HIPAA vs FERPA
Last reviewed: · By Victor Humenhuk (CIPP/US certified)
FERPA governs education records held by schools and colleges that receive U.S. Department of Education funding. HIPAA governs protected health information held by covered entities and their business associates. The two rarely collide, because HIPAA's definition of protected health information expressly excludes FERPA education records and the postsecondary treatment records that FERPA itself carves out. In practice a K-12 school nurse's file is a FERPA education record, while the same information held by an independent pediatric clinic is HIPAA PHI, and neither statute gives the individual a private right of action.
What does each law actually cover?
FERPA is a funding condition. It applies to educational agencies and institutions that receive funds under a program administered by the U.S. Department of Education, which in practice covers nearly every public school district and most colleges and universities. What it protects is the education record: any record directly related to a student and maintained by the school or by a party acting for the school. That includes grades, discipline files, financial aid records and, critically, health records the school itself keeps. The chapter topic on the FERPA education record works through the definition in more detail.
HIPAA is status-based. It applies to a defined set of covered entities - health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a HIPAA standard transaction - together with the business associates that handle protected health information on their behalf. Funding is irrelevant; what matters is whether the organization performs one of those functions.
The statutes are drafted so that they mostly do not overlap. HIPAA's definition of protected health information excludes education records covered by FERPA, and also excludes the postsecondary treatment records that FERPA removes from the education record definition. So the first question is almost never which law is stricter. It is whether the record is a FERPA record at all, because if it is, the HIPAA Privacy Rule steps aside.
HIPAA vs FERPA at a glance
| FERPA | HIPAA | |
|---|---|---|
| What triggers coverage | Receiving funds under a program administered by the U.S. Department of Education | Being a health plan, clearinghouse, or provider that transmits electronic standard transactions - or a business associate of one |
| What is protected | Education records: records directly related to a student and maintained by or for the school | Protected health information: individually identifiable health information relating to health, care or payment |
| Who exercises the rights | Parents, until the student turns 18 or enrolls in a postsecondary institution, at which point rights transfer to the eligible student | The individual who is the subject of the information; for an unemancipated minor a parent generally acts as personal representative, subject to state law |
| Default disclosure rule | No disclosure of personally identifiable information from education records without signed, dated written consent, unless an exception applies | No use or disclosure of PHI without authorization, except for treatment, payment and health care operations and other permitted purposes |
| Notable exceptions | School officials with a legitimate educational interest, transfer to another school, health or safety emergency, and directory information the student has not opted out of | Treatment, payment and operations, public health, required by law, and disclosures to the individual |
| Regulator | Student Privacy Policy Office, U.S. Department of Education | Office for Civil Rights, U.S. Department of Health and Human Services, with criminal referrals to the Department of Justice |
| Consequence of violation | Compliance action, ultimately withdrawal of federal funding; the Department has no power to fine | Tiered civil money penalties based on culpability, corrective action plans, and criminal penalties in serious cases |
| Private right of action | None - confirmed by the Supreme Court in Gonzaga University v. Doe (2002) | None; individuals complain to OCR, though state law claims may exist |
| Relationship to state law | Operates alongside state student privacy laws such as California's SOPIPA, which regulates edtech operators rather than schools | A federal floor - HIPAA does not preempt more stringent state protections |
Which law applies to a school health record?
Work through it in this order, because the answer turns on the exclusions rather than on which record looks more medical.
- Is the holder a FERPA-covered school? If it receives Department of Education funding, yes. A private school or clinic that takes no such funding is outside FERPA entirely.
- Is the record maintained by or for that school? Immunization records, nurse visit logs, IEP health information and counseling notes held by the school are education records, whoever created them.
- Is it a postsecondary treatment record? Records made or maintained by a physician, psychologist or other recognized professional in connection with treating an eligible student, used only in connection with that treatment and not disclosed to anyone other than those providing treatment, sit outside the education record definition - and are also excluded from HIPAA's PHI definition.
- Only if the answer to steps 1 and 2 is no do you ask whether the holder is a HIPAA covered entity or business associate.
Two worked examples. A public high school nurse records a student's asthma diagnosis: FERPA, even if the district also runs a self-funded employee health plan that is a HIPAA covered entity, because the record belongs to the school in its educational capacity. A community pediatrician treats the same student and sends a note to the school: the note is PHI in the pediatrician's hands and an education record once the school files it, so the same information is governed by different statutes depending on who is holding it.
Where do the two laws genuinely overlap?
Overlap is narrower than most people assume, but it is real in a few settings, which the topic on the FERPA and HIPAA boundary takes further.
- University health centers treating non-students. If a university clinic is a HIPAA covered entity and treats faculty, staff or members of the public, those patient records are PHI - the FERPA carve-outs only reach records about students.
- School districts as employers and plan sponsors. A district that sponsors a self-funded employee health plan is wearing a HIPAA hat for that plan. Employment records held in its role as employer are excluded from PHI, which is a separate exclusion from the FERPA one.
- School-based Medicaid billing. A school that bills Medicaid electronically can meet the definition of a covered entity, but its student health records remain education records, so FERPA still controls their disclosure.
- Vendors. An edtech supplier acting as a school official under FERPA is bound by FERPA through the school; a claims processor handling PHI for a clinic is a business associate bound by a business associate agreement. The compliance instrument is different even though the risk looks similar.
HHS and the Department of Education have issued joint guidance on the interaction, and the practical takeaway from it matches the statutory text: identify the holder and the record type first, then apply one rule set rather than trying to satisfy both at once.
Related study notes
- FERPA and the HIPAA Privacy Rule
- Health Information Is Protected Differently by Setting
- Education Record and Its Exceptions
- PHI and ePHI Defined
- FERPA Enforcement, No Private Right, and Preemption
Frequently asked questions
Is a school nurse's file a medical record or an education record?
In a FERPA-covered K-12 school it is an education record. Health information the school maintains about a student falls inside the education record definition, and HIPAA's definition of protected health information expressly excludes FERPA education records, so the HIPAA Privacy Rule does not govern it.
Does HIPAA apply to a university health center?
It can, but usually not to student treatment records. If the center transmits electronic standard transactions it may be a covered entity, yet records made in connection with treating an eligible student are excluded from PHI. Records about non-student patients at the same clinic are PHI.
Can a school disclose student health information in an emergency?
Yes. FERPA permits disclosure of personally identifiable information from education records, without consent, to appropriate parties whose knowledge of the information is necessary to protect the health or safety of the student or others in a health or safety emergency.
Can a student or parent sue the school for a FERPA violation?
No. The Supreme Court held in Gonzaga University v. Doe (2002) that FERPA creates no privately enforceable right. Complaints go to the Department of Education's Student Privacy Policy Office, and the ultimate sanction is withdrawal of federal funding. HIPAA likewise has no private right of action.
Test yourself
Try the free CIPP/US practice questions, or read the full CIPP/US study guide - free.