Which statement best reflects the relationship between FERPA and HIPAA in school health records?

• A. HIPAA supersedes FERPA in all cases
• B. FERPA has no influence on HIPAA
• C. FERPA and HIPAA are mutually exclusive
• D. FERPA can supersede HIPAA in certain school health records

Answer: (D)

In school settings, the type of record and who maintains it determine which law applies. If health records are created and kept by the school or its staff as part of the student’s education records, those records are governed by FERPA. FERPA sets who can access or disclose those records and under what conditions, and it often takes precedence over HIPAA in the school context. HIPAA, by contrast, covers protected health information handled by health care providers, plans, or other covered entities and their business associates, typically outside the school’s education records.

So, for health records that the school itself maintains as part of educating the student, FERPA controls disclosures even if HIPAA would otherwise apply. That’s why the statement that FERPA can supersede HIPAA in certain school health records is accurate. Records outside the school’s control or created by external health care providers may fall under HIPAA instead.