FERPA and HIPAA: Protecting Student Privacy in Home and Hospital Settings

When a student learns at home, in a hospital or in a treatment facility, two federal privacy laws often come into play. FERPA generally protects student education records, and HIPAA generally protects health information held by health care providers and health plans. In home and hospital settings, both can apply to different parts of the same student's records, so districts, facilities and teachers need clear habits for sharing only what's needed, with the right permissions.

Rules and how they apply vary by state and district. This article is general information, not legal advice, so check with your district's privacy or legal staff for specifics.

What does FERPA cover?

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. It gives parents rights related to their child's records, such as reviewing them, and generally requires consent before records are shared, with certain exceptions. The U.S. Department of Education's Student Privacy Policy Office offers guidance and resources for schools and families.

In homebound and hospital instruction, education records can include the IEP or 504 plan, session notes, attendance records, progress reports and grades.

What does HIPAA cover?

The Health Insurance Portability and Accountability Act (HIPAA) protects health information held by covered entities, such as most hospitals, clinics and health plans. When a student is in a hospital or treatment program, their medical and treatment information is generally protected under HIPAA, and the facility's own policies guide what staff can share and when.

Which law applies when?

A simple way to think about it: records the school or district keeps about a student are usually education records under FERPA. Health records a hospital or treatment provider keeps are usually covered by HIPAA. The two often meet at moments like these:

• Medical documentation a family provides to request homebound instruction

• Session notes a hospital or facility teacher sends back to the home district

• Discharge planning when a student returns home or to school

• Conversations between facility staff, district staff and the student's teacher

When it isn't clear which rules apply, ask before sharing. The district and the facility each have staff responsible for privacy.

How can teams protect privacy in home and hospital settings?

A practical checklist for districts, facilities and teachers:

• Share only what's needed. A homebound or hospital teacher usually needs the IEP or 504 plan, current coursework and scheduling limits, not a full medical history.

• Get the right permissions. Follow district and facility procedures for consent before records move between them.

• Name one contact on each side. Information should flow through known channels, not personal texts or email chains.

• Use approved tools. Run virtual lessons and share documents only on platforms your district approves.

• Keep session notes about learning. Record what was taught, progress and attendance. Leave out medical details that don't affect instruction.

• Respect the home setting. Lessons often happen in family spaces, so be mindful of what's discussed and who is nearby.

• Plan the handoff. Before discharge or a return to school, agree on which records go to whom.

What should families know?

Families are partners in protecting privacy. Parents can ask the district who will see their child's records, what will be shared with the homebound or hospital teacher, and how session notes and progress reports are stored. If a child is in a hospital or treatment program, it helps to ask the facility how it coordinates with the school and what consent forms it needs.

Key takeaways

• FERPA generally protects student education records. HIPAA generally protects health information held by health care providers and health plans.

• In home and hospital settings, both can apply to different parts of a student's records.

• Share only what's needed for instruction, with the right permissions.

• Keep session notes focused on learning and use district-approved tools.

• Rules vary by state and district, so check with your district's privacy staff.

How Einstein Tutoring can help

Einstein Tutoring works with school districts and facilities nationwide to provide homebound, hospital and facility instruction, and we follow FERPA and HIPAA. Lessons follow each student's IEP goals and accommodations and support 504 plans. Districts receive session notes after every lesson, weekly progress reports, attendance records and communication logs, with a dedicated district liaison as one point of contact.

Frequently asked questions

Does a homebound teacher need a student's full medical records?

Usually not. Teachers generally need what affects learning, such as the IEP or 504 plan, accommodations and scheduling limits. Families can ask the district exactly what will be shared.

Do the same privacy expectations apply to virtual lessons?

Yes. The same principles apply online. Follow your district's rules for approved platforms and for how records are shared and stored.

Who should we ask about student privacy questions?

Start with your district's special education office or privacy staff. In a hospital or treatment program, the facility's privacy officer or education contact can help. Rules vary by state and district.

Learn more in our Homebound Instruction FAQs. To refer a student or talk about a district partnership, contact us.