10.1 FERPA vs. HIPAA in School Nursing Practice

Overview of FERPA vs. HIPAA in the School Environment

School nurses operate at the complex intersection of healthcare delivery and educational administration. A foundational requirement for National Certified School Nurse (NCSN) candidates is mastering the federal legal frameworks governing student health privacy: the Family Educational Rights and Privacy Act (FERPA) (34 CFR Part 99) and the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Parts 160 and 164).

Misunderstandings regarding which statute applies to school health records are common among healthcare providers transitioning into the academic setting. On the NCSN exam, questions frequently test your ability to correctly identify the governing law, determine appropriate record disclosures, apply emergency exceptions, and safeguard student privacy rights.

---

FERPA: Scope, Application, and Definition of Education Records

Enacted in 1974, FERPA applies to all educational agencies and institutions that receive federal funds under any program administered by the U.S. Department of Education. This encompasses virtually all public elementary, secondary, charter, and post-secondary school districts.

Under FERPA, an "education record" is broadly defined as any record that is:

1. Directly related to a student; and
2. Maintained by an educational agency or institution or by a party acting for the agency or institution.

Classification of Student Health Records

In public school districts, all student health documentation—including immunization records, Individualized Healthcare Plans (IHPs), daily clinic visit logs, medication administration records (MARs), Individualized Education Program (IEP) related health services, sports physicals, and nursing assessments—falls squarely under the statutory definition of education records.

Key implications of FERPA record classification include:

• Parental Inspection Rights: Parents and legal guardians have the statutory right to inspect, review, and request amendments to their child's health records until the student reaches age 18 or attends an institution of postsecondary education (becoming an "eligible student").
• School Official Access: Access to student health information within the school district is governed by "legitimate educational interest" (need-to-know standard), allowing school personnel (e.g., teachers, administrators) access only to information necessary to fulfill their professional responsibilities for the student.
• Directory Information Exclusion: Health records are never classified as directory information and can never be disclosed without explicit authorization unless a statutory exception applies.

---

The HIPAA Privacy Rule and Public School Exemption

The HIPAA Privacy Rule, enacted in 1996 and administered by the U.S. Department of Health and Human Services (HHS), establishes national standards for protecting Protected Health Information (PHI) held by covered entities (healthcare clearinghouses, health plans, and healthcare providers who transmit health information electronically).

The Statutory Exclusion

Congress explicitly addressed the potential overlap between HIPAA and FERPA in the HIPAA Privacy Rule regulations (45 CFR § 160.103). The definition of Protected Health Information specifically excludes:

1. Education records covered under FERPA;
2. Treatment records of eligible students described under 20 U.S.C. § 1232g(a)(4)(B)(iv).

Because public school health records are FERPA education records, public school districts are generally exempt from HIPAA Privacy Rule compliance regarding student health records. Even if a school nurse bills Medicaid electronically (making the district a HIPAA covered entity for billing transactions), the underlying student health records remain governed exclusively by FERPA, not HIPAA.

---

Sole Possession Notes Exception: Definition, Scope, and Legal Pitfalls

One of the most heavily tested FERPA nuances on the NBCSN examination is the sole possession notes exception (34 CFR § 99.3).

Statutory Definition

FERPA excludes from the definition of education records notes that are:

• Kept in the sole possession of the maker;
• Used only as a personal memory aid; and
• Not accessible or revealed to any other person except a temporary substitute for the maker.

Strict Legal Parameters and Common Pitfalls

To maintain legal status as a sole possession note, the documentation must satisfy all three criteria strictly. The moment a school nurse discloses the contents of a note to a principal, guidance counselor, teacher, parent, or multidisciplinary team, the note immediately loses its sole possession status and automatically becomes a FERPA education record subject to parental review.

[Sole Possession Note] ──(Shared with Administrator or Team)──> [Official FERPA Education Record]

• Clinical Working Notes vs. Official Records: Personal memory aids regarding informal observations or clinical impressions may qualify as sole possession notes if kept exclusively in the nurse's private drawer/encrypted personal file. However, routine nursing assessment notes, vital signs, medication logs, and treatment records are clinical care documentation and must be maintained in the official FERPA health record.
• Substitute Coverage Exception: Passing notes to a formal substitute nurse during an absence is permissible under FERPA without invalidating sole possession status, provided the substitute uses them strictly as a temporary personal memory aid.

---

Health and Safety Emergency Exception (34 CFR § 99.36)

While FERPA generally mandates written parental consent prior to releasing student education records, the statute contains a critical emergency exception designed to protect student and community welfare.

Legal Standard: Articulable and Significant Threat

Under 34 CFR § 99.36, an educational agency or institution may disclose personally identifiable information (PII) from an education record without prior consent to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.

To invoke this exception lawfully, the school nurse and district must satisfy specific criteria:

1. Articulable Threat: There must be an actual, imminent, and articulable threat to health or safety (e.g., active suicidal ideation with plan, severe anaphylactic reaction, weapon threat, acute outbreak of a dangerous reportable communicable disease like meningococcal meningitis).
2. Targeted Recipients: Information may only be disclosed to parties who strictly need the information to address the emergency (e.g., emergency medical technicians, emergency department physicians, local public health officials, law enforcement officers).
3. Mandatory Documentation: FERPA requires the district to document in the student's record the specific articulable threat that formed the basis for the disclosure and the parties to whom information was disclosed within 24 hours of the event.

---

Parental Consent Requirements and Record Disclosure Workflows

Except when statutory exceptions (such as the Health and Safety Emergency Exception or judicial court orders) apply, FERPA mandates obtaining written, signed, and dated parental consent prior to releasing PII from student health records to outside parties.

Mandatory Elements of a Valid FERPA Consent Form

A compliant Release of Information (ROI) consent document must explicitly specify:

1. The specific health records to be disclosed (e.g., asthma action plan, allergy testing results, psychological evaluations);
2. The specific purpose of the disclosure (e.g., care coordination with private pediatric allergist);
3. The exact party or class of parties to whom the disclosure may be made; and
4. The signature of the parent/guardian (or eligible student) and the date executed.

FERPA Consent Checklist:
[✓] Specific records identified
[✓] Clear purpose stated
[✓] Designated recipient named
[✓] Signed and dated by parent/eligible student

---

Comparative Analysis: FERPA vs. HIPAA Compliance Table