Student health records under FERPA or HIPAA, and where health details leak

Health records kept by a school that receives Education Department funds are covered by FERPA, not HIPAA. A K-12 school nurse's records, immunization records included, are FERPA education records, and the HIPAA Privacy Rule excludes education records from protected health information, even at a school that bills Medicaid electronically. At a college, clinic records used only to treat a student are FERPA "treatment records", which HIPAA excludes too. HIPAA applies when the record is kept by a provider who isn't acting for the school, such as a university hospital treating a student like any other patient.

The test is who keeps the record, not what it says. Redacting one is harder, because a school's health information rarely stays in a health file.

Which law covers which record

The Departments of Education and Health and Human Services sort the common cases in their joint guidance on student health records, updated in 2019. HIPAA's exclusions are in the definition of protected health information in 45 CFR 160.103.

A few cases need care. A hospital that runs a university's student clinic keeps that clinic's student records under FERPA. A college clinic that also treats staff or the public keeps those patients' records under HIPAA, if the institution is a covered entity. And most private K-12 schools take no Education Department funds, so FERPA doesn't reach them: one that bills a health plan electronically for care it gives students follows HIPAA instead.

Treatment records, and when they stop being treatment records

FERPA's definition of education records, in 34 CFR 99.3, leaves out records on a student who is 18 or older, or in college, that a physician, psychologist or other professional makes or keeps only to treat the student and discloses only to the people treating them. A college psychologist's notes are the usual example.

The exclusion is narrow, and it ends at the first other use:

• Billing records were never treatment records, because they aren't used only for treatment.
• A disclosure for any other purpose, to a dean, a parent or a court, makes the records education records, with every FERPA requirement that follows.
• Records sent to an outside provider for treatment come under HIPAA in that provider's hands, if it is a covered entity. The school's copy stays a treatment record.

Sharing without consent

Inside a school, FERPA lets health information go to teachers and other school officials with a legitimate educational interest, as the school's annual notice defines it. Outside it, the main route without consent is the health or safety emergency exception in 34 CFR 99.36: disclosure to appropriate parties, such as parents, police or medical staff, when the school sees an articulable and significant threat and the information is needed to protect someone. The school must then record the threat and who received the information, under 99.32(a)(5). Without an exception, a disclosure needs written consent from a parent or eligible student, and the guidance says that includes the billing information a school sends Medicaid for a student's services.

Where health details leak from student records

Nurses, teachers, counselors and outside doctors all write health details down, and the Department of Education counts handwriting, print and email alike as education records. The details then travel in files that go to parents, state agencies, lawyers and researchers.

Nurse visit logs

A health office log puts a day's visits on one page: "10:42 Malik Turner, Gr 7, headache, ibuprofen per parent note. 11:05 Sofia Reyes, Gr 8, inhaler, back to class." Each line is a different student's education record, and a parent asking for their child's visits may see only their child's lines under 34 CFR 99.12(a). Many logs are kept by hand.

Medication and immunization forms

Medication administration records carry the drug, the dose and often the condition behind it. Immunization records are education records too, the guidance says, and an exemption form can state a medical reason or a religious belief. Both usually carry a parent's or doctor's signature.

Doctors' notes and faxed evaluations

A note on a clinic's letterhead becomes an education record once the school files it: "Diego was seen on 10/14 for an asthma flare and may return to PE on 10/21." Faxed copies add a header with the clinic's name and number. Outside psychological evaluations in special education files can run to pages of developmental and family history.

504 plans and IEPs

Eligibility sections name the diagnosis: "Type 1 diabetes; glucose checks before lunch and before PE." The accommodations can give it away without one, such as an EpiPen kept in the classroom or unlimited restroom passes. Records on children with disabilities fall under IDEA's confidentiality rules as well as FERPA, and the guidance calls IDEA's broader.

College clinic records that leave the clinic

A counselor's notes are treatment records only while they stay with the people treating the student. Once a copy goes into a conduct file or answers a court order, it is an education record, and a conduct file usually names the other students involved.

A checklist before health records leave the school

• Each record has been sorted as an education record, a treatment record or a provider's own record, so the right law applies.
• Records going to a parent show only that parent's child, on logs and rosters as well as forms.
• Diagnoses, medications, doses and immunization exemptions are gone wherever the recipient isn't entitled to them.
• Accommodations that reveal a condition have been treated as health information.
• Faxed notes and outside evaluations have been checked, fax headers and letterheads included.
• Handwritten logs and scanned forms have been read by OCR and checked by a person.
• Any emergency disclosure is recorded in the student's file, with the threat and who received it.
• Redacted text is removed, not covered, and the document properties and comments are clean.

Where DocArmor fits

DocArmor's Educational Records (FERPA) template covers student names and IDs, family and guardian names, grades, academic accommodations and disciplinary records. Plain-English instructions add what a record needs beyond that, such as diagnoses and medications, or "every student except Malik Turner" for a parent's request. OCR reads scanned and image-only pages, handwritten notes included, and every finding goes to a reviewer before export, because whether an accommodation or a description points to one child is a judgment a person has to make. Redacted content is removed and checked on every page, and metadata, attachments and form values are stripped.

This post is general information about FERPA and HIPAA, not legal advice. State health privacy and student records laws can add their own rules, so check yours and your institution's policies.