HIPAA and FERPA in Schools: A Quick Reference for Parents and Teachers

HIPAA AND FERPA: THE ONE-SENTENCE RULE

FERPA usually governs student records maintained by a school or school district. HIPAA usually governs health information maintained by a covered healthcare provider or health plan. The same information may be protected by different laws depending on who holds the record and why.

FERPA AT A GLANCE

The Family Educational Rights and Privacy Act protects education records maintained by schools receiving U.S. Department of Education funds. Education records include information directly related to a student and maintained by the school or someone acting for it.

FERPA generally gives parents the right to inspect and review education records, request correction of information they believe is inaccurate or misleading, consent before personally identifiable information is disclosed, and file a complaint with the U.S. Department of Education. These rights transfer to the student at age 18 or when the student attends a postsecondary institution.

HIPAA AT A GLANCE

The Health Insurance Portability and Accountability Act protects health information held by covered healthcare providers, health plans, and healthcare clearinghouses. HIPAA does not automatically govern every health-related conversation or document.

When a healthcare provider sends information to a school with parent authorization, the copy maintained by the school generally becomes an education record governed by FERPA rather than HIPAA. The provider’s original record generally remains governed by HIPAA.

SCHOOL NURSE AND COUNSELING RECORDS

Health records kept by a public school nurse, school psychologist, counselor, or other school employee are usually education records under FERPA. HIPAA generally excludes FERPA education records from its coverage.

WHEN MAY A SCHOOL SHARE INFORMATION?

Under FERPA, a school may disclose education-record information without consent only when a specific exception applies. Common examples include disclosure to school officials with a legitimate educational interest, transfer to another school in which the student seeks or intends to enroll, response to a health or safety emergency, and disclosure of properly designated directory information after required notice and opt-out opportunity.

A health or safety emergency exception is limited to an actual, impending, or imminent emergency. It is not a general permission to share sensitive information broadly.

WHAT TEACHERS SHOULD DO

Access only the student information needed for your professional role. Use district-approved systems and communication channels. Verify recipients before sending records or discussing a student. Avoid identifying students in hallways, staff rooms, personal texts, social media, or unsecured email.

Do not promise absolute confidentiality. Explain that information may need to be shared with appropriate staff to protect the student or provide services. Before sharing information with an outside provider or advocate, confirm that valid consent or another legal basis is documented.

WHAT PARENTS SHOULD KNOW

Ask who will receive the information, what records will be shared, why they are needed, how long authorization will remain effective, and how consent can be revoked. Read releases carefully and limit them to the information and purpose actually needed.

Parents may request access to education records and may ask the school to explain its record-review, amendment, consent, complaint, and directory-information procedures.

COMMON SCHOOL SCENARIOS

A teacher discussing a student’s accommodation plan with staff responsible for implementing it is generally a FERPA matter and may be allowed under the school-official exception.

A pediatrician sending a diagnostic report to a school usually requires parent authorization under HIPAA. Once the school maintains the report for educational purposes, the school’s copy is generally covered by FERPA.

A school nurse calling emergency responders and sharing information necessary to address an imminent threat may be permitted under FERPA’s health or safety emergency exception.

Posting a student’s diagnosis, grade, behavior, or accommodation in a public or unsecured setting is inappropriate and may violate privacy requirements.

QUICK DECISION CHECK

Who maintains the record: a school or a healthcare provider?

Is the information directly related to a student and maintained by the school?

Does the person requesting it have a legitimate need connected to the student’s education or safety?

Is there written consent, or does a specific legal exception apply?

Am I using an approved, secure method and sharing only what is necessary?

When the answer is unclear, stop and consult the school’s privacy official before disclosing information.

This resource provides general educational information and is not legal advice. State law, district policy, professional ethics, and specific circumstances may add requirements.