FERPA vs HIPAA
When student health records fall under FERPA and when HIPAA applies — school nurses, campus health centers, school-based clinics and university hospitals.
FERPA vs HIPAA at a glance
Most K-12 schools and colleges are covered by FERPA, not HIPAA, for student records. Health records kept by a school nurse or campus clinic for students are usually education records or treatment records under FERPA, and HIPAA's definition of protected health information excludes them. HIPAA applies when a health care provider that conducts standard electronic transactions — such as an outside clinic or a university hospital treating the public — holds the records. HHS and the Department of Education explain the line in joint guidance updated in December 2019.
| K-12 school nurse records | Usually FERPA education records — not HIPAA |
|---|---|
| College student health center records | Usually FERPA treatment records — not HIPAA |
| HIPAA applies when | A covered provider holds the records, e.g. an outside clinic or hospital |
| Official guidance | HHS / Department of Education joint guidance, updated December 2019 |
HIPAA’s definition of protected health information excludes health information in education records covered by FERPA and in student treatment records described in FERPA (20 U.S.C. 1232g(a)(4)(B)(iv)) (45 CFR 160.103). That single exclusion decides most school questions.
Who follows which law
| Setting | Usually governed by |
|---|---|
| K-12 school nurse records on students, at a school receiving federal education funds | FERPA |
| College or university student health center records about students | FERPA (treatment records) |
| School-based health center run by an outside provider that bills insurance electronically | HIPAA, for that provider’s records |
| University hospital treating members of the public | HIPAA |
| Private school that receives no Department of Education funds | Neither FERPA nor (usually) HIPAA for student records — state law applies |
The joint guidance from HHS and the Department of Education, first issued in 2008 and updated in December 2019, walks through these cases and adds answers on sharing information in emergencies, with parents of adult students, and about mental health and substance use.
If a provider that is a HIPAA covered entity works in a school, look at who employs the provider and who holds the record — that decides which law applies.
Next steps
Frequently asked questions
Does HIPAA apply to schools?
Generally not to student records at schools that receive Department of Education funds — FERPA governs those. HIPAA's definition of PHI excludes education records covered by FERPA.
Is a school nurse covered by HIPAA?
Usually not for student records. A school nurse's records on students are typically education records under FERPA. A nurse employed by an outside provider may be different.
Can a school share a student's health information with parents?
FERPA generally gives parents of minor students access to education records, and allows certain disclosures without consent, such as in health or safety emergencies. The joint guidance covers these cases.