Guides

FERPA vs HIPAA in school health communication: a practitioner's guide

The federal guidance on this exists, it is joint, and it is written for lawyers. What a nurse needs at 9:40 on a Tuesday, with a teacher standing in the doorway asking whether she can be told which child has the seizure disorder, is a decision she can make in ninety seconds and defend afterwards. This is that version. It is not legal advice, and where the answer depends on your state or your district's arrangements it says so.

Last reviewed 2026-08-04 · Kastr is pre-launch; we publish dated status rather than logos.

Fourteen situations, and which framework decides each
Situation	Governing framework	Generally permitted?	The condition attached
Telling a classroom teacher a student has a seizure disorder	FERPA	Yes	School official with a legitimate educational interest, as defined in your annual notification
Telling a bus driver a student carries an epinephrine auto-injector	FERPA	Yes	Same, provided your policy defines transport staff as school officials for this purpose
Telling a substitute teacher the same thing	FERPA	Yes	Same test applies; a substitute is a school official while covering
Naming a child with lice in a letter to other parents	FERPA	No	No exception covers disclosure to other families
Telling another parent which child has a diagnosis	FERPA	No	Same — and the pressure to do it is intense, which is why the script must be written
Reporting a communicable disease case to the health department	FERPA plus state disease law	Yes	State law compels it; FERPA accommodates disclosure required by law
Responding to a subpoena for a health record	FERPA	With process	Notify the parent before complying, unless the order says otherwise
A divorced parent requesting the record	FERPA	Usually yes	Both parents have access unless a court order says otherwise; ask for the order, do not assume
A coach asking about a concussion	FERPA plus state concussion law	Limited	Share the participation restriction, not the clinical detail
A reporter asking about an outbreak	FERPA	Aggregate only	No individual detail; route to comms and the health department
Sending records to the district a student transferred to	FERPA	Yes	Transfer exception; your annual notification should say you do this
A parent texting you their child's diagnosis	FERPA	It becomes a record	Once held by the school in a recorded form and used for the student, treat it as one
Notes you keep only for yourself, shown to nobody	FERPA — sole possession	Excluded, narrowly	The moment anyone else sees them, or they are relied on by others, the exclusion is gone
Discussing a student in the staff room	Not a legal question	No	This is where almost every real disclosure happens

Written against FERPA at 34 CFR Part 99 as we understand it. Several rows depend on your district's own annual notification and policy — particularly who is designated a school official and what counts as a legitimate educational interest. State law adds obligations in some rows and restricts disclosure in others. Confirm application with your district counsel and school health services lead; this is a decision aid, not advice.

The short answer on HIPAA

Nurses are told constantly that they are bound by HIPAA. In a public school, that is usually not the operative framework, and the confusion causes real harm in both directions — nurses withhold information from a teacher who is entitled to it, and disclose in situations FERPA does not permit.

The structure, as plainly as it can be put:

FERPA governs education records held by a school or district receiving US Department of Education funds. A student health record maintained by the school is, in the ordinary case, an education record.
The HIPAA Privacy Rule applies to covered entities — health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with certain standard transactions, chiefly billing. Most public schools are not covered entities, because they do not bill electronically for the care they provide.
Where both could apply, HIPAA steps back. The HIPAA Privacy Rule's definition of protected health information expressly excludes records that are FERPA education records. So even a school that is a covered entity for some purpose is generally applying FERPA to its student health records.
HIPAA still shows up at the boundary. The paediatric practice, the hospital, the clinic — those are covered entities, and they are bound when sending information to you. That is why a provider asks for a signed authorisation before releasing records to the school, and it is not the school being difficult.

Two situations complicate this. A school-based health centre operated by an outside provider may genuinely be a HIPAA covered entity operating inside your building, with its own records under its own rules. And a district that bills Medicaid electronically for school health services may have a covered-entity footprint for that activity. Both are worth resolving in writing for your own district rather than reasoning about generally — and both are questions for counsel, not for a template.

The exceptions a nurse actually uses

FERPA generally requires written parental consent to disclose personally identifiable information from an education record. The exceptions are a short list, and a school nurse uses six of them.

School officials with a legitimate educational interest. The workhorse. It permits telling a teacher, an aide, a bus driver or a coach what they need in order to do their job for that student. Two conditions attach: your district's annual notification must specify the criteria for who is a school official and what constitutes a legitimate educational interest, and the disclosure must be limited to what that person actually needs. A teacher needs to know a child has a seizure disorder and what to do; they do not need the medication history.
Health or safety emergency. Narrower than its reputation. It permits disclosure, in an actual emergency, to people whose knowledge is necessary to protect the health or safety of the student or others — paramedics, public health authorities, in some cases parents of the affected student. It has never been a route to naming a child to the general parent body, and the temptation to read it that way during an outbreak is the single most common misapplication in school health.
Disclosure required by law, including public health reporting. State communicable-disease law compels reporting, and complying with it is not a FERPA problem.
Lawful subpoena or court order. Generally requires notifying the parent before you comply, so they have an opportunity to respond — unless the order itself directs otherwise. Route every one of these through counsel; never respond to a subpoena from the health office directly.
Directory information. Rarely relevant to health, and worth knowing precisely because a health condition is never directory information no matter how a district defines it.
De-identified information. Aggregate figures with no reasonable basis to identify an individual. This is what makes an outbreak letter possible at all, and the test is whether someone in the community — not a stranger — could work out who it is.

Two administrative obligations that follow. FERPA requires a district to maintain a record of certain disclosures with the education record, so a parent can see who has had access. And the school-official exception depends entirely on what your annual notification says — if it does not designate transport staff or contractors, you cannot rely on it for them. Read yours; most nurses never have.

What you may say in an outbreak letter: a language bank

The single most useful artefact for a health office. Three columns of the same idea, with the line between them drawn where it actually falls.

Permitted.

A case of [CONDITION] has been confirmed at [SCHOOL].
A case of [CONDITION] has been confirmed in [GRADE]. — in a school with multiple sections per grade.
We have several cases of [CONDITION] in the building this week.
Students who may have been exposed have been contacted directly.
We are working with [HEALTH DEPARTMENT], which is leading the public health response.
We are not able to share information about any individual student.

Borderline — depends on your school's size and what else is in the letter.

A case has been confirmed in Ms. [TEACHER]'s class. — fine in a large elementary, identifying in a small one.
One case has been confirmed in [GRADE]. — a count of one narrows sharply; consider omitting the number.
The case was identified on [DATE]. — combined with a room and a visible absence, this identifies.
A student on bus route [N]. — a route is a small group; usually too narrow.

Prohibited.

Any name, initials, or nickname.
The student has been excluded from school until [DATE].
The family has been advised to seek treatment.
The student's sibling in [GRADE] has also been tested.
The student is unvaccinated. — an immunization status disclosure, and the most damaging of all of these.
There is no risk to other students. — not a privacy problem, but it belongs on this list anyway.

The test to apply to a finished letter: hand it to someone who works in the building and ask whether they can work out which child it is. If they can, so can a parent.

The disclosures that actually happen

Almost no real privacy incident in a school health office comes from a letter. Letters get reviewed. The incidents come from these:

The staff room. A concerned, well-meaning conversation between two adults who both know the child, overheard by a third who does not need to.
The health-office counter. A clipboard, a sign-in sheet, a list of names next to a reason for visiting, visible to whoever is standing there. This is the most fixable and the most common.
The audience of a message. A notice sent only to the households of one classroom, on the day one child went home visibly unwell, tells the recipients as much as a name would. Audience choice is disclosure, and it is invisible in a review because the text of the letter is clean.
The reply-all. An email to twenty-four families with the addresses in the To field discloses the class roster and, in context, more than that.
The screen. A student record open on a monitor angled towards the counter.
The forwarded thread. A message to a teacher that quotes the clinical detail, forwarded to a colleague with the history intact.

The audience point, stated once more because it is the one people miss. A carefully anonymised letter sent to a small enough group is not anonymous. When you send to one classroom about a condition the recipients can attribute, you have made a disclosure through the choice of recipients. The mitigations are to widen the audience to a grade or a building, or to delay slightly so the send is not adjacent to a visible event, or not to send. This is a judgement, it belongs to the nurse and not to the software, and no platform will warn you about it.

Records, retention and what a comms platform holds

Two record systems are in play and they are frequently conflated. The student health record lives in your health record system and is governed by FERPA, your state's record-retention schedule, and your district's policy. The communications record — what was sent, to whom, when, in what language, and what happened to it — lives wherever you send from.

The second one matters more than districts assume, because it is the evidence for every question that arises later: was the family notified, in what language, at what number, and did it arrive.

What Kastr holds, and what it does not. Kastr is a communications platform. It does not hold a student health record, an immunization record, or a care plan, and it applies no clinical or compliance logic. What it holds is the send record: every send writes to a per-district audit log, hash-chained with SHA-256 so each entry covers the one before it, append-only at two independent layers — UPDATE and DELETE revoked at the database role, plus row-level security policies granting INSERT and SELECT only. Isolation is enforced through a non-owner database role inside every transaction and is hierarchy-aware, so a school sees its own and its children's rows and never another district's; with no organisation context set, the policies return zero rows rather than everything. Retention defaults are published per record class. Two things we will not claim: there is no self-serve export tool — export is a contract right under clause 7.1, exercised through us, and the self-serve tooling is not built — and we hold no SOC 2 attestation, because we are pre-launch and have not been audited. Contract clause 9.4 commits that we never market or sell to district families and never take family-facing revenue, which is a different arrangement from platforms that bill parents directly.

Questions people actually ask

Is a school nurse a HIPAA covered entity?

Usually not. HIPAA applies to covered entities, chiefly providers who transmit health information electronically for billing and similar standard transactions, and most public schools do not. More importantly, HIPAA's definition of protected health information expressly excludes FERPA education records, so a school's student health records are generally governed by FERPA even where a district has some covered-entity footprint. School-based health centres run by outside providers and districts billing Medicaid electronically are the complications worth resolving in writing with counsel.

Can I tell a classroom teacher which student has a diagnosed condition?

Generally yes, under the school-officials exception, provided your district's annual notification defines who counts as a school official and what a legitimate educational interest is, and provided you share only what that person needs to do their job. A teacher needs to know a child has a seizure disorder and what to do if one happens; they do not need the medication history or the diagnosis date.

Does the health-or-safety emergency exception let me name a student in a letter to other parents?

No. The exception permits disclosure, during an actual emergency, to people whose knowledge is necessary to protect health or safety — emergency responders, public health authorities, and similar. The general parent body is not that group, and reading the exception that way during an outbreak is the most common misapplication in school health. Write the letter so no combination of details identifies the child.

Do I have to log every disclosure of a student health record?

FERPA requires a district to maintain a record of certain disclosures with the education record so that a parent can see who has had access, with defined exceptions — disclosures to parents and to school officials with a legitimate educational interest among them. Ask your records officer exactly what your district logs and where, because practice varies and the health office is frequently outside whatever system the registrar uses.

If a parent texts me their child's diagnosis, is that text now an education record?

Treat it as one. Once the school holds information about a student in a recorded form and uses it in relation to that student, the safest working assumption is that it is an education record with all that follows. The practical implication is that clinical information should not accumulate on personal devices: move it into the health record, and use a district channel for the conversation.

One price. Every feature. Locked for three years.

$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.

See the pricing table Become a design partner