Design a site like this with
Get started

What’s the deal with privacy laws and school health services?

I’ve seen some chatter recently about school staff and the dissemination of student health information – specifically what staff are allowed to say to students in relation to health issues and what the nurse is allowed to say to staff about students’ health issues.

Situation #1: The school nurse has a student in the health room. A staff member walks by and sees them and comes in to say “Hey, Student, what’s wrong??” and comes in and maybe feels a forehead, asks follow up questions like “did you tell your mom this morning?” or “did the nurse call your parents to come pick you up?” or “did you try x-y-z to fix the problem?” What’s a school nurse to do? Do you allow or encourage the chit-chat? Do you get offended because I’M the nurse? Do you give a dismissive response to end the interaction?

Situation #2: The nurse receives health forms for a student that indicate serious health concerns that affect the student’s day to day time at school such as epilepsy. The student requires the use of a safety helmet, receives medications, and has frequent grand-mal seizures at school. This requires health information to be shared with multiple members of the school team. How is this information disseminated and to whom? What information is divulged?

A reoccurring theme I’ve seen is “That’s against HIPAA to tell anyone anything!” Well it’s not.

What is HIPAA? HIPAA stands for Health Insurance Portability and Accountability Act. Per the US Department of health & Human Services, HIPAA is defined as “The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other individually identifiable health information (collectively defined as “protected health information”) and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual’s authorization. The Rule also gives individuals rights over their protected health information, including rights to examine and obtain a copy of their health records, to direct a covered entity to transmit to a third party an electronic copy of their protected health information in an electronic health record, and to request corrections.” In short, healthcare entities (and the employees within) can not share protected health information including patient identifying information in relation to the health information with anyone that is not in a position of need-to-know.

Those who work in hospitals and doctor’s offices are well aware of the issue of staff discussing patient information in public places (chatting about your crazy patient while having lunch in the caf), staff looking up patient information in the computer systems that they don’t have permission to access (like looking up your neighbor’s lab results), or posting anything to social media that would reveal a patients identity in relation to their healthcare. We also of course know that we don’t discuss patient issues with people outside their care team.

All that being said, does this also apply to school nurses maintaining the medical privacy of students in the health room? Sort of but no. Yes a student’s privacy should be maintained as much as possible and yes their medical information should be disseminated on a need-to-know basis but sometimes a large portion of the staff is considered “need-to-know”, especially as it relates to serious medical issues that can affect many teachers, classes, and staff members. The information doesn’t need to be broadcast to the entire school – parents and all but it does need to be told to any staff that is interacting with that student.

The answer is also no because HIPAA privacy rules exclude information considered educational records which includes school health room information. Educational records are covered under FERPA (Family Educational Rights and Privacy Act). It works the same though – basically personally identifying educational records of a student including health room records and information should have privacy maintained under FERPA. You can read more here:

However, the answer is YES when it applies to private schools that do not receive federal funding. When it comes to an institution that does not receive federal funding the privacy laws become a gray area between HIPAA, FERPA, and no privacy laws. The HIPAA law might come into play when it relates to the school nurse specifically if they are providing healthcare to the student however, the school nurse is not providing health insurance managed medical care or billing for services. In this case I would think that the nurse would have to use their good judgement and refer to the HIPAA and FERPA laws to decide what they think is best.

In a case such as scenario #1, a staff member comes to the health room and starts asking the student questions. Is it appropriate? Probably not. But is it illegal? No. The patient is allowed to say anything they want to anyone they want about their own health. Most staff members who are coming in and asking a kid what’s wrong likely know the student already and are doing so because they care. Many times they are in “mommy mode” and just being a person. They are generally not trying to “do your job” or intrude (unless they are but that’s a different issue). You don’t have to tell their business to everyone but you can allow the student to tell what’s wrong if they want to. You can even say that to the student – “you don’t have to talk if you don’t want to”. What would be considered illegal is if the nurse then began explaining the issue to the staff member who is only asking out of curiosity. Use your judgement in what you want to say.

I frequently have staff members telling me that they aren’t totally sure what they are allowed to say health-wise and what they aren’t. According to Frontline Educational Services, “FERPA does not require written consent when “school officials” with “legitimate educational interest” review student records. Such access does not require prior notice to parents or guardians, other than the usual, annual FERPA notice provided by schools.” This means that the teachers, paras, and other school staff that have a genuine educational need to know health or educational information about the student are allowed to know/ask about it. If the staff’s only interest in the student’s health is curiosity then it is technically illegal for them to ask or be told about the student’s health status. That being said, the teacher and related staff members are absolutely allowed to ask parents or be told about a student’s history of asthma, allergies, seizures, etc. as it relates to their education in their class. It’s important to note that while they have the right to know the information, they do not have the right to suggest treatments or management of anything.

The area that this comes into question relating to teachers is when it comes to ADHD and ADHD medications. While there are no laws stating that a teacher can’t suggest a student be evaluated or medicated for ADHD, it is in very poor taste and can be construed as discrimination if that subject is broached inappropriately. This should be addressed through the Special Education team. You can read more about this issue here:

This information applies in the case of scenario #2. The teachers and related staff need to be aware of the student’s seizures and information surrounding that issue in order to appropriately care for the student should a seizure happen at school. This information should be shared with anyone who is directly working with that student including PE, paras, admins, subs, and specials teachers.

Scenario #3: The school nurse needs some specific medication orders from a doctor’s office. Should they ask the parent and have the parent ask the doctor’s office OR should they cut out the middle man and call the doctor’s office themselves and request the information. The school nurse is allowed to call the doctor’s office themselves. The doctor is permitted to share the information with the school nurse for health maintenance purposes. Some offices might ask for a parent to sign a release and that’s fine if that is their policy. Personally I always ask the parent’s permission first – that way I can verify what doctor I should be calling.

At the end of the day, just be nice. There is no need for being defensive or snippy if someone asks about a student. You can just let them know politely “they are sick” or “we are all good now” if someone asks. If you wanted to you could just ask the student if they want to explain or not and then leave it at that.


  • FERPA applies to educational records including health room information
  • HIPAA applies to specific medical institutions that are billing for services such as hospitals and doctor’s offices, not school health rooms.
  • If someone needs to know medical information about a student because they have an educational interest in that student (their teachers, paras, etc.) you can tell them all the stuff.
  • If someone is just curious then you don’t tell them anything but the student can tell them anything they want.
  • Teachers can ask/ be told about student’s health issues but they can not suggest any treatments.
  • Teachers should not discuss ADHD and ADHD medications with parents as it can be construed as discrimination. Refer to the SEL for that issue.
  • Be nice.

Cherokee Women’s V Neck Scrubs Shirt

Published by Emme Mauer M.Ed., BSN, RN, CSN

Mom to two preemies, anxiety sufferer, postpartum depression survivor, and school nurse extraordinaire.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: