handle.
• State laws on minors, immunizations, and sensitive services can add requirements—reflect them in policies, consent forms, and EHR configurations.

Hybrid Entity Designation

When a district operates both educational functions and clinical services, it can designate itself a hybrid entity. Only the designated health care components are HIPAA‑covered; the rest of the institution remains under FERPA. Clear boundaries, policies, and access controls prevent inadvertent mixing of records.

How to implement a hybrid entity model

• Identify and formally designate the health care component(s) that create, receive, maintain, or transmit ePHI.
• Separate systems and workflows: keep the EHR distinct from the student information system; segment networks and user directories where feasible.
• Assign workforce to components; train “dual‑hat” staff on which rules apply to which records and when to use secure messaging versus school channels.
• Issue component‑specific policies, notices, and procedures; maintain BAAs for vendors serving the HIPAA component.
• Conduct a focused security risk analysis on the HIPAA component and maintain ongoing evaluations.
• Document data sharing agreements with the school under minimum necessary principles and applicable consent standards.

Conclusion

Effective security risk analysis for school‑based health center EHRs ties together administrative safeguards, physical safeguards, and technical safeguards, all supported by living compliance documentation. Clarifying FERPA versus HIPAA boundaries—and, when needed, adopting a hybrid entity structure—reduces confusion, streamlines operations, and protects students’ and families’ trust.

FAQs

What is the difference between HIPAA and FERPA for school health records?

FERPA generally governs education records maintained by schools, including records kept by school‑employed nurses and counselors. HIPAA typically applies to records maintained by a healthcare provider operating the school‑based health center as a covered entity. If a clinic shares information with the school, the copies held by the school become FERPA records, while the provider’s originals remain HIPAA‑covered.

How do you conduct a risk assessment for school health EHRs?

Define scope, inventory assets and data flows, identify threats and vulnerabilities, assess current controls, score likelihood and impact, and prioritize mitigations. Validate with testing, assign owners and deadlines, and maintain a risk register and evidence. Reassess at least annually or after major changes, using a security risk assessment tool to standardize scoring and reporting.

What are the key administrative safeguards for HIPAA compliance?

Designated security leadership, written policies and procedures, workforce training, role‑based access, incident response and breach handling, contingency planning, vendor risk management (including BAAs where applicable), and periodic evaluations. Keep detailed compliance documentation—access reviews, training logs, incident reports, and DR test results—to prove controls are operating.

How should a school-based health center document compliance efforts?

Maintain the full risk analysis, remediation plan, and leadership approvals; store policies with version history; keep training rosters and sanctions; archive audit logs and access reviews; preserve vulnerability and configuration reports; and record outcomes from incident response and disaster recovery tests. Organize these artifacts within your security risk assessment tool or a structured repository for quick retrieval during audits.