HIPAA vs FERPA
Student health records maintained by a FERPA-covered school are generally governed by FERPA, not HIPAA. The HIPAA Privacy Rule expressly excludes FERPA education records and qualifying treatment records from protected health information. The record holder, relationship to the school and type of patient decide the result.
Start with the record, not the diagnosis. Ask who maintains it, whether that person acts for a FERPA-covered institution, whether the patient is a student and whether an outside provider is independently subject to HIPAA.
HIPAA and FERPA compared
| Question | FERPA | HIPAA Privacy Rule |
|---|---|---|
| Primary subject | Education records and qualifying treatment records | Protected health information |
| Typical institution | Education agencies and institutions receiving U.S. Department of Education programme funds | Health plans, clearinghouses and providers conducting covered electronic transactions |
| Primary regulator | U.S. Department of Education | HHS Office for Civil Rights |
| School health records | Usually applies when the school or its agent maintains them | FERPA records are excluded from PHI |
| University clinic | Usually covers student education or treatment records | May cover nonstudent patient records |
Five questions that determine which rule applies
- Is the institution subject to FERPA? FERPA applies to educational agencies and institutions receiving funds under programmes administered by the Department of Education.
- Who maintains the record? A school employee or contractor acting for the school generally creates a FERPA record.
- Is the patient a student? A university clinic may hold FERPA records for students and HIPAA records for nonstudents.
- Is an outside provider acting independently? A provider not employed by, contracted to or acting for the school may hold records outside FERPA.
- Is that provider a HIPAA covered entity? HIPAA applies only if the provider meets the covered-entity test, including the relevant electronic transactions.
Common scenarios
| Scenario | Likely rule | Why |
|---|---|---|
| Public school nurse maintains a student's health file | FERPA | The record is maintained by a FERPA-covered school |
| Contract nurse acts on behalf of that school | FERPA | A party acting for the school can maintain an education record |
| Independent clinic treats a student and does not act for the school | Potentially HIPAA | The record may sit outside FERPA, but the provider must still be a HIPAA covered entity |
| University health centre treats an enrolled student | FERPA | The record is generally an education or treatment record |
| University clinic treats a member of the public | Potentially HIPAA | The patient is not a student and the clinic may be a covered entity |
Two traps to avoid
- Health information is not automatically HIPAA information. HIPAA regulates particular entities and records, not every fact about health.
- A school can have both regimes. A university may designate a health-care component and maintain FERPA records for students while HIPAA applies elsewhere.
Primary sources
- HHS and Department of Education joint FERPA and HIPAA guidance.
- Department of Education guidance on student health records.
Reviewed 29 August 2026. This is an exam-preparation summary, not legal advice.
Continue with the CIPP/US study guide or practice in the question bank.
Sources and study method
This independent study material uses the current published CIPP/US outline, active recall, spaced retrieval and scenario practice. Read the full method. Current sources are identified in the article.
Frequently asked questions
Does HIPAA or FERPA cover school health records?
Student health records maintained by a FERPA-covered school, or by a party acting for it, are generally education records under FERPA and are excluded from HIPAA protected health information.
Does HIPAA apply to a school nurse?
Usually not to student records maintained by a FERPA-covered school. The result can differ for a private school outside FERPA or an independent health provider that is a HIPAA covered entity.
Does FERPA cover university clinic records?
Records concerning student patients are generally education or treatment records under FERPA. Records concerning nonstudent patients may fall under HIPAA when the clinic or university is a HIPAA covered entity.