Does HIPAA Apply to Schools? FERPA vs HIPAA Explained
Quick Answer
HIPAA does not apply to schools. Schools are regulated by FERPA (Family Educational Rights and Privacy Act), which has different rules and protections. However, schools may fall under HIPAA if they provide healthcare services through a covered entity, such as a school-based clinic.
Myth vs. Reality
❌ Myth: HIPAA governs student health records in schools
Many parents and educators assume student health information is protected by HIPAA like healthcare records.
✓ Reality: FERPA is the primary law protecting student records
Schools are primarily regulated by FERPA, not HIPAA. FERPA governs student educational records, including health information collected by schools. HIPAA applies only to healthcare providers and health plans, not educational institutions.
❌ Myth: Schools must follow HIPAA penalties for privacy breaches
Some believe schools face HIPAA fines for unauthorized access to student records.
✓ Reality: Schools face FERPA enforcement, not HIPAA penalties
Schools that violate privacy rules face FERPA enforcement through loss of federal education funding and state penalties, not HIPAA fines. FERPA violations don't carry the monetary penalties HIPAA violations do.
❌ Myth: School nurses are covered by HIPAA
Some assume school nurses must follow HIPAA since they handle health information.
✓ Reality: School nurses follow FERPA and state laws; HIPAA applies only to separate clinics
School nurses working as part of the school organization follow FERPA. However, if a school operates a separate health clinic that's a covered entity or business associate, that clinic must follow HIPAA.
FERPA vs. HIPAA: Key Differences
| Aspect | HIPAA | FERPA |
|---|---|---|
| Applies To | Healthcare providers, health plans, clearinghouses, and business associates | Schools and educational institutions receiving federal funding |
| Information Protected | Protected Health Information (PHI) in any format | Educational records, including health and disciplinary information |
| Parent/Student Rights | Access, amendment, accounting of disclosures | Access, amendment, inspection rights; more parental control |
| Default Disclosure | Restrictive—requires authorization | Restrictive—requires parental consent or legal exception |
| Penalties for Violation | $100-$50,000 per violation; up to millions annually | Loss of federal education funding; state enforcement |
| Security Requirements | Specific technical, physical, and administrative safeguards required | Reasonable security measures required; less prescriptive |
When HIPAA Applies to Schools
Although rare, HIPAA can apply to schools in specific situations:
- School-based health clinics: If operated as a separate healthcare entity, must follow HIPAA
- Telehealth providers: If a school partners with a healthcare provider for telemedicine, that provider is HIPAA-covered
- School nurses as healthcare providers: If employed by a hospital or healthcare system rather than the school, HIPAA applies
- Electronic health records for medical care: If the school maintains EHRs for ongoing medical treatment, HIPAA may apply
Key FERPA Requirements for Schools
Schools must:
- Provide notification: Inform parents/students of FERPA rights annually
- Limit access: Only allow access to those with educational need to know
- Obtain consent: Get parental/student consent before disclosing records externally
- Maintain confidentiality: Keep all educational and health records secure
- Document disclosures: Track who accesses records and when
- Grant access rights: Allow parents/students to review and request amendments
Student Health Information Protected by FERPA
- Immunization records and vaccination status
- Disability determinations and IEP/504 plans
- Mental health counseling records
- Medication administration records
- Allergies and medical conditions
- Communication with healthcare providers
- Emergency medical information
Frequently Asked Questions
Q: Can a school share my child's health information with other staff without consent?
A: Under FERPA, yes, but only with staff who have a legitimate educational need to know. Teachers may be informed of allergies or medical conditions affecting classroom participation, but detailed medical records require parental consent to share.
Q: What's the difference between HIPAA and FERPA enforcement?
A: HIPAA violations result in monetary penalties ($100-$50,000 per violation). FERPA violations result in federal education funding loss and state enforcement. Schools don't pay HIPAA fines.
Q: Can schools give law enforcement access to student medical records?
A: Not without parental consent or a subpoena, with exceptions for immediate safety concerns. Schools must be cautious with police requests and verify legal authority before disclosing.
Q: Do private schools follow FERPA or HIPAA?
A: Private schools generally follow FERPA if they receive federal education funding. They're not subject to HIPAA unless they operate as separate healthcare entities. State privacy laws may also apply.
Ensure Your School's Health Records Are Secure
Get a comprehensive security risk analysis to identify privacy compliance gaps in your school's health information management.
Get Your Risk Analysis →