Direct comparison
FERPA vs HIPAA: Student Health Records
FERPA vs HIPAA compared row by row from 45 CFR 160.103, 34 CFR 99.3 and ED/HHS joint guidance: treatment records, university hospitals, hybrid entities.
Written and maintained by CASRAI Editorial Board
Last updated
Ask CASRAI · free to try
Ask about FERPA vs HIPAA: Student Health Records
Ask your first 2 questions free below. Subscribers get 150 a day for $29 a month.
An AI assistant specialized in research administration. It cites the sources behind every answer, labels web answers and says when it can't answer.
Answers draw on CASRAI's guides and dictionary plus the federal and funder documents we index: Federal Register, Grants.gov, Regulations.gov and UKRI.
Works on this site and inside Claude, Cursor and the AI tools you already use.
Everything CASRAI publishes — this page, the dictionary, the guides and the news — stays free to read, with no account and no card.
How do FERPA, HIPAA Privacy Rule compare side by side?
The table below compares FERPA, HIPAA Privacy Rule across 13 procurement-relevant dimensions, from governing text through source.
Side-by-side comparison
| Dimension | FERPA | HIPAA Privacy Rule |
|---|---|---|
| Governing text | FERPA, 20 U.S.C. 1232g, implemented by 34 CFR Part 99. | The HIPAA Privacy Rule, which relies on the definitions in 45 CFR 160.103. |
| Who is regulated | Educational agencies and institutions that receive U.S. Department of Education funds (public or private). | Covered entities: health plans, health care clearinghouses, and health care providers that transmit health information electronically in a covered transaction. |
| What records it protects | Education records: records directly related to a student and maintained by the institution or a party acting for it (34 CFR 99.3). | Protected health information (PHI): individually identifiable health information transmitted or maintained in any form (45 CFR 160.103). |
| How the two laws meet in the text | Student health information held in an education record is a FERPA record. | The PHI definition expressly excludes education records covered by FERPA, the FERPA treatment records, employment records held by a covered entity as employer, and records of a person deceased more than 50 years. |
| Elementary and secondary schools | FERPA is the law that applies to student health records held by the school. | The Privacy Rule generally does not apply: the school is either not a covered entity, or holds student health information only in FERPA education records, which are not PHI. |
| College student health clinic | Applies to a student patient's records, whether they are education records or treatment records. | Applies to nonstudent patients' PHI, for example when the clinic also serves staff, the public or family members. |
| Treatment records (postsecondary or age 18+) | Excluded from education records only if made and kept by a physician, psychiatrist, psychologist or other recognized professional acting in that capacity, used only for treatment, and disclosed only to people providing treatment. Remedial educational activities are not treatment. Treatment records disclosed to anyone else become education records. | Because the PHI definition excludes these FERPA treatment records, they are outside the PHI definition as well. |
| Billing and other non-treatment clinic records | Billing records are education records under the joint ED/HHS guidance. | Not PHI where they are education records under FERPA. |
| University-affiliated hospital | If the hospital does not serve students on behalf of the university, its records are typically not education or treatment records. If the hospital runs the student clinic on the university's behalf, the student records are under FERPA. | A hospital that is a covered entity follows HIPAA for records that are not FERPA records. |
| Hybrid entities and research units | A postsecondary institution's education and treatment records stay under FERPA wherever they are held. | A covered postsecondary institution may be a hybrid entity. Components such as a research department or campus law enforcement that hold records that are neither education nor treatment records may be subject to HIPAA unless they sit outside the designated health care component. |
| Oversight and questions | U.S. Department of Education Student Privacy Policy Office ([email protected] for technical assistance). | HHS Office for Civil Rights, which issued the joint guidance with the Department of Education. |
| Which to apply | Start here when the record is about a student and the institution (or a party acting for it) keeps it as part of its education function, including student health information. | Start here when the holder is a covered entity and the record is not a FERPA education or treatment record, such as a nonstudent patient or a hospital not acting for the school. Where one institution holds both kinds of records, classify each record first. |
| Source | 34 CFR 99.3 (law.cornell.edu/cfr/text/34/99.3); ED/HHS Joint Guidance on the Application of FERPA and HIPAA to Student Health Records (Dec 2019 update), studentprivacy.ed.gov; read 2026-11-08. | 45 CFR 160.103 (law.cornell.edu/cfr/text/45/160.103); ED/HHS Joint Guidance (Dec 2019 update); read 2026-11-08. |
Common questions
Common questions about FERPA vs HIPAA Privacy Rule
Does HIPAA or FERPA apply to student health records?
+
Usually FERPA. HIPAA's definition of protected health information excludes education records covered by FERPA and FERPA treatment records, so student health information in school records is generally governed by FERPA. HIPAA can still apply to a covered entity's records that are not FERPA records, such as a nonstudent patient's chart at a campus clinic.
Are college counseling or clinic records covered by HIPAA?
+
Records of a student patient that are treatment records (made and kept by a recognized professional, used only for treatment, disclosed only to treatment providers) fall outside FERPA's education-records definition and, because of the exclusion in the PHI definition, outside HIPAA's PHI as well. Treatment records disclosed to anyone else become education records under FERPA. Clinic records for nonstudents are PHI if the clinic is a covered entity.
Is a university hospital covered by FERPA or HIPAA?
+
Per the joint ED/HHS guidance, records of a university-affiliated hospital are typically not education or treatment records and fall under HIPAA if the hospital is a covered entity. If the hospital runs the student health clinic on the university's behalf, those student records are under FERPA instead.
Can a school nurse receive health information from a doctor under HIPAA?
+
Yes. The joint guidance states HIPAA permits a covered health care provider to disclose PHI to a school nurse for treatment without authorization, for example a student's primary care physician and a school nurse who administers medication.
Going deeper
