HIPAA Excludes Information Considered Education Records Under FERPA Law

Picture a school nurse's note about a student's asthma sitting in the same folder as a spelling test. Which privacy law applies to that paper?

The short answer is that HIPAA (the Health Insurance Portability and Accountability Act) generally doesn't cover records that FERPA (the Family Educational Rights and Privacy Act) already governs.

For most school files, that means FERPA is the law to know.

So why does that exclusion exist, and how do you tell which rules apply on a given day? In this post, we'll explain the reasoning, map common scenarios, and give you a practical checklist for handling attendance and health information in your classroom.

What HIPAA Excludes from FERPA Education Records

The Health Insurance Portability and Accountability Act (HIPAA) steps aside for any record the Family Educational Rights and Privacy Act (FERPA) covers. Your first question is whether it's an education record, and we'll show you how to tell.

What makes a record an education record

A record qualifies when it:

• Is directly related to a student. It identifies a specific learner.
• Is maintained by the school or its agent. An agent acts on the school's behalf.
• Comes in any medium or format. Paper and digital both count.
• Applies to federal fund recipients. The institution must receive federal education funds.

Attendance records count too. An office assistant who logs a tardy creates an education record the moment it's saved. What matters is who keeps the record, not how it's stored.

Which schools must follow FERPA

• Public schools and districts are covered.
• Postsecondary institutions (colleges and universities) are covered too.
• Private schools without federal funds are excluded.

Enforcement comes down to money. According to FERPA Close-Up, FERPA is "enforceable only by the withholding of federal funding," so federal money can be withheld from a school that doesn't comply.

A tutor is covered only as a school's agent, and homeschool records usually fall outside FERPA.

Records that don't count as education records

• Sole-possession notes. Personal memory aids that only their maker sees are excluded.
• Law enforcement records. Records kept by a school's law enforcement unit for law enforcement purposes are excluded.
• Employee records. Files about staff acting as employees fall outside FERPA.
• Treatment records. Records a professional makes for treatment, kept apart from school use, are excluded.
• Alumni records. Records about someone after they've left the school don't count.

Personal notes stay outside FERPA only while they stay personal. Picture a fifth-grade teacher jotting reading observations for her own planning. Hand one to a substitute, though, and it usually becomes an education record. One handoff changes the answer.

When health records count as education records

In K-12 (kindergarten through grade 12), health records a school maintains are education records, so FERPA governs them, not HIPAA. Immunization records count too.

Consider a school nurse who logs clinic visits and writes notes. Those notes, the visit log, and any Individualized Health Plan (IHP) are education records.

The same privacy rules that protect a grade protect the nurse's documentation, so you know which law to check before you share it.

When FERPA Lets Schools Share Records

FERPA (the Family Educational Rights and Privacy Act) controls who can see student education records, and most sharing starts with a signed form.

Getting written consent before sharing

The default is written consent.

Before releasing records, a school generally needs signed, dated permission from a parent or eligible student (FERPA's term for a student who has turned 18 or enrolled in a postsecondary school). A strong form names three things:

• What records will be shared
• To whom they're going
• Why they're needed

A complete form saves a round of follow-up. A consent form is about what gets shared, not just whether anything does.

When sharing without consent is allowed

FERPA permits release without consent in a few narrow situations:

• Transfer schools: where the student is enrolling or intends to enroll
• Judicial order or subpoena: the school should generally notify the family first
• Financial aid: those determining aid eligibility or amount
• Audit and evaluation: authorized officials reviewing education programs
• Accrediting organizations: bodies doing accreditation work

Check before you hit send.

Which school officials have legitimate access

School officials can see records when they have a legitimate educational interest, meaning they need the information to do their job. A special education teacher reviewing accommodations for her own caseload qualifies. Browsing out of curiosity doesn't.

Access follows who needs the information, not who works in the building.

Contractors can count too, when they do work the school would otherwise do, stay under its direct control, and use records only for that purpose. Ask your administrator which roles can see your students' records.

Schools must also tell families each year who qualifies.

Sharing information during a safety emergency

Records can be disclosed without consent when a serious imminent threat to health or safety exists, meaning danger that is real and about to happen. Responders can get what they need right away, without waiting for a signature.

Picture a school nurse who gives paramedics a student's medication history during a severe reaction. She then documents the reason and who received the information. Write it down while it's fresh.

Directory information and how to opt out

Directory information is a limited set of details, such as a student's name and dates of attendance, that a school can share without consent. Attendance dates count here too, so you can often confirm them unless the family has opted out.

Families have opt-out rights. A full restriction blocks all directory information, while a partial restriction blocks only the items families choose. Schools must notify families and eligible students of this right.

Picture a registrar who gets a call from a local youth league asking when a student attended. She checks the file for a restriction. If none exists, she can confirm the dates. If the family has restricted them, she needs written consent first.

That quick check honors the family's choice.

Handle Attendance and Health Records in Class

Use this guide when you log an absence, receive a nurse note, or get asked to share something about a student. It keeps daily habits, a quick sharing check, and a pocket list in one place.

Four daily habits

Log absences factually. Record what happened, not why it might have happened.

• ✅ "Absent 10/14. Parent called to report illness."
• ❌ "Absent 10/14. Strep throat, on antibiotics."
• The difference: the first states the fact, and the second records a diagnosis.

Skip diagnoses in notes. If a parent offers details, you don't need to write them down.

Store records in secure systems. Use your school's approved system, not a sticky note or personal drive.

Avoid unencrypted email. Student details don't belong in ordinary email.

• Use your school's secure messaging, or ask the office to relay it.

Before you share anything

Run these four checks in order, every time. If one fails, stop and ask.

1. Is it an education record?
   • Attendance logs and nurse notes the school keeps usually are.
2. Is the recipient a school official?
   • A counselor who needs it for their job, yes. A curious colleague, no.
3. Is written consent on file?
   • For anyone outside the school, no consent means no sharing.
4. Log the disclosure.
   • Jot the date, who received it, what you shared, and why.

⚠️ Watch out: The usual slip is friendly over-sharing, like a quick staff-room "How's Maya doing? Is she sick?" Run the four checks even when the ask feels casual.

What it looks like by grade level

Say: "I can't share that here, but I'll point you to the right person."

Pocket checklist

Glance at this before you hit send or answer a request:

• Know your records custodian. Have their name and contact handy.
• Keep health details minimal. Record only what the school needs.
• Redirect outside requests. Send them to the office or custodian.
• Ask before sharing. When you're unsure, check first.

EMStudio's attendance tracking keeps absence records organized and secure in one place.

Rights Parents and Students Have

The Family Educational Rights and Privacy Act (FERPA) gives parents and students rights over education records. Knowing who holds them keeps you from guessing when a request comes in.

Reviewing and correcting records

Parents and students can inspect and review education records and request corrections. That includes any entry that's inaccurate or misleading.

Consider a parent who finds a note calling their son disruptive for an incident that never happened. They can ask the school to correct it, so the record reflects what happened rather than what someone assumed.

When rights shift to eligible students

• Age 18. An Eligible Student Guide to the Family Educational Rights and Privacy Act (FERPA) from Protecting Student Privacy explains that once a student turns 18, all FERPA rights transfer from parent to student.
• Postsecondary enrollment. Attending a college or other postsecondary institution (after high school) at any age also triggers the shift.
• Parents control consent before. Until one of those triggers, parents hold these rights and control consent.

Who speaks for minors under HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) protects protected health information (PHI), the medical details a provider keeps. Parents usually speak for a minor's PHI. Not always.

• Minor consent exceptions. When a minor legally consents to their own care, a parent's access to those details may change.
• Court-assigned representatives. A court can appoint someone to make decisions for a child, and that person speaks for the minor.
• Risk of endangerment. A provider can limit a parent's access if sharing could put the minor at risk of endangerment, meaning serious harm.

That's your first step: before answering a health question about a student, figure out who speaks for them.

Deciding Whether HIPAA or FERPA Applies

Before you protect a student's health information, you need to know whether the Health Insurance Portability and Accountability Act (HIPAA) or the Family Educational Rights and Privacy Act (FERPA) governs it.

The answer turns on who holds the record, not what it says.

School health files are covered by FERPA

Picture a school nurse keeping a student's asthma action plan in the health office. That plan is an education record, so FERPA governs it.

A nurse employed by the district typically isn't a HIPAA covered entity, and HIPAA's definition of protected health information (PHI) excludes education records, so the plan isn't PHI, even with its medical details.

The same goes for records the school or district keeps. When a teacher asks to see that plan, the nurse's first question isn't about HIPAA. It's whether FERPA allows the request.

Situations where HIPAA still applies

HIPAA takes over in these cases:

• An outside clinic billing electronically. It's a covered entity, so its records fall under HIPAA even when the patient attends your school.
• A private school billing electronically. If its health services bill electronically, HIPAA can apply. FERPA generally reaches schools that receive federal education funding, so one that doesn't may fall outside it.
• A hospital affiliated with a university. It's often a covered entity in its own right, so its treatment records can fall under HIPAA even for student patients.
• Care for non-students. Consider a school-based clinic that also treats siblings or community members. Those records aren't education records, so HIPAA applies if the clinic is a covered entity.

Billing without full HIPAA coverage

Billing doesn't automatically bring a school's whole health file under HIPAA. Electronic claims follow the Transactions and Code Sets standards for formats and codes.

A district that bills an insurer for speech therapy meets those standards for the claim, but the therapist's notes usually remain an education record. Claims follow one set of rules, and records follow another.

Moving records between clinic and school

The clinic's copy of a student's immunization history is PHI, held by a covered entity. Once that copy enters the student's school file, it becomes an education record under FERPA.

Take a school secretary who receives a faxed physical from an outside clinic. The original stays under HIPAA, but the fax is now part of the school file, so FERPA applies.

Keep the two files separate, and don't assume a copy carries the original's protections.

How the main HIPAA rules work

HIPAA works through a few core pieces:

• Privacy Rule. Limits how covered entities use and disclose PHI and gives patients rights to their records.
• Security Rule. Requires covered entities to safeguard electronic PHI through administrative, physical, and technical protections.
• Transactions and Code Sets. Standardizes the formats and codes used for electronic health care billing.
• Defining PHI. PHI is individually identifiable health information that a covered entity holds or transmits. Its definition excludes FERPA education records, and that exclusion is the hinge of this section. Same diagnosis, different law.

When HIPAA Allows Health Information Sharing

Most of the time, a provider needs written permission before sharing a patient's health information. The Health Insurance Portability and Accountability Act (HIPAA) has a few exceptions you'll want to know.

Sharing allowed without patient authorization

Providers can share protected health information (PHI) without authorization in a few cases:

• Treatment, payment, and operations. Doctors, hospitals, and insurers can share information to treat patients, process payment, and run their operations.
• Public health reporting. Providers report things like contagious illness to public health agencies.
• Serious imminent danger. Information can be shared to prevent a serious, imminent threat to health or safety.

These exceptions cover specific purposes, not any purpose.

Sending health info from clinics to schools

Parents are the gatekeepers here:

• Parent authorization usually required. Clinics typically need a signed form from a parent or guardian first.
• Immunization proof with permission. With that permission, clinics can send proof of shots straight to the school.
• Minimum necessary standard. Clinics should share only what the school needs. A full medical history usually isn't part of that.

Picture a kindergarten teacher waiting on shot records. The family signs one form, and the teacher gets just the immunization record. The real question is what the school needs, not everything the clinic has.

Contracts with outside vendors

Outside software may store health forms, so two agreements matter most.

• Business associate agreements. When a vendor handles PHI for a clinic, the two sign an agreement on how that data is used and protected.
• School official agreements. Under the Family Educational Rights and Privacy Act (FERPA), a vendor can act as a school official through a written agreement that keeps it under the school's direct control.

Before any new app touches student health data, confirm a signed agreement is in place. Simple, but easy to skip.

Best Ways to Protect Records

Protecting records comes down to three habits: limiting access, storing securely, and documenting decisions.

Controlling who can see records

Assign one records custodian to own the files and answer access questions. Then set role-based permissions so each person sees only what they need, not everything the system allows.

An audit trail logs who opened or changed a record and when. A disclosure log tracks every time information leaves the school.

Consider a school nurse who gets a records request from a student's new doctor. Her disclosure log shows what was sent and when, so answering a parent's follow-up takes minutes, not days.

Storing and sending records securely

Use only school-approved systems with encryption, which scrambles data so only authorized users can read it. Never send health details through unencrypted email. Use a secure portal instead.

Lock paper files away, keep electronic records on school systems, and skip personal phones and flash drives. Fire, theft, or a failed hard drive can wipe out a file. Keep paper originals in a fireproof cabinet and back up electronic records off-site.

Documenting decisions and training staff

Use one standard consent form so every family's choices are recorded the same way. Schedule annual role-specific training, since front office staff and teachers handle different information.

Limit verbal discussion: if you're talking about a student's health or home life, keep it between people who need to know, never in the hallway or staff lounge.

Build a workflow for subpoenas, formal legal orders for documents, before one arrives. Write down who receives it, who reviews it, and who signs off, so no one scrambles or answers alone. Decide now, not mid-crisis.

Extra Protections Under State Laws

Federal law is only part of the picture, so we'll look at what your state can add. State protections can sit on top of federal rules, which means the rules you follow may depend on where you teach.

Keeping minors' sensitive care confidential

Some minors' care comes with confidential care protections, meaning it's protected, not just documented. Consider a health teacher whose student asks how to get a private test.

Before anything reaches a parent, she checks with the school nurse and her district's policy, so the student gets help and nobody's privacy takes a hit. Don't guess.

• Mental health: Counseling a minor may carry its own confidentiality rules.
• Reproductive health: Care like contraception or pregnancy services may have special privacy protections.
• Testing for human immunodeficiency virus (HIV) and sexually transmitted diseases (STDs): These results often follow their own rules.
• Substance use treatment: Treatment records can be guarded more tightly than ordinary health notes.
• Limits parental access: State rules can restrict what parents see, even if they can see other school files.

Other rules your state may require

Your state may also set rules for records, breaches, and abuse reporting.

• Retention schedules: Your state and district may set how long records are kept. Check the schedule rather than relying on memory.
• Breach notification: If records are exposed, state rules may require notice to families or officials. Tell your admin right away.
• Mandated abuse reporting: State law may require you to report suspected abuse or neglect. Know your district's steps before you need them.
• State-by-state matrix: Build a one-page matrix with a row for each topic above, your state's rule for it, and who to contact.

FERPA Rules in Prison Education Programs

Teaching inside a prison brings privacy questions most teachers never face. The Family Educational Rights and Privacy Act (FERPA) still applies to education records here, so let's look at where you'll need the most care.

Tough spots in consent and data sharing

Four situations call for extra caution:

• Free Application for Federal Student Aid (FAFSA) completion access. Who sees the sensitive data a learner enters, and under what consent?
• Department of Corrections sharing. When the Department of Corrections (DOC) asks for records, what does the consent actually cover?
• Password sharing concerns. Shared logins make it hard to tell who opened a record. Give everyone their own.
• Third-party technology. Before a learner logs into any outside app, check where its data goes.

Protecting learner data is less about whether and more about how. Take an adult education teacher who gets a DOC request for a learner's progress report. Before she sends anything, she checks that the signed consent names that agency and purpose.

That keeps the release within what the learner agreed to.

What the Education Department recommends

It comes down to four habits:

• Say "consent to share information." Use that exact wording on your forms so learners and agencies read the permission the same way.
• Rely on the standard DOC support letter. Use it instead of drafting a new one for every request.
• Make orientations mandatory. Everyone who handles learner information completes one before starting.
• Put job titles in the consent. Naming the role, not just the person, keeps it accurate when staff change.

Clear forms are only half the job.

Trusted Places to Find Guidance

Privacy questions, especially under the Family Educational Rights and Privacy Act (FERPA), tend to pop up at the worst moments: a parent call, a substitute's question, a form you're not sure you can sign.

You don't have to work out the answers alone, so here's where we'd start.

Where to find guidance and training

Start with these four resources:

• Privacy Technical Assistance Center. Turn here when your question is about how privacy rules apply to the technology and data systems your school uses.
• Student privacy website. A good first stop for plain-language direction when you're not sure where a question belongs.
• FERPA 101 and 201. Work through 101 for the foundations, then move to 201 once the basics feel solid.
• Expert webinars and blog posts. Hear how other educators have handled real situations, and catch new guidance as it's shared.

The goal isn't to memorize every rule. It's to respond with confidence rather than guesswork. Think of a fifth-grade teacher who gets a call from a parent asking who can see their child's attendance records.

She spends a few minutes reviewing FERPA 101 during her planning period, then returns the call with a clear, careful answer before the day ends. Bookmark these resources now.

The big idea is simple: when a record qualifies as a FERPA education record, HIPAA generally doesn't apply, so your school's FERPA rules are the ones to follow.

Keep attendance and health notes accurate and limited to what your role requires, and bring questions to your school administrators when a situation is unclear.

Ready to make attendance easier to manage? Check out Attendance & Records to mark attendance quickly and spot patterns across classes over time.

References

1. An Eligible Student Guide to the Family Educational Rights and Privacy Act (FERPA) — studentprivacy.ed.gov
2. FERPA Close-Up: When Video Captures Violence and Injury — digitalcommons.law.ou.edu (2018)