FERPA vs. HIPAA: How Educational and Medical Privacy Laws Protect Student Health Records

When you head off to college, your medical history enters a complex legal landscape. This guide explains FERPA vs HIPAA student medical in detail. Two federal laws—FERPA and HIPAA—control who can access your health information and under what conditions. However, many students and parents assume these laws offer more protection than they actually do. Therefore, it's crucial to understand the real limits. Additionally, the answer to 'can you keep your health records private?' often surprises people. Moreover, these laws apply differently to college students than to minors. Consequently, you need to know your rights before a crisis occurs. This overview clarifies the key differences and practical implications for your campus life.

The reality is that the answer to "can university view my medical diagnosis" is often yes, depending on where that information lives and who recorded it.

However, the protections under FERPA and HIPAA differ significantly for college students.

This article breaks down how these laws interact, what rights you actually hold, and what steps you can take to keep sensitive health details private.

The Core Difference: Who Holds Your Records Determines the Law

The fundamental distinction between FERPA and HIPAA comes down to the role of the institution holding your information. A single university campus can contain records governed by both laws simultaneously, and which law applies depends entirely on who created the record and why.

Therefore, you must check your college's specific policies to understand who can see your records.

HIPAA — the Health Insurance Portability and Accountability Act — protects "protected health information" held by "covered entities." These include doctors' offices, hospitals, health insurers, and other healthcare providers.

When you visit the campus health center for a physical or a mental health consultation, those medical records fall under HIPAA if the health center bills insurance or transmits health information electronically for billing purposes.

The U.S. Department of Health and Human Services explains that HIPAA applies to health plans, healthcare clearinghouses, and healthcare providers who conduct certain transactions electronically. Most university health centers qualify as covered entities because they bill insurance providers.

FERPA — the Family Educational Rights and Privacy Act — protects "education records." The U.S. Department of Education defines these as records that contain information directly related to a student and are maintained by an educational agency or institution.

Here's where it gets complicated: if a university health center is considered part of the educational institution for FERPA purposes, the records it maintains may be treated as education records rather than HIPAA-protected medical records.

This is a significant distinction because FERPA gives parents of dependent students access rights that HIPAA would normally restrict. The U.S. Department of Education and HHS jointly issued guidance clarifying this overlap.

They explained that records maintained by a postsecondary institution's health clinic are generally education records under FERPA, not "treatment records" under HIPAA, unless the clinic is a separate covered entity conducting transactions like billing insurers independently.

This means your campus health records may be accessible to your parents (if they claim you as a dependent on taxes) under FERPA's parental access provisions — something most students never expect.

Can University View My Medical Diagnosis? (FERPA vs HIPAA student medical)

According to the U.S. Department of Health & Human Services (HHS), proper medical documentation is essential for protecting your rights.

What the Law Actually Permits The short answer: yes, in several scenarios, and you may not even be notified. This surprises most students who assume their medical information is sealed.

Under FERPA, university officials with "legitimate educational interests" can access education records without your consent. The law permits disclosure to school officials who have a legitimate educational interest, including faculty advisors, academic deans, and sometimes even coaches or administrative staff. The university must annually notify students of their FERPA rights and specify what constitutes a legitimate educational interest, but the definition can be broad.

Here are the key scenarios where your medical information may be visible:

• Disability accommodations: If you register with the disability services office for academic accommodations, your documentation becomes part of your educational record.

Professors may receive notification that you have approved accommodations, though the specific diagnosis is typically not shared unless you request otherwise.

• Medical leave of absence: When you request a medical leave, your documentation supporting that request becomes part of the leave process.

The committee reviewing your request may see details of your condition, treatment plan, and prognosis.

• Residence life exceptions: If you live on campus and have a medical condition that affects housing, the housing office may need to know certain details to accommodate you.

• Health and safety emergencies: FERPA includes a health and safety emergency exception that permits disclosure without consent when knowledge of the information is necessary to protect the health or safety of the student or other individuals.

Under HIPAA, if your record is held by a healthcare provider that qualifies as a covered entity, the provider can disclose your information to the university's administration with your authorization.

However, HIPAA generally requires written authorization before a covered entity can share your records with your school. The exception occurs when the disclosure is required by law — and FERPA can be that "law" that compels disclosure. The U.S.

Department of Education's Family Policy Compliance Office has addressed this directly.

Their guidance states that when a student's health records are maintained by the university, FERPA applies, and the university may disclose those records to appropriate parties in connection with a health or safety emergency.

This creates a significant gap in privacy protection that many students only discover after a crisis.

How Student Health Record Privacy Differs on Campus

According to the National Institutes of Health (NIH), proper medical documentation is essential for protecting your rights.

The practical application of these laws varies by record type and campus department. Understanding these distinctions helps you make informed decisions about what you share and with whom. Campus health center — These records are the most confusing.

If your university's health center bills insurers electronically, it may be a HIPAA covered entity for billing purposes. But the Department of Education guidance indicates that the same records can simultaneously be education records under FERPA. In practice, most university health centers operate under FERPA's framework, which means parents of dependent students can request access to their child's health center records.

Students who want to prevent this can file a statement with the university declaring that they are not a dependent for tax purposes, which blocks FERPA-based parental access.

Off-campus healthcare providers — When you see a doctor off campus who is not employed by the university, those records are squarely under HIPAA. The university cannot access them without your written authorization. This distinction matters: if you want maximum privacy, seeing an off-campus provider may offer stronger protections than using the campus health center.

Counseling and mental health services — These records receive special treatment under both laws. FERPA's "treatment records" exception excludes records made by physicians, psychiatrists, psychologists, or other recognized professionals used only for treatment purposes. These treatment records are not subject to FERPA parental access rights.

However, the exception doesn't apply if the records are shared with anyone other than the treating professional — so if your counselor shares notes with the disability services office, those notes may lose their protected status.

Athletic department records — Team physicians and athletic trainers maintain records that occupy a gray area. If the athletic department is considered part of the educational institution, their records may fall under FERPA. This means coaches and athletic directors may have access to your medical information in ways that surprise student-athletes.

What You Can Do to Protect Your Medical Information

Despite the complexity, you have several practical options to maintain control over your health information on campus. Understand your FERPA rights first. The Department of Education requires institutions to notify students of their FERPA rights annually.

Review your university's FERPA policy, which is typically published in the student handbook or registrar's website. Pay particular attention to the definition of "legitimate educational interest" and the list of officials who qualify. File a non-dependency statement if needed.

If you want to block parental access under FERPA, submit a written statement to your university's registrar confirming that you do not claim yourself as a dependent on your parents' tax return.

This simple step removes the FERPA basis for parental access to your education records, including health records maintained by the university. Choose off-campus providers for sensitive care. For conditions you want kept strictly private, consider using off-campus healthcare providers.

Their records fall under HIPAA, which restricts disclosure to the university without your explicit authorization. This approach gives you the strongest legal protection available. Use consent forms carefully.

When you sign medical release forms for university purposes — whether for study abroad programs, clinical placements, or athletic participation — read what you're authorizing. Many consent forms allow broad disclosure of your entire medical record rather than condition-specific information. Request narrow authorizations that limit disclosure to specific conditions or timeframes.

Ask about the university's record-keeping practices. The Department of Education's guidance emphasizes that how records are maintained affects their legal status. Ask your campus health center whether they bill insurers separately and whether they consider themselves a HIPAA covered entity.

Their answer affects your rights.

FERPA and HIPAA in Practice: Medical Leave and Documentation Requests

When you request a medical leave of absence or need documentation for academic accommodations, the intersection of these laws becomes concrete. Universities legitimately need sufficient information to evaluate your request, but you control how much detail you provide. Most universities require a healthcare provider to complete a specific form or provide a letter confirming that you have a condition requiring accommodation or leave.

The university does not need your complete medical history — they need confirmation of the condition, its functional impact on your academic participation, and the recommended accommodations.

The U.S. Department of Education's Office for Civil Rights clarifies that documentation must be sufficient to establish the disability but institutions cannot require more documentation than necessary. Here's what you should know when submitting medical documentation:

• You control the scope: Provide the minimum documentation necessary to support your request.

A letter from your provider stating the diagnosis, functional limitations, and recommended accommodations is typically sufficient. You don't need to submit your full medical chart.

• Request confidentiality agreements: When meeting with deans or accommodation committees, ask who will see your documentation and how it will be stored.

Request that only the minimum necessary staff have access.

• Understand the record's permanence: Once submitted, your medical documentation becomes part of your educational record under FERPA.

This means it may be accessible to university officials with legitimate educational interests, and if you transfer schools, your records may be shared with the receiving institution.

If you're navigating a medical leave and need professional documentation, Havellum can connect you with licensed physicians through its doctor's note USA service. A properly documented medical leave application can make the difference between an approved leave and a denied request.

Key Differences at a Glance

To summarize the practical differences between these laws:

• FERPA applies to education records maintained by the university, including campus health center records.

It allows parental access for dependent students, permits disclosure to school officials with legitimate educational interests, and includes a health and safety emergency exception.

• HIPAA applies to protected health information held by covered entities like off-campus providers and insurers.

It requires written authorization for disclosure to the university, except in specific circumstances like public health reporting or emergencies.

• The overlap: Campus health center records can fall under both laws simultaneously, creating uncertainty about which protections apply.

The U.S. Department of Education maintains a comprehensive FAQ on FERPA and health records that addresses many of these scenarios. Additionally, the HHS HIPAA page provides detailed information about when HIPAA applies and its privacy protections.

When Your Privacy Rights Are Challenged

If you believe your rights under FERPA or HIPAA have been violated, you have recourse through formal complaint processes. For FERPA violations: File a complaint with the U.S. Department of Education's Family Policy Compliance Office.

The office investigates alleged violations and can take enforcement actions against institutions, including withholding federal funding. The complaint process requires you to submit a written complaint within 180 days of the alleged violation, including specific details about what occurred. For HIPAA violations: File a complaint with the Office for Civil Rights at HHS.

Complaints must be filed within 180 days of when you knew or should have known about the violation. OCR investigates and can impose civil monetary penalties on covered entities.

For disability discrimination: If your medical information was mishandled in connection with a disability accommodation request, you may also have grounds for a complaint under Section 504 of the Rehabilitation Act or the Americans with Disabilities Act.

The Office for Civil Rights at the Department of Education handles these complaints. Before filing a formal complaint, address your concerns directly with the university's privacy officer or registrar. Many institutions have internal grievance procedures that can resolve issues faster than federal investigations.

Before You Share Medical Documentation: A Practical Checklist

Before you submit any medical documentation to your university, take these steps to protect your privacy:

1. Review your university's FERPA notification to understand who qualifies as a school official with legitimate educational interests.

2. Ask your healthcare provider what information they plan to include in any documentation they write for your university.

3. Request a narrow letter that states your diagnosis, functional limitations, and recommended accommodations without including unnecessary treatment details.

4. Submit documentation to the correct office — typically disability services for accommodations or the dean of students for medical leaves — rather than to individual professors.

5. Keep copies of everything you submit and any correspondence about your medical information.

6. Ask about storage and access — request that your documentation be kept in a secure location accessible only to staff who need it.

If you need medical documentation for a leave request or accommodation, Havellum's mental health certificate and custom medical certificate services connect you with licensed providers who can prepare appropriate documentation.

Book a medical certificate to begin the process with professional support.