HIPAA excludes information considered education records under FERPA law from its definition of protected health information. This means student records covered by the Family Educational Rights and Privacy Act are generally governed by FERPA rather than the HIPAA Privacy Rule, even when those records contain medical, psychological, disability or immunisation information.
The exclusion does not leave student health information unprotected. Instead, it determines which federal privacy framework applies. FERPA usually governs health information maintained by a school, while HIPAA may govern records maintained by an independent healthcare provider.
Understanding this distinction is essential for schools, colleges, healthcare providers, parents and students because the applicable law affects access rights, consent requirements and permitted disclosures.
Is the Statement True or False?
The statement “HIPAA excludes information considered education records under FERPA law” is true.
Under the HIPAA regulations, protected health information does not include individually identifiable health information found in:
- Education records covered by FERPA
- Certain treatment records described in the FERPA statute
- Employment records held by a covered entity in its role as an employer
- Records concerning a person who has been deceased for more than 50 years
The first two exclusions are particularly important in educational settings. If a student’s health information qualifies as a FERPA education record or a qualifying postsecondary treatment record, it is excluded from HIPAA’s definition of protected health information.
Why Does HIPAA Exclude FERPA Education Records?
HIPAA and FERPA protect different types of information and regulate different organisations.
FERPA was created to protect the privacy of student education records maintained by educational agencies and institutions. HIPAA regulates protected health information held by health plans, healthcare clearinghouses and certain healthcare providers.
Without the education-record exclusion, schools and colleges could face overlapping federal privacy requirements for the same record. The exclusion establishes a clearer division:
- FERPA governs qualifying student records maintained by schools.
- HIPAA governs qualifying health information maintained by covered healthcare entities.
- The organisation holding the record and the purpose for which it is maintained often determine which law applies.
The same health information may therefore be governed by different laws in different locations. A student’s diagnosis in a hospital record may be protected by HIPAA, while a copy provided to a FERPA-covered school may become part of the student’s education record and be protected by FERPA.
What Is FERPA?
The Family Educational Rights and Privacy Act is a federal law governing the privacy of student education records. It applies to educational agencies and institutions that receive funding through programmes administered by the United States Department of Education.
FERPA covers most public elementary and secondary schools and many colleges and universities. It may also apply to certain private educational institutions receiving applicable federal education funding.
FERPA provides parents and eligible students with rights that generally include:
- Inspecting and reviewing education records
- Requesting correction of inaccurate or misleading information
- Exercising some control over the disclosure of personally identifiable information
- Filing a complaint concerning an alleged FERPA violation
When a student turns 18 or begins attending a postsecondary institution at any age, FERPA rights generally transfer from the parent to the student. That individual is then called an eligible student.
What Is HIPAA?
The Health Insurance Portability and Accountability Act includes federal rules governing certain health information. The HIPAA Privacy Rule protects individually identifiable health information when it is held or transmitted by a covered entity or its business associate.
The main HIPAA-covered entities are:
- Health plans
- Healthcare clearinghouses
- Healthcare providers that transmit health information electronically in connection with covered transactions
Not every person or organisation handling medical information is automatically subject to HIPAA. For example, a school does not become a HIPAA-covered entity merely because it employs a nurse or maintains student health forms.
The school’s legal status, how healthcare services are delivered, whether covered electronic transactions occur and whether the records qualify under FERPA must all be considered.
FERPA vs. HIPAA Comparison
| Comparison Point | FERPA | HIPAA |
|---|---|---|
| Full name | Family Educational Rights and Privacy Act | Health Insurance Portability and Accountability Act |
| Primary focus | Student education records | Protected health information |
| Commonly regulated entities | Federally funded schools, districts, colleges and universities | Covered health plans, clearinghouses and healthcare providers |
| Common school-related records | Academic, disciplinary, disability and school-maintained health records | Records held by independent covered healthcare providers |
| Protected information | Personally identifiable information from education records | Protected health information |
| General disclosure rule | Written consent is generally required unless an exception applies | Written authorisation may be required unless a permitted use or disclosure applies |
| Rights generally belong to | Parents, then eligible students | Individuals or their personal representatives |
| Federal oversight | U.S. Department of Education | U.S. Department of Health and Human Services |
| School nurse records | Usually governed by FERPA when maintained by a covered school | Usually not governed by HIPAA |
| Independent clinic records | Usually not FERPA records unless the clinic acts for the school | May be governed by HIPAA if the clinic is a covered entity |
What Counts as an Education Record Under FERPA?
An education record generally has two essential characteristics:
- It is directly related to a student.
- It is maintained by an educational agency, institution or party acting on its behalf.
Education records are not limited to grades and transcripts. Depending on who maintains them and why, they may include:
- Attendance records
- Disciplinary reports
- Academic assessments
- Individualized Education Program records
- Disability documentation
- School counselling records
- Medication administration logs
- Immunisation records
- Allergy and emergency action plans
- Records of visits to the school nurse
- Psychological or behavioural evaluations
- Health information used to provide educational accommodations
A record does not stop being an education record merely because it contains medical information. Its relationship to the student and the entity maintaining it are usually more important than its subject matter.
Are School Health Records Covered by HIPAA?
Most student health records maintained by public elementary and secondary schools are governed by FERPA rather than HIPAA.
For example, records maintained by a school nurse may include:
- Student allergies
- Vaccination history
- Chronic health conditions
- Prescribed medications
- Injuries occurring at school
- Emergency treatment details
- Physician instructions
- Diabetes management plans
- Asthma action plans
- Mental health concerns
When these records are directly related to a student and maintained by a FERPA-covered school, they normally qualify as education records. HIPAA therefore excludes them from protected health information.
This does not mean school staff can disclose the records freely. They must comply with FERPA’s consent requirements and applicable exceptions.
Does HIPAA Apply to a School Nurse?
A school nurse is not automatically subject to HIPAA simply because the nurse provides healthcare.
A nurse employed by a FERPA-covered school generally maintains student health records on behalf of the school. Those records are usually FERPA education records rather than HIPAA-protected records.
The result can change when a nurse or healthcare professional works independently from the school. For example, an outside public health nurse may provide vaccinations on school property without acting for the school. Records created and maintained by that outside provider would not automatically become FERPA education records.
If the outside provider is a HIPAA-covered entity, HIPAA may apply to the provider’s records. Any information later received and maintained by the school may become part of the student’s FERPA education record.
Records Maintained by School Contractors
Schools frequently use outside organisations to provide counselling, therapy, nursing, disability support and technology services.
Records maintained by a contractor may qualify as FERPA education records when the contractor:
- Performs a service the school would otherwise use employees to perform
- Acts on behalf of the educational agency or institution
- Is under the school’s direct control regarding the use and maintenance of education records
- Uses the information only for the authorised institutional purpose
- Meets FERPA’s requirements concerning use and redisclosure
A contractor does not automatically become part of the school merely by working on campus. The agreement, relationship, control over records and purpose of the service all matter.
An independent healthcare provider serving students directly may remain subject to HIPAA for its own records, while a provider acting for the school may maintain records governed by FERPA.
When HIPAA May Apply in a School Setting
Although most public K–12 schools are not governed by the HIPAA Privacy Rule for student education records, there are situations where HIPAA may apply.
Independent Healthcare Providers
A physician, therapist, clinic or public health agency providing services independently from the school may be subject to HIPAA if it qualifies as a covered entity.
Private Schools Not Covered by FERPA
Many private elementary and secondary schools do not receive funding through programmes administered by the Department of Education and are therefore not subject to FERPA.
If such a school operates a healthcare service that qualifies as a HIPAA-covered entity, HIPAA may govern its patient health information.
University Hospitals
A university hospital usually provides treatment without regard to whether a patient is a student. When the hospital is not acting on behalf of the educational institution in maintaining student records, its patient records are generally governed by HIPAA.
A student does not lose HIPAA protection merely because the treating hospital is affiliated with the student’s university.
Clinics Serving Students and Nonstudents
A university health clinic may treat students, employees, family members and members of the public. Different laws can apply to different records within the same facility:
- Student records may fall under FERPA.
- Nonstudent patient records may fall under HIPAA.
- Employee health information may require a separate analysis.
- The institution may operate as a HIPAA hybrid entity.
The institution can therefore be subject to both FERPA and HIPAA, even though the same individual record is generally governed by one framework rather than both.
Common Student Record Scenarios
| Scenario | Law Generally Applicable | Reason |
|---|---|---|
| Public school nurse records a student’s asthma treatment | FERPA | The record is maintained by a FERPA-covered school |
| Independent paediatrician treats a student | HIPAA | The record is maintained by a covered healthcare provider |
| A paediatrician sends an asthma plan to the school | HIPAA for the provider’s copy; FERPA for the school’s copy | Each entity maintains its own record |
| School contractor provides counselling on the school’s behalf | Usually FERPA | The contractor may be acting for the school |
| Independent therapist meets a student on school property | Usually HIPAA for the therapist’s record | Location alone does not make the record a FERPA record |
| Public school maintains immunisation records | FERPA | The records directly relate to a student and are maintained by the school |
| University clinic treats an enrolled student | FERPA education or treatment-record framework | Student clinic records are excluded from HIPAA |
| University clinic treats a member of the public | HIPAA, if the clinic is a covered entity | The patient is not receiving care as a student |
| University hospital treats an enrolled student as a regular patient | Usually HIPAA | The hospital is generally not acting for the university’s educational programme |
| Private school not covered by FERPA operates a covered clinic | HIPAA may apply | The FERPA exclusion may not be available |
These results are general. State law, funding arrangements, contracts and the exact relationship between the organisations may affect the final determination.
Postsecondary Student Treatment Records
Colleges and universities have a special category of student health information known as treatment records.
Qualifying treatment records generally concern a student who is at least 18 or attends a postsecondary institution and are:
- Made or maintained by a physician, psychiatrist, psychologist or other recognised professional or paraprofessional
- Created, maintained or used only for treatment
- Disclosed only to people providing treatment or appropriate professionals chosen by the student
These records are excluded from FERPA’s ordinary definition of education records while they remain treatment records. However, HIPAA separately excludes this category from its definition of protected health information.
Therefore, qualifying treatment records at a FERPA-covered college clinic do not become HIPAA records simply because they are excluded from the ordinary definition of education records.
When Treatment Records Become Education Records
A treatment record can become an education record if the institution uses or discloses it for a purpose other than treatment.
For example, if information from a campus counselling file is disclosed to an administrator for a non-treatment purpose, the disclosed information may become an education record governed by FERPA’s ordinary disclosure requirements.
Billing records maintained by a university clinic may also be education records rather than treatment records because they are not created and used solely for treatment.
Can Treatment Records Be Shared With Another Provider?
A college or university may share treatment records with another healthcare professional when the disclosure is made to provide treatment to the student.
If the receiving provider is a HIPAA-covered entity, the copy received and maintained by that provider may become protected health information under HIPAA. The copy retained by the educational institution can remain a FERPA treatment record if it continues to meet the treatment-record requirements.
This demonstrates why the same medical information may be subject to different privacy laws in different record systems.
Does FERPA Protect Mental Health Records?
Student mental health records may fall within FERPA when they are maintained by a covered educational institution or a party acting for it.
At the K–12 level, counselling and psychological records directly related to a student are generally education records when maintained by the school.
At the postsecondary level, records used only for treatment may qualify as treatment records. If they are used or disclosed for other purposes, they may become education records.
Mental health information does not automatically fall under HIPAA simply because it was created by a counsellor, psychologist or psychiatrist. The record holder, institutional relationship and purpose of the record remain critical.
Consent and Disclosure Under FERPA
FERPA generally requires written consent from the parent or eligible student before personally identifiable information from education records is disclosed.
Valid consent generally identifies:
- The records that may be disclosed
- The purpose of the disclosure
- The person or organisation receiving the information
- The signature and date of the parent or eligible student
However, FERPA includes several circumstances in which consent may not be required.
School Officials With Legitimate Educational Interests
A school may allow teachers, nurses, counsellors and other authorised school officials to access records when they have a legitimate educational interest.
Access should be limited to information needed to perform the person’s professional responsibilities. Employment at a school does not automatically provide unrestricted access to every student record.
Transfer to Another School
Education records may generally be disclosed to another school where the student seeks or intends to enrol, subject to FERPA’s applicable conditions.
Health or Safety Emergencies
A school may disclose information without prior consent when there is an articulable and significant threat to the health or safety of a student or another person.
The disclosure must be made to someone whose knowledge of the information is necessary to address the threat. Possible recipients may include:
- Parents
- Medical professionals
- Public health officials
- Law-enforcement personnel
- Emergency responders
- Appropriate school officials
The emergency exception is not permission for a blanket release of student records. It is limited to information and recipients connected to an actual or impending health or safety threat.
Judicial Orders and Subpoenas
FERPA may permit disclosure in response to a lawfully issued subpoena or judicial order, subject to applicable notification and procedural requirements.
Sharing Information During an Emergency
FERPA does not prevent schools from responding to genuine emergencies. When school officials reasonably determine that an articulable and significant threat exists, they may disclose relevant information to appropriate parties.
Examples may include:
- A credible threat of violence
- An immediate risk of self-harm
- A dangerous medical emergency
- A serious infectious disease situation
- A natural disaster affecting student safety
- An urgent threat involving access to weapons
The school should consider the totality of the circumstances and limit the disclosure to information necessary to protect health or safety.
Following a non-consensual emergency disclosure, the school generally must document the threat forming the basis of the disclosure and identify the parties that received the information.
How HIPAA Providers Can Share Information With Schools
An outside healthcare provider subject to HIPAA may sometimes share protected health information with a school without obtaining a standard written HIPAA authorisation.
For example, HIPAA may permit disclosures:
- For treatment purposes
- When required by law
- For certain public health activities
- To prevent or lessen a serious and imminent threat
- Under the student immunisation provision
A healthcare provider may discuss a student’s medication or care needs with a school nurse when the disclosure is permitted for treatment. However, the school must independently determine how FERPA applies to any information it receives or later discloses.
Permission for a healthcare provider to send information to a school does not automatically give the school permission to redisclose that information.
Immunisation Records and Schools
Immunisation records provide a common example of how HIPAA and FERPA interact.
A covered healthcare provider may disclose proof of a student’s immunisation directly to a school without a standard written HIPAA authorisation when:
- The school is legally required to obtain proof of immunisation before admitting the student
- The parent, guardian or eligible student agrees to the disclosure
- The provider documents that agreement
The agreement may be oral or written under the relevant HIPAA provision, but the healthcare provider must document it.
Once the school receives and maintains the immunisation information as part of the student’s education record, FERPA generally governs the school’s copy.
If no law requires the school to obtain proof before admission, the healthcare provider may need written authorisation before sending the information directly to the school.
Parent and Student Access Rights
Under FERPA, parents generally hold privacy and access rights while a student is under 18 and attending an elementary or secondary school.
The rights transfer to the student when the student:
- Turns 18; or
- Attends a postsecondary institution at any age
After the transfer, the student becomes an eligible student and generally controls access to the education records.
A college may still disclose certain information to parents without the eligible student’s consent when a FERPA exception applies. Examples may include:
- The student is claimed as a dependent for federal tax purposes.
- A health or safety emergency exists.
- A student under 21 violates a law or institutional policy concerning alcohol or controlled substances.
- The information comes from a school official’s direct observation rather than an education record.
The transfer of FERPA rights does not prevent parents from sharing concerns with a college. School officials may listen to information provided by family members even when FERPA limits what the institution can disclose in response.
Does FERPA Override HIPAA?
FERPA does not simply override HIPAA. The HIPAA regulations expressly exclude FERPA-covered education records from the definition of protected health information.
A more accurate way to describe the relationship is:
- If the record qualifies as a FERPA education record, HIPAA does not govern that record.
- If the record is maintained by an independent HIPAA-covered provider and does not qualify under FERPA, HIPAA may govern it.
- An organisation can be subject to both laws for different records, departments or patient groups.
- State privacy, medical confidentiality and minor-consent laws may also apply.
The analysis is based on the specific record and relationship, not merely the name or location of the organisation.
Does the FERPA Exclusion Remove All Privacy Protection?
No. The exclusion changes the applicable federal law; it does not make the information public.
FERPA restricts disclosure of personally identifiable information from education records and gives parents or eligible students important access and amendment rights.
Additional protections may also arise from:
- State student privacy laws
- Medical confidentiality laws
- Mental health privacy requirements
- Disability education laws
- Professional licensing standards
- School policies
- Contractual obligations
- Data-security requirements
An organisation should not assume that information can be disclosed simply because HIPAA does not apply.
Common HIPAA and FERPA Mistakes
Assuming All Medical Information Is Covered by HIPAA
HIPAA does not govern every medical record. Student health information maintained by a FERPA-covered school is generally governed by FERPA.
Assuming Schools Must Follow HIPAA Because They Employ Nurses
Employing a healthcare professional does not automatically make a school subject to the HIPAA Privacy Rule.
Assuming FERPA Applies to Every Private School
FERPA applies based on participation in covered federal education funding programmes. Many private K–12 schools are not FERPA-covered institutions.
Focusing Only on Where Treatment Occurred
Receiving treatment on school property does not automatically make the provider’s records education records. The provider’s relationship with the school is more important than physical location.
Treating All College Clinic Files as Treatment Records
Billing, administrative and non-treatment records may be education records rather than treatment records.
Assuming the Same Law Covers Every Copy
A doctor’s copy may be protected by HIPAA, while the school’s copy of the same information may be protected by FERPA.
Sharing More Information Than Necessary
Even when an exception permits disclosure, schools and providers should consider the purpose of the disclosure and limit information to what is legally and practically necessary.
How to Determine Whether FERPA or HIPAA Applies
The following questions help identify the applicable privacy framework:
- Who created and currently maintains the record?
- Is the record directly related to a student?
- Is the institution subject to FERPA?
- Is an outside provider acting for the school or independently?
- Is the healthcare provider a HIPAA-covered entity?
- Was the information created solely for postsecondary treatment?
- Is the patient being treated as a student, employee or member of the public?
- Has a treatment record been used or disclosed for a non-treatment purpose?
- Does a federal or state disclosure exception apply?
- Do state privacy or medical confidentiality laws provide additional protections?
The title of a document is not enough to determine which law applies. The record’s purpose, custodian and institutional context must be examined.
Frequently Asked Questions
Does HIPAA exclude education records under FERPA?
Yes. HIPAA expressly excludes individually identifiable health information contained in FERPA-covered education records from its definition of protected health information.
Are school medical records protected by HIPAA?
School medical records are usually protected by FERPA when they are directly related to a student and maintained by a FERPA-covered school. Records maintained independently by a covered healthcare provider may be protected by HIPAA.
Are school nurse records covered by FERPA?
In most public elementary and secondary schools, records maintained by the school nurse are considered education records governed by FERPA.
Can a record be covered by both HIPAA and FERPA?
The same record is generally not governed by both laws. However, the same institution may be subject to HIPAA for some records and FERPA for others.
Does HIPAA apply to public schools?
Generally, the HIPAA Privacy Rule does not apply to public elementary and secondary school student records because the school is either not a HIPAA-covered entity or its student health records are FERPA education records.
Does HIPAA apply to private schools?
It can. A private school not subject to FERPA may be required to follow HIPAA if it operates a healthcare component that qualifies as a HIPAA-covered entity.
Are college health records protected by HIPAA?
Records maintained by a FERPA-covered college clinic about enrolled students are generally education or treatment records excluded from HIPAA. Records held by an independent hospital or outside provider may be covered by HIPAA.
Are college counselling records covered by FERPA?
Counselling records maintained by a college may qualify as treatment records when they are used only for treatment. If they are used or disclosed for other purposes, they may become FERPA education records.
Can schools disclose health records without consent?
FERPA permits certain disclosures without prior consent, including disclosures to school officials with legitimate educational interests and appropriate parties during qualifying health or safety emergencies.
Can a doctor send medical information to a school nurse?
HIPAA may allow a covered provider to share relevant information with a school nurse for treatment or under another permitted disclosure. The school’s copy will generally become a FERPA record when maintained by a FERPA-covered school.
Can parents access their child’s school health records?
Parents generally have FERPA access rights until the student turns 18 or attends a postsecondary institution. After that, the rights normally transfer to the eligible student, although exceptions may permit parental access or disclosure.
Does FERPA protect student information after graduation?
Education records maintained by a school may remain subject to FERPA after a student leaves. Records created after the person is no longer a student and unrelated to the person’s attendance may fall outside the definition.
What regulation contains the HIPAA FERPA exclusion?
The exclusion appears in the HIPAA definition of protected health information at 45 CFR §160.103. FERPA’s definition of education records appears in 34 CFR §99.3.
Conclusion
HIPAA excludes information considered education records under FERPA law because Congress and federal regulators established separate privacy frameworks for healthcare and education. Student health information maintained by a FERPA-covered school is usually governed by FERPA, not the HIPAA Privacy Rule.
The most important factor is not whether a record contains medical information. The key questions are who maintains it, why it is maintained, whether the institution is subject to FERPA and whether the healthcare provider qualifies as a HIPAA-covered entity.
School nurse files, disability records, medication logs and school-maintained immunisation information are commonly protected by FERPA. Records held by independent physicians, hospitals and other covered healthcare providers may instead be protected by HIPAA. In colleges and universities, student treatment records create an additional category that is excluded from HIPAA while handled under the FERPA framework.
Correctly identifying the governing law helps protect student privacy while allowing schools, families and healthcare professionals to share necessary information in legally permitted circumstances.
admin
Helping students learn better, prepare smarter, and build real career skills at LearnBeing.
View all posts