Does HIPAA Exclude FERPA? The Education Records Exception
HIPAA and FERPA both protect sensitive information, but they generally cover different records. Under federal rules, health information that qualifies as a FERPA education record is excluded from HIPAA’s definition of protected health information. That distinction affects school nurses, colleges, health clinics, parents, and health care providers. The answer depends on who maintains a record, why it is kept, and whether it is an education record, a treatment record, or information held by a separate health care organization.
How HIPAA’s FERPA Exception Works
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule applies to protected health information, or PHI, held by covered health care providers, health plans, and health care clearinghouses, along with certain business associates. However, the HIPAA regulations specifically exclude education records covered by the Family Educational Rights and Privacy Act (FERPA) from the definition of PHI. The exclusion appears in the definition at 45 C.F.R. § 160.103.
FERPA is a federal privacy law that applies to educational agencies and institutions receiving funds under programs administered by the U.S. Department of Education. It generally protects records that are directly related to a student and maintained by the school or by a party acting for the school. FERPA’s definition of education records is set out at 34 C.F.R. § 99.3.
The practical rule is that a record’s content alone does not determine which law applies. A nurse’s note may describe a medical condition, but if it is an education record maintained by a school subject to FERPA, it is generally governed by FERPA rather than HIPAA. Conversely, a medical provider’s copy of the same information may be PHI subject to HIPAA if the provider is a covered entity and no other exclusion applies.
What Counts as a FERPA Education Record?
An education record is generally a record that is directly related to a student and maintained by an educational agency or institution, or by a party acting on its behalf. Records can take many forms, including paper files, electronic entries, photographs, and other stored information. A record does not have to be academic to qualify: attendance, discipline, counseling, and health information may all fall within FERPA when the legal conditions are met.
For example, a K–12 school may keep a student’s medication plan, immunization documentation, visit notes from the school nurse, or records supporting an accommodation. If those records are directly related to the student and maintained by the school, they are generally FERPA education records. HIPAA’s education-record exception applies even though the information is health-related.
FERPA does not automatically cover every record connected to a school. A record maintained by an outside hospital or private medical practice may be subject to HIPAA if that organization is a covered entity. The school’s copy and the provider’s copy can therefore be subject to different rules. A contract, data-sharing arrangement, or school referral does not by itself settle the question; the record’s maintenance and the parties’ roles matter.
School Health Records and School Nurses
School nurse records are a common source of confusion. When a nurse is employed by a school or works for a contractor maintaining records on the school’s behalf, student health records maintained as part of the school’s records are generally governed by FERPA. This remains true even if the nurse is licensed, uses a clinical charting system, or provides care that resembles services in a medical office.
In many cases, a school that maintains student health records under FERPA is not subject to HIPAA for those records. The result is not that the information is unprotected. FERPA restricts disclosure and gives parents or eligible students rights to inspect and seek amendment of education records, subject to the law’s terms and exceptions.
Another arrangement can produce a different result. A community clinic may operate on school grounds but remain a separate health care provider, keeping its own patient records and billing for services. If it qualifies as a HIPAA covered entity, its records may be subject to HIPAA. The clinic’s records do not become FERPA records merely because the patient is a student or the clinic is located at a school.
Schools and providers should identify who controls and maintains each record, whether the provider is acting for the school, and whether the information is kept in the school’s education-record system. Written agreements can help clarify responsibilities, but they cannot change the legal status of a record that follows from the facts and applicable rules.
College and University Treatment Records
FERPA has a specific category called “treatment records” for eligible students at postsecondary institutions. These are records made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional; made, maintained, or used only in connection with treatment; and disclosed only to people providing treatment, subject to FERPA’s definition and conditions.
These postsecondary treatment records are not treated as FERPA education records while they meet the statutory criteria. They also are not automatically HIPAA records: HIPAA’s definition excludes certain records described in FERPA’s treatment-record provision. The U.S. Department of Education explains how the rules interact in its guidance on postsecondary health records.
If a treatment record is used or disclosed for a purpose other than the student’s treatment, FERPA treats it as an education record, and the student’s FERPA rights apply. That can affect access, disclosure, and recordkeeping. Institutions should not assume that a campus counseling or health center is covered by HIPAA simply because it provides clinical services; its relationship to the institution and the records’ use are important.
When HIPAA May Still Apply
The FERPA exception is limited to records that fall within FERPA’s definitions. HIPAA may still apply to health information held by a covered provider or health plan when the information is not a FERPA education record or qualifying postsecondary treatment record. Common examples include:
- A separate provider’s patient file: A hospital, physician’s office, or independent clinic may hold PHI about a student under HIPAA.
- Records for nonstudents: A school-based clinic’s records about a community member who is not a student may not qualify as FERPA education records.
- Employee health information: A school’s employment-related health records are generally not student education records. HIPAA’s employment-record exclusion and the employer’s role must also be considered.
- Information maintained outside the school’s FERPA records: A provider’s independent records may remain subject to HIPAA even if the school also keeps a separate copy under FERPA.
Not every health care provider is a HIPAA covered entity. Generally, a provider is covered when it transmits health information electronically in connection with certain standard transactions, such as claims. Whether HIPAA applies depends on the organization’s activities and legal status, not simply on whether it provides health care.
Who Can Access or Receive Student Health Information?
FERPA does not prohibit every disclosure of student health information. It generally requires written consent before a school discloses personally identifiable information from education records, but it includes specific exceptions. For instance, a school may disclose information to school officials with a legitimate educational interest under its published criteria. Other exceptions may apply in particular circumstances, such as a health or safety emergency.
Parents generally have FERPA rights concerning a student’s education records while the student is under 18 or attending a school that receives Department of Education funds, subject to applicable rules. At a postsecondary institution, FERPA rights generally transfer to the student when the student attends the institution, regardless of age. A college may disclose information to parents in limited circumstances, including certain situations involving tax dependency or a health or safety emergency, but it should follow the relevant FERPA conditions.
HIPAA has its own rules for parents and personal representatives. A parent is usually a minor’s personal representative, but exceptions can apply under state law, when a minor may consent to care independently, or in other circumstances recognized by HIPAA. These HIPAA rules should not be substituted for FERPA’s disclosure rules when a school maintains the record as an education record.
When a school sends information to a provider, or a provider sends information to a school, the parties should identify the record type and the legal basis for the disclosure. A school’s FERPA authority does not automatically authorize a provider’s HIPAA disclosure, and a provider’s HIPAA permission does not automatically satisfy FERPA. Consent, an applicable exception, or another legal basis may be needed on one or both sides.
FERPA and HIPAA at a Glance
| Record or setting | Likely governing framework | Key consideration |
|---|---|---|
| School-maintained K–12 student health record | FERPA | Directly related to the student and maintained by the school or its agent |
| Independent clinic’s record about a student | Often HIPAA, if the clinic is covered | The clinic’s status and control of its record matter |
| Qualifying postsecondary treatment record | Special FERPA treatment-record rules | Must meet treatment-only requirements; other use can change its status |
| School employee medical file | Not ordinarily FERPA; HIPAA may also exclude employment records | Determine whether it is an employment record and who maintains it |
Common Misconceptions
“HIPAA covers every medical record.”
HIPAA applies to defined entities and information. It does not automatically cover every organization that handles health information. FERPA education records are expressly excluded from HIPAA’s PHI definition.
“FERPA means a school can never share health information.”
FERPA permits disclosures in defined circumstances, including certain disclosures with consent and those covered by regulatory exceptions. Schools must assess the facts, use the proper exception where applicable, and follow any documentation or notice requirements.
“A school clinic is always covered by HIPAA.”
Location alone does not decide coverage. A clinic operated as part of the school may maintain FERPA records, while an independent covered provider on campus may maintain HIPAA records. Some arrangements involve separate records governed by different laws.
“The same information must follow one law everywhere.”
A school and an outside provider can maintain separate copies of the same health information under different legal frameworks. The applicable law is determined for each record and record holder, not just by the information’s subject matter.
How Schools and Providers Can Assess a Record
A practical review starts with four questions: Is the information directly related to a student? Who maintains the record, and is that person acting for the school? Does the record meet FERPA’s education-record or postsecondary treatment-record criteria? If FERPA does not govern it, is the holder a HIPAA covered entity or business associate?
Organizations should also check state privacy and student-record laws, which may impose protections beyond federal requirements. State rules can affect minor consent, parental access, school health services, and disclosures. Contract terms, institutional policies, and professional obligations may add further requirements, but they cannot authorize a disclosure prohibited by governing law.
For difficult cases, schools and providers should consult their privacy officer or legal counsel rather than relying on a record’s label, software platform, or the credentials of the person who created it. The central distinction is straightforward: FERPA generally governs qualifying student education records, while HIPAA may govern separate records held by covered health care organizations. Applying that distinction record by record helps prevent both improper disclosure and unnecessary barriers to care.