HIPAA vs FERPA: Key Differences for Schools & Healthcare
Quick Answer
HIPAA protects health information of healthcare patients and is enforced by HHS. FERPA protects educational records of students and is enforced by the Department of Education. Schools primarily use FERPA, but school-based health clinics may need HIPAA compliance. The laws have different privacy standards, access rights, and penalties.
Understanding HIPAA vs FERPA
HIPAA and FERPA are two separate federal privacy laws that often confuse healthcare professionals and educators. While both protect sensitive personal information, they apply to different sectors, have different definitions of protected information, and are enforced by different agencies.
HIPAA Overview
The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 and governs the privacy, security, and breach notification of Protected Health Information (PHI). HIPAA applies to:
HIPAA is enforced by the Office for Civil Rights (OCR) within the Department of Health and Human Services (HHS).
FERPA Overview
The Family Educational Rights and Privacy Act (FERPA) was enacted in 1974 and protects the privacy of student educational records. FERPA applies to:
FERPA is enforced by the Family Policy Compliance Office (FPCO) within the Department of Education.
Comparison Table: HIPAA vs FERPA
| Aspect | HIPAA | FERPA |
|---|---|---|
| Enacted | 1996 | 1974 |
| Applies To | Healthcare providers, health plans, clearinghouses | Schools and educational institutions |
| Protected Information | Protected Health Information (PHI) | Personally Identifiable Information (PII) in educational records |
| Right to Access | Patients can request copies of their health records | Students/parents can inspect and review records |
| Consent Required | Yes, for most uses beyond treatment/payment/operations | Yes, for disclosure to third parties outside legitimate educational purposes |
| Data Breach Notification | Required to notify affected individuals, HHS, media | No specific federal requirement, but varies by state |
| Enforced By | HHS Office for Civil Rights (OCR) | Department of Education, Family Policy Compliance Office |
| Penalties | $100-$50,000 per violation; criminal penalties possible | Loss of federal education funding |
When Schools Need Both HIPAA and FERPA
Schools are primarily regulated by FERPA for all educational records. However, certain situations require HIPAA compliance alongside FERPA:
School-Based Health Centers
If a school operates a health clinic that bills insurance for medical services, the clinic becomes a HIPAA-covered entity. In these cases, the school must comply with both FERPA (for educational records) and HIPAA (for health records created by the clinic).
Special Education Medical Documentation
Schools must maintain special education records under FERPA. However, if medical professionals employed by the school create health records (like nurse visit notes), those records may be protected under both FERPA and HIPAA depending on the context.
School Districts with Health Insurance Operations
Some school districts operate health insurance programs or wellness programs. These operations may trigger HIPAA requirements separate from FERPA obligations for educational records.
Key Differences in Privacy Standards
Information Definition
HIPAA: Protects Protected Health Information (PHI) - any information in a medical record that can identify an individual. This includes health status, treatment information, billing information, and more.
FERPA: Protects Personally Identifiable Information (PII) in educational records - grades, test scores, attendance, disciplinary records, and similar educational information.
Minimum Necessary Standard
HIPAA: Requires covered entities to use and disclose only the minimum amount of PHI necessary to accomplish the intended purpose.
FERPA: Does not have a strict "minimum necessary" requirement but requires legitimate educational purposes for access and disclosure.
Authorization and Consent
HIPAA: Requires written authorization for most disclosures, with exceptions for treatment, payment, and operations (TPO).
FERPA: Requires parental or student consent for disclosure to third parties, with exceptions for school officials with legitimate educational interests and emergency situations.
Frequently Asked Questions
Does a school counselor need to comply with HIPAA or FERPA?
School counselors must comply with FERPA regarding educational and counseling records maintained by the school. If the counselor is licensed as a mental health professional and operates independently or bills insurance, HIPAA may apply. The records maintained by the school fall under FERPA regardless. Schools should have clear policies about which records are maintained under which law.
Can parents access medical records kept in school health clinics?
Yes, under both FERPA and HIPAA (if applicable). FERPA allows parents to access all educational records, including health clinic records. If the clinic is a HIPAA-covered entity, parents also have HIPAA rights to access and receive copies of medical records. The school must provide access within the required timeframes under both laws.
What happens if a school violates HIPAA and FERPA?
FERPA violations are enforced by the Department of Education and can result in loss of federal education funding - a severe penalty. HIPAA violations are enforced by HHS and result in civil penalties ($100-$50,000 per violation) and potential criminal penalties. A school violating both laws faces enforcement from both agencies and the combined penalties. Each violation is treated separately.
Do universities need HIPAA compliance for student health centers?
Universities must comply with FERPA for all student records. If the student health center bills insurance or provides medical treatment records, it may be a HIPAA-covered entity requiring HIPAA compliance. Universities often have both a Health Center (HIPAA covered) and student records office (FERPA regulated), requiring dual compliance. Clear policies should separate which records fall under which law.
Ensure Your Organization Complies With Both HIPAA and FERPA
Schools and healthcare organizations operating in educational settings need clear compliance strategies. Medcurity helps you navigate complex HIPAA and FERPA requirements with specialized guidance for schools, health clinics, and educational institutions.
Start Your Compliance Audit Today