Does HIPAA exclude information considered education records under FERPA law?
True. The HIPAA Privacy Rule expressly excludes FERPA-covered education records (and FERPA-defined treatment records at postsecondary institutions) from its definition of Protected Health Information, so those records are governed by FERPA rather than HIPAA.
The answer
True. The HIPAA Privacy Rule specifically carves out records that are covered by FERPA. In the definition of Protected Health Information (PHI), HIPAA states that PHI excludes individually identifiable health information that is contained in education records covered by FERPA and in the 'treatment records' described in FERPA for eligible students at postsecondary institutions. In plain terms: if a student's health information lives in a record that FERPA already governs, HIPAA steps aside and FERPA controls it.
This exclusion exists to avoid two federal privacy laws claiming the same records. Congress drew a clean line: schools' education records — including the health information inside them — follow FERPA, while health information held by covered entities like hospitals, clinics, and health plans follows HIPAA.
Why the exclusion exists
FERPA (Family Educational Rights and Privacy Act) protects the privacy of education records held by schools that receive federal funding. Education records include most records maintained by the school about a student — and that sweeps in things like the school nurse's records, immunization records, and health information kept by the school as part of providing services to students.
HIPAA (Health Insurance Portability and Accountability Act) protects PHI held by covered entities (health-care providers who bill electronically, health plans, and clearinghouses) and their business associates.
Because a school nurse's file is already an education record under FERPA, HIPAA deliberately excludes it from PHI. Without this exclusion, a school would face conflicting obligations under both laws for the same file. The exclusion means a school does not typically apply HIPAA to records that FERPA already covers.
Applying it: which law covers a school health record?
- K–12 school nurse records, student immunization records, health screenings kept by the school → these are education records under FERPA, excluded from HIPAA.
- Postsecondary treatment records (counseling/health-center records used only for the student's treatment) → governed by FERPA's treatment-record provisions, also excluded from HIPAA PHI.
- A hospital or outside clinic treating the same student → that provider is a HIPAA covered entity, so those records are PHI under HIPAA.
- A school that runs a clinic billing electronically → can create a narrow situation where HIPAA's transaction rules apply, but records that qualify as FERPA education records still remain under FERPA.
Why 'False' is wrong
Saying the statement is false would imply HIPAA and FERPA both regulate the same school health records, which would create direct legal conflict. The regulatory text prevents that: HIPAA's own definition of PHI removes FERPA education records and postsecondary treatment records. So the statement is accurately True — HIPAA excludes information considered education records under FERPA.
The practical takeaway for researchers and CITI learners: when you want student health information from a school, you generally seek it under FERPA rules (often needing consent or a FERPA exception), not HIPAA authorization — because for those records FERPA, not HIPAA, is the controlling law.
| School nurse / health records held by a K-12 school | FERPA | They are education records, which HIPAA excludes from PHI |
| Student immunization records kept by the school | FERPA | Part of the education record; excluded from HIPAA |
| Postsecondary student treatment records (campus health/counseling) | FERPA | FERPA-defined treatment records are excluded from HIPAA PHI |
| Records at a hospital or outside clinic treating the student | HIPAA | The provider is a covered entity holding PHI |
Frequently asked
Does FERPA or HIPAA cover student health records?
FERPA generally covers student health records held by a school, because they are education records. HIPAA specifically excludes FERPA education records and postsecondary treatment records from Protected Health Information, so those school-held health records are governed by FERPA, not HIPAA.
What are education records under FERPA?
Education records are records directly related to a student and maintained by a school or its agents that receive federal funds. They broadly include grades, disciplinary files, and health information kept by the school, such as nurse and immunization records, which is why HIPAA excludes them.
Are school immunization records protected by HIPAA?
No. When immunization and other health records are maintained by a school as part of the education record, they are protected by FERPA and excluded from HIPAA's definition of PHI. HIPAA applies to the same information only when held by an outside covered entity like a clinic.
When does HIPAA apply to a school?
HIPAA can apply to a school if it acts as a covered entity, for example by operating a clinic that bills health plans electronically. Even then, records that qualify as FERPA education records remain under FERPA, so HIPAA's reach at schools is narrow.