FERPA for school-based OT, PT, and SLP: education records and consent
The Family Educational Rights and Privacy Act (FERPA) protects students’ education records at schools and other educational agencies that receive U.S. Department of Education funds. Its rules turn on the school and the record, not on the profession. The Department of Education and HHS say health records a FERPA-covered school keeps on a student are generally education records, and records on children with disabilities under IDEA are education records under both FERPA and IDEA. Where FERPA applies to a record, the HIPAA Privacy Rule does not. This page quotes the regulation and the federal guidance; it does not say whether any particular school, clinic, or contractor is covered.
Quoted from official pages checked November 10, 2026. Confirm current requirements, fees, and dates on those sites. This page is not legal advice and does not guarantee eligibility, certification, or licensure.
Sources read on November 10, 2026: 34 CFR Part 99 on eCFR (up to date as of November 6, 2026), the Student Privacy Policy Office’s FERPA regulations page and parent guide on StudentPrivacy.ed.gov, and the joint FERPA and HIPAA guidance (PDF) posted on HHS’s FERPA and HIPAA page; the same December 2019 update is also posted as a StudentPrivacy.ed.gov copy (PDF). An ASHA FERPA address tried the same day returned ASHA’s page-not-found message, so nothing is quoted from ASHA.
Who FERPA applies to
The joint guidance states: “FERPA applies to educational agencies and institutions that receive Federal funds under any program administered by the U.S. Department of Education.” It explains that the term “educational agency or institution” generally refers to “public elementary and secondary schools, school districts, and postsecondary institutions, including medical and other professional schools.” It also states: “Private and religious schools at the elementary and secondary levels generally do not receive funds from the U.S. Department of Education and are, therefore, not subject to FERPA.”
The guidance describes the rights FERPA gives parents: “These include the right to access their children’s education records, the right to seek to have these records amended, and the right to provide consent for the disclosure of personally identifiable information (PII) from these records, unless an exception to consent applies.” StudentPrivacy.ed.gov’s parent guide states that when a student reaches 18 years of age or attends an institution of postsecondary education at any age, “the student becomes an ‘eligible student,’ and all rights under FERPA transfer from the parent to the student.”
What counts as an education record
34 CFR 99.3 defines education records as records that are “Directly related to a student; and” “Maintained by an educational agency or institution or by a party acting for the agency or institution.” Its exclusions include records “kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the record.”
The joint guidance states: “For instance, a student’s health records, including immunization records, maintained by an educational agency or institution (such as by an elementary or secondary school nurse) would generally constitute education records subject to FERPA.” On students with disabilities: “Records that educational agencies and institutions maintain on children with disabilities, including records of children referred under the Individuals with Disabilities Education Act (IDEA), are also covered as education records under both FERPA and IDEA.” It adds that IDEA “includes confidentiality provisions that are similar to, but broader than, FERPA”. See IEPs and IFSPs.
On providers who are not school employees, the guidance states: “Health records that directly relate to students and are maintained by a health care provider, such as a third party contractor, acting for a FERPA-covered elementary or secondary school, would qualify as education records subject to FERPA regardless of whether the health care provider is employed by the school.” It also states that student health records kept by a provider “that is not acting for a FERPA-covered educational agency or institution do not constitute FERPA-protected education records.”
Treatment records
FERPA’s “treatment records” exclusion is limited to older students. 34 CFR 99.3 excludes records “on a student who is 18 years of age or older, or is attending an institution of postsecondary education” that are made or maintained by a “physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assisting in a paraprofessional capacity”, used only in connection with treatment, and “Disclosed only to individuals providing the treatment.” It adds: “For the purpose of this definition, ‘treatment’ does not include remedial educational activities or activities that are part of the program of instruction at the agency or institution”.
Consent and its exceptions
34 CFR 99.30 states: “The parent or eligible student shall provide a signed and dated written consent before an educational agency or institution discloses personally identifiable information from the student's education records, except as provided in § 99.31.” The written consent must “Specify the records that may be disclosed”, “State the purpose of the disclosure”, and “Identify the party or class of parties to whom the disclosure may be made.”
One exception in 34 CFR 99.31 is disclosure “to other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests.” It says an outside party such as a contractor or consultant may be considered a school official only under listed conditions, including that it “Performs an institutional service or function for which the agency or institution would otherwise use employees”.
On access, 34 CFR 99.10 states that a school “shall comply with a request for access to records within a reasonable period of time, but not more than 45 days after it has received the request.”
FERPA and HIPAA
The joint guidance says that even though a school employs school nurses, physicians, psychologists, or other health care providers, “the school is not generally a HIPAA covered entity because the providers do not engage in any of the covered transactions, such as billing a health plan electronically for their services.” It adds: “It is expected that most elementary and secondary schools fall into this category.”
For a school that bills Medicaid electronically for IDEA services, the guidance says the school is a HIPAA covered entity for the transaction standards, but “if the school provider maintains health information only in ‘education records’ under FERPA, the school is not required to comply with the HIPAA Privacy Rule because the Privacy Rule explicitly excludes FERPA ‘education records.’” It continues: “Importantly, although the HIPAA Privacy Rule does not apply, FERPA’s and IDEA’s privacy requirements do apply”. HIPAA’s covered-entity rules are on HIPAA for OT, PT, and SLP.
What this page does not do
It does not decide whether a school, district, contractor, or clinic is subject to FERPA or HIPAA, and it gives no caseload numbers or record-retention periods. It is not legal, billing, tax, or compliance advice. Confirm current rules with the agency that publishes them, your employer, and your state board.