Hipaa Excludes Information Considered Education Records Under Ferpa Law.

Understanding the HIPAA Exclusion: When Student Records Fall Under FERPA, Not Healthcare Privacy Law

Navigating the complex landscape of privacy laws in the United States can be particularly challenging for parents, students, and educational professionals. A critical and often misunderstood point of intersection exists between the Health Insurance Portability and Accountability Act (HIPAA) and the Family Educational Rights and Privacy Act (FERPA). The fundamental rule is that HIPAA excludes information considered education records under FERPA law. But this means that for the vast majority of health-related information created and maintained by K-12 schools and post-secondary institutions, FERPA—not HIPAA—is the governing privacy statute. Understanding this exclusion is essential for knowing who can access a student’s health information, under what circumstances, and what rights students and parents possess.

What is FERPA? The Foundation of Student Record Privacy

The Family Educational Rights and Privacy Act, enacted in 1974, is the primary federal law protecting the privacy of student education records. Day to day, it applies to all educational agencies and institutions that receive federal funding from the U. S. Which means department of Education. FERPA grants specific rights to parents of minor students and to eligible students (those 18 years or older, or attending a post-secondary institution) once they turn 18 or enter college.

Under FERPA, an "education record" is broadly defined as records, files, documents, and other materials that contain information directly related to a student and are maintained by an educational agency or institution, or by a party acting for the agency or institution. This definition is intentionally wide-ranging and includes:

Academic records (transcripts, grades, class schedules)
Disciplinary records
Financial aid records
Health and medical records created by school nurses, counselors, or athletic trainers
Records of special education services (IEPs)
Emails and digital files containing student information

FERPA generally requires written consent from the parent or eligible student before an educational institution can disclose personally identifiable information from an education record. On the flip side, it includes numerous exceptions, such as disclosures to school officials with legitimate educational interests, other schools where a student is transferring, and in cases of health or safety emergencies.

What is HIPAA? The Standard for Healthcare Privacy

The Health Insurance Portability and Accountability Act, specifically its Privacy Rule, establishes national standards to protect individuals’ medical records and other personal health information (PHI). But it applies to covered entities: healthcare providers (who transmit health data electronically), health plans, and healthcare clearinghouses. HIPAA’s core purpose is to safeguard the privacy of patient information held by these healthcare professionals and organizations.

HIPAA gives individuals rights over their health information, including the right to access their records, request corrections, and receive an accounting of certain disclosures. It strictly limits how covered entities can use and share PHI for treatment, payment, and healthcare operations without explicit patient authorization.

The Crucial Exclusion: Why HIPAA Usually Doesn’t Apply to Schools

The HIPAA Privacy Rule contains a specific provision, known as the "FERPA Exception" or "Education Records Exclusion." It explicitly states that individually identifiable health information that is included in education records is exempt from HIPAA’s requirements. This exclusion exists because Congress intended FERPA to be the sole, comprehensive privacy framework for records maintained by educational institutions.

The U.S. Department of Education (ED), which enforces FERPA, have jointly clarified this relationship. Even so, s. Department of Health and Human Services (HHS), which enforces HIPAA, and the U.Their guiding principle is: **if a record is an "education record" under FERPA, it is not subject to HIPAA, even if it contains health information.

Key Criteria for the FERPA Exclusion to Apply:

The record must be maintained by the school or a party acting for the school. This is the most critical factor. If a school nurse, employed by the school district, creates a health record for a student in the school’s health office, that record is maintained by the school.
The record must be directly related to a student. Any health information that pertains to a student’s physical or mental health while they are enrolled qualifies.
The institution must receive federal funding from the Department of Education. Almost all public K-12 schools and most colleges and universities meet this criterion.

Example: A student visits the school nurse for an asthma attack. The nurse documents the incident, treatments provided, and the student’s health history in the school’s health office file. This file is an education record under FERPA. So, HIPAA does not apply. The parent’s right to access this record, and the school’s ability to share it (e.g., with a teacher for emergency planning or with another school upon transfer), is governed by FERPA’s rules and exceptions.

Continue exploring with our guides on write an equation for the line graphed below and why should readers preview headings in an expository article.

Common Scenarios Where FERPA Governs, Not HIPAA

To solidify understanding, consider these typical school situations:

School-Based Health Clinics: If a clinic is operated by the school district and its staff are school employees, patient records are education records. So * Counseling Center Notes: A university counseling center, as part of the institution, creates records that are education records. There is a FERPA exception for "treatment records" of students over 18, but this is a narrow, often misunderstood provision that does not automatically make them HIPAA-covered.
Athletic Trainer Injuries: Documentation of sports injuries and treatments by a school-employed athletic trainer is an education record. HIPAA does not apply. Day to day, these are protected by FERPA. Even so, if the clinic is run by an external, private healthcare provider that is a HIPAA-covered entity and maintains separate medical records, HIPAA could apply to those specific records.
Special Education Evaluations: Psychological assessments, medical diagnoses provided to the school for IEP development, and therapy notes from school-based therapists are all education records.

The "Treatment Records" Misconception for Post-Secondary Students

A frequent point of confusion involves the FERPA provision regarding "treatment records" for students over 18 or attending a post-secondary institution. F

does not create a HIPAA exception. If a university counseling center, staffed by university employees, creates a note, it is an education record. The misconception arises because some interpret this FERPA exception as a gateway to HIPAA, but it is not. A record’s classification depends on its origin and custodian, not the student’s age. Which means under FERPA, "treatment records" are a specific subset of education records that may be shared with appropriate parties without consent for the student’s treatment. That said, these records remain education records under FERPA, not medical records under HIPAA. HIPAA would only apply if that same note were maintained by a separate, external medical provider that is a HIPAA-covered entity—a rare arrangement in a typical university counseling structure.

Practical Implications for Schools and Parents

This distinction has significant operational consequences:

Parental Access: For K-12 students, FERPA generally grants parents the right to inspect and review their child’s education records, including health records, until the student turns 18 or attends a post-secondary institution. After that, rights transfer to the student. Here's the thing — this differs from HIPAA, where parents are often the personal representatives of minor children and retain access rights. Practically speaking, * Disclosure Without Consent: FERPA permits schools to disclose education records to school officials with legitimate educational interests, to other schools where the student is enrolling, in health or safety emergencies, and as required by law. HIPAA’s "treatment, payment, and healthcare operations" (TPO) exceptions do not automatically apply to school nurses or counselors. So a school nurse sharing a student’s asthma action plan with a teacher for classroom safety is permitted under FERPA’s legitimate educational interest or health/safety emergency provisions, not under HIPAA’s TPO rules. * Recordkeeping and Security: Schools must manage these records according to FERPA’s security and privacy requirements, which, while reliable, differ in specific mandates from HIPAA’s administrative, physical, and technical safeguards.

Conclusion

The short version: the vast majority of health information created and maintained by school personnel—nurses, counselors, athletic trainers, and therapists—within the scope of their school employment constitutes education records under FERPA. On top of that, the application of HIPAA in the K-12 and typical post-secondary setting is the exception, not the rule, generally limited to situations where a distinct, external HIPAA-covered entity operates a clinic on campus and maintains its own separate medical records. Understanding this fundamental boundary is not an academic exercise; it is essential for school administrators, health staff, and parents to ensure compliance, protect student privacy, and support the appropriate sharing of critical health information to support student safety and well-being within the educational environment. When in doubt, the guiding principle is the identity of the record’s creator and maintainer: if it’s a school employee acting for the school, FERPA is the governing law.