In plain terms
FERPA
The federal law that protects student education records at schools that receive U.S. Department of Education funds, and the reason most school health records fall outside HIPAA.
My Master of Public Health taught HIPAA as the baseline rule for health information. It surprises a lot of people, including plenty of health professionals, that a student’s health records at school usually are not protected by HIPAA at all. They are governed by a completely different statute, FERPA, built for a different purpose, with different rights, different enforcement, and a different definition of who counts as covered.
What does HIPAA cover?
HIPAA, the Health Insurance Portability and Accountability Act, and its Privacy Rule apply to covered entities: health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with certain standard transactions, plus their business associates, vendors and contractors who handle protected health information on a covered entity’s behalf under a required business associate agreement. HIPAA protects protected health information, individually identifiable health information held or transmitted by a covered entity, and gives patients rights to access their own records, request corrections, and control certain disclosures, enforced by the Department of Health and Human Services’ Office for Civil Rights through civil penalties, with criminal cases for the worst violations going to the Department of Justice.
What does FERPA cover?
FERPA, the Family Educational Rights and Privacy Act, applies to schools and educational agencies that receive funding from U.S. Department of Education programs, which in practice means nearly every public school, school district, and most colleges and universities. It protects education records, records directly related to a student and maintained by the school, and gives parents (or the student, once they turn 18 or enroll in a postsecondary institution) the right to inspect, seek to amend, and control disclosure of those records. FERPA is enforced administratively by the Department of Education, primarily through the threat of cutting off federal funding, not through individual lawsuits; in Gonzaga University v. Doe, 536 U.S. 273 (2002), the Supreme Court held that FERPA’s nondisclosure provisions create no personal rights enforceable through a federal civil rights suit, so a FERPA violation typically has to be pursued as a complaint to the Department, not a suit against the school.
Why doesn’t HIPAA cover school health records?
This is the piece that trips people up. When a school, rather than an outside health care provider, maintains health-related records on a student, records from the school nurse, immunization records, a school-based counselor’s notes, those records generally fall under FERPA’s education records definition instead of HIPAA, through an explicit carve-out in the HIPAA regulations for records covered by FERPA, 45 C.F.R. § 160.103. The practical result: a school nurse’s notes about a student are typically a FERPA education record, subject to FERPA’s disclosure rules and parental access rights, not a HIPAA-protected health record, even though the content is unmistakably health information. The same student’s records at an outside pediatrician’s office sit under HIPAA instead, because that provider is a covered entity and is not acting for the school.
Colleges are where people get this wrong. A campus health clinic can bill insurance and look exactly like a doctor’s office, and its records on students still fall under FERPA, either as education records or as what FERPA calls treatment records. HHS says both categories are excluded from the HIPAA Privacy Rule, even if the school is a HIPAA covered entity. A university hospital is usually the opposite case: it treats patients without regard to whether they are students and not on the school’s behalf, so those records are typically under HIPAA. The analysis has to start with who holds the record and on whose behalf, not what the record is about.
What does this mean practically?
For students and families, the first question when health information sits at a school is not whether it is private. It usually is protected somehow. The question is which statute protects it, because that determines who has the right to see it, who can be told what without consent, and where a complaint goes if something goes wrong. For colleges, the line runs between student patients and everyone else: a campus clinic that is a covered entity and also treats staff or the public follows FERPA for its student patients and the HIPAA Privacy Rule for the rest, in the same building.
Related: What HIPAA Actually Covers, Plainly goes through the myths about the statute itself. More health law posts are collected in Health Law, Plainly.
I am a law student, not a lawyer. Nothing here is legal advice.
