FERPA vs. HIPAA for College Students: What Parents Can Access
A parent may be able to help with a tuition bill without being entitled to every grade, medical record, or counseling note. For college students, information sharing depends on the record, the institution holding it, the student's permissions, and any applicable legal exceptions.
FERPA, HIPAA, and powers of attorney do different jobs. Start by identifying whether the goal is to receive information, make a decision, or handle a financial task. Then check the process that applies rather than assuming one form covers everything.
FERPA concerns education records
The Family Educational Rights and Privacy Act, or FERPA, protects education records at institutions subject to the law. Rights generally transfer from parents to the student when the student turns 18 or attends a postsecondary institution at any age. College attendance can therefore trigger the transfer before the student's eighteenth birthday. The Department of Education's eligible-student guide explains that transition.
A consent to disclose records should identify the records, the purpose, and the recipients, and be signed and dated. Oral permission alone does not satisfy FERPA's consent requirements. See the Department's consent guidance. Ask the college how to submit the consent and verify that the appropriate office has received it.
The student might want someone to discuss a particular billing issue without seeking ongoing access to unrelated records. Ask how the school's process can reflect that choice. A records release does not itself give the recipient general authority to choose courses, change enrollment, or make every educational decision for the student.
Paying tuition is not the same as having unrestricted access
FERPA permits certain disclosures without the eligible student's consent. Examples include disclosures to parents when the student is a dependent for federal tax purposes, qualifying health or safety emergencies, and certain alcohol or controlled-substance violations involving students under 21. These exceptions are not a blanket right to every record whenever a parent asks. The Department of Education describes the permitted disclosures.
Do not equate paying tuition with satisfying the tax-dependency exception. Ask what documentation and procedures the school uses. Likewise, ask the billing office what an authorized-payer account actually permits; do not assume it also opens academic or health records.
HIPAA concerns protected health information
The HIPAA Privacy Rule governs protected health information held by covered healthcare entities and their business associates, subject to exclusions and exceptions. A HIPAA authorization can permit specified disclosures to named recipients. It is not an appointment to make treatment decisions. HHS summarizes the Privacy Rule and authorization requirements.
For medical decision-making, look to a healthcare power of attorney or other authority recognized by applicable law. HHS generally treats a legally authorized personal representative as the patient for HIPAA purposes within the scope of that role, subject to exceptions. Someone merely named to receive information does not automatically become that representative.
For a comparison of healthcare documents, read Healthcare POA, Living Will, and HIPAA Authorization: 3 Different Jobs.
Campus health records may fall under FERPA instead
The label "medical record" does not automatically mean HIPAA applies. At postsecondary institutions subject to FERPA, student health-center records may be education records or treatment records under FERPA. Both categories are excluded from HIPAA's definition of protected health information. HHS explains the rules for campus health clinics.
Do not assume that a HIPAA form delivered to an outside physician also covers a university counseling or student health office. Ask that office which rules govern its records, which release it uses, and whether records receive special protection. The answer depends on the provider and how the records are maintained, not simply whether the appointment happened on campus.
Emergency disclosures are possible, but limited
Privacy law is not an absolute prohibition on communicating with family during an emergency. Under HIPAA, when a patient is absent or incapacitated, a provider may use professional judgment to share information relevant to the person's involvement in care or payment when doing so is in the patient's best interests. HIPAA does not require disclosure in every such case. HHS gives the conditions and limits.
FERPA also has a health-or-safety-emergency exception, but it is not a standing substitute for a student's choices about ordinary access. The Department's parent-access guidance includes that exception. Ask the institution about the particular situation rather than demanding general access under an emergency label.
For immediate danger, call 911. Do not delay requesting emergency help while searching for a signed form.
Discuss the permissions before completing them
Use three questions to organize the conversation: What help would be useful? What information would that helper need? Which decisions, if any, should that person be authorized to make?
For example, a student might want a parent to discuss an insurance problem, a different trusted adult to serve as healthcare agent, and a nearby friend to be an emergency contact. Those are different proposed roles, not a single appointment. Review the relevant documents and eligibility requirements before assuming the arrangement is in place.
Keep the discussion voluntary. A parent can help locate the right office or explain a question without deciding every permission for the student. A young adult should not sign a form merely because someone presents it as a routine school requirement.
Check the receiving offices and keep a simple record
Before relying on the forms, ask the registrar, billing office, student health center, outside providers, and financial institutions what each needs. Useful questions include:
- Which records and recipients will this permission cover?
- Where should the document be submitted, and how will receipt be confirmed?
- Is there a separate consent, proxy-access, or authorized-user process?
- How are limits, expiration, replacement, or withdrawal of permission handled?
For HIPAA authorizations, revocation generally must be in writing and received by the covered entity; it does not undo actions already taken in reliance on a valid authorization, and additional rules may apply to insurance authorizations. HHS explains revocation. Do not assume telling a family member alone updates every provider's records.
Keep copies and a private list of where documents were sent. Use the institution's approved access process instead of sharing the student's login. Revisit permissions after a transfer, a new provider, a move, or a change in trusted helpers.
Use a kit as a starting point, not a substitute for school procedures
The Harner Legal Forms College Student & Young Adult Legal Documents Kit includes a Durable Financial Power of Attorney, Healthcare Power of Attorney, Living Will, HIPAA Authorization, FERPA Authorization, and a bonus Emergency Medical & Contact Information Sheet. Review each document's instructions and the state-specific information available through product registration before signing.
The kit addresses several planning needs, but the student should still confirm each receiving institution's process. Get individual advice where age, capacity, court orders, conflicting documents, specially protected records, or state-to-state use creates uncertainty.
For related planning guidance, see College Student Legal Documents Every Parent Should Know.
This article provides general educational information, not legal, medical, or financial advice. Laws, institutional procedures, and individual circumstances vary. Consult an appropriately qualified professional about your situation.