How to Tell Whether a School ABA Record Is Governed by FERPA or HIPAA

Classify the holder before the content

The same clinical summary can sit in two legal systems. The joint HHS and Education guidance explains that health records maintained by a school subject to FERPA are generally education records excluded from HIPAA's definition of protected health information. A private healthcare provider's own copy may follow HIPAA if that provider is a covered entity. Record holder, role, and purpose decide the first branch.

Map each direction of sharing

School-to-provider and provider-to-school disclosures are separate events. One school consent does not automatically authorize the clinic's later disclosure, and a clinic authorization does not direct the school. Document the originating system, exact records, recipient, purpose, expiration, and exception if one applies. Keep a transmission receipt without replacing either source record.

Route mixed or uncertain records

A contractor may act for a school in one role and run an independent healthcare service in another. Ask each organization which capacity produced and maintains the record, which notice applies, and who owns the privacy decision. Escalate uncertainty to the school privacy official and provider privacy owner before releasing the disputed information.

Build a two-system coordination record

Create a restricted school-record classification matrix for record holder, capacity, original source, copy, governing rule, requested disclosure, recipient, consent or exception, date, and correction route. Record the student and authorized decision-maker, school and ABA contacts, each source and effective date, the exact event, pending questions, next action, due date, and closure evidence. Preserve original records and label summaries, copies, corrections, and professional interpretations.

In the school-record classification matrix, keep education decisions, private clinical recommendations, consent, disclosure authority, payer states, meeting participation, scheduling, and emergency duties in separate fields. A shared goal, signature, email, portal account, or meeting does not give either organization authority over every decision.

Protect the student's voice and access

Use the school-record classification matrix to show how the student participated. Offer plain language, the student's ordinary AAC, interpreters or other communication support, enough response time, and a way to agree, question, pause, object, or ask for private help. Do not remove communication access to simplify a meeting, observation, or data collection.

For the school-record classification matrix, the BACB Ethics Code addresses understandable communication, client and stakeholder involvement, consent and assent when applicable, confidentiality, assessment, documentation, and risk for covered professionals. ASHA says AAC users should always have access to their communication tools or devices. Apply the governing school and clinical sources to the actual roles.

Ask nine coordination questions

Use these questions when reviewing FERPA or HIPAA for school ABA records:

• What exact meeting, observation, record, decision, or support is proposed?
• Who maintains each source record and in what role?
• Which FERPA, IDEA, HIPAA, state, school, or provider rule applies?
• What consent, authorization, exception, or invitation supports the action?
• How will the student communicate preference, assent, dissent, pain, or need for help?
• Which definitions, dates, settings, and denominators travel with the data?
• Which school, clinical, privacy, payer, or safety owner decides each issue?
• Which system, recipient, and transmission path will be tested?
• What change, deadline, error, or conflict triggers recheck?

Mark each item complete, failed, pending, or inapplicable with a reason. Pause the affected handoff when required while safe and authorized school and clinical supports continue.

Verify before the handoff occurs

Before the school-record classification matrix releases a record, guest, observation, meeting, plan comparison, or system connection, confirm the exact purpose, holder, recipient, source, effective period, student access, and assigned decision owners. Verify that the data packet contains the definitions and dates needed to avoid a misleading comparison.

A pending item in the school-record classification matrix blocks only the unsupported path. Send the next owner the source, exact question, evidence already collected, and deadline. Recheck when the student, school, provider, service, record category, invited person, consent, setting, or system changes.

Make the handoff usable

Summarize the school-record classification matrix in language the student and authorized adult can use. State what will happen, which organization owns each action, what information will move, what will remain separate, and when the next review occurs. Attribute every statement to student report, family report, school record, provider record, direct observation, or professional interpretation.

The joint FERPA and HIPAA guidance explains that record coverage depends on who maintains the information and in what capacity. Apply that boundary to the school-record classification matrix; avoid calling all school health information HIPAA data or all provider data an education record. Offer a correction path for a wrong summary or recipient.

A fictional school-ABA example

Ari is fictional and involved in a progress summary stored by both a district and private clinic. The team locks 22 record-location and disclosure fields before review and completes 17 of 22 by the due date. Every missing, disputed, expired, or failed field stays in the denominator with an owner, age, source request, and next action.

The school-record classification matrix reports documentation completeness separately from lawful disclosure, educational quality, clinical quality, safety, and Ari's experience. The team preserves original school and clinic data, tests the affected route, and asks Ari whether communication and support worked as explained.

Any mismatch remains open in the school-record classification matrix. The affected transmission, meeting action, observation, plan change, or access permission waits for the proper owner. Unrelated safe and authorized services continue under their existing plans.

Measure without losing pending work

Measure the school-record classification matrix with locked units: complete handoffs divided by all handoffs due; correct permissions divided by permissions tested; records carrying source, date, definition, and denominator divided by records reviewed; AAC available divided by student observations due; and corrections validated by deadline divided by corrections due. Publish counts, time window, and exclusions.

Segment school-record classification matrix results by school, provider, record type, legal route, event, and owner. Pair process results with student and family feedback, access failures, privacy events, safety conflicts, complaints, and recurrence. These measures show workflow performance. They do not establish educational benefit, clinical effectiveness, compliance, or causation.

Recheck the source and the relationship

Review the school-record classification matrix when consent or authorization changes, the student reaches the applicable age, a school or provider changes, a new record or purpose appears, definitions drift, AAC changes, a safety plan changes, or a transmission fails. Preserve the source, version, effective date, repair, and test history.

For the school-record classification matrix, the CASP organizational overview supplies broad business, clinical-operations, and risk framing. IDEA sources describe federal special-education requirements; the joint guidance explains FERPA and HIPAA at a federal level. School policy, state law, contracts, and case facts can add requirements. Keep this page draft and noindex until every named reviewer completes review.