School-based ABA: HIPAA or FERPA?

An RBT sits at the back of a second-grade classroom, running a program with a child the clinic has treated for two years. The teacher wants to know how it went. The district’s special education coordinator wants the data. The parent wants everything. And somewhere in the clinic, a document exists that nobody is certain is a health record or an education record.

This is the most confusing corner of HIPAA for an ABA clinic, and most of the confusion comes from asking the wrong question. The right one is short.

The exclusion that decides most of it

Open the definition of protected health information (45 CFR 160.103). Buried in it is a carve-out: PHI excludes individually identifiable health information in education records covered by FERPA, and in certain treatment records of students at postsecondary institutions.

Read what that means. Where information sits in a FERPA education record, it is not PHI at all, which means HIPAA does not reach it. The two laws do not stack on the same document; the definition hands it to FERPA and steps back. HHS and the Department of Education have said as much in their joint guidance, which is the single best free resource on this question and is linked in the sources.

So the question is not where the session happened. It is whose record it is.

The two clean cases

The school’s record is FERPA’s. Records the school maintains about its student, kept by the school or on its behalf, are education records under FERPA (20 U.S.C. 1232g; 34 CFR Part 99). The IEP, the school psychologist’s report, the aide’s notes, the district’s data on progress toward IEP goals: FERPA governs those, HIPAA does not. Parents have rights to them, but they are FERPA rights, with FERPA timelines, from the school.

“The question is not where the session happened. It is whose record it is.”

Your record is HIPAA’s. A clinic that is a covered entity (45 CFR 160.102), treating its own client, billing insurance for that treatment, and maintaining its own clinical record, holds PHI. Walking into a school building to deliver that treatment does not transform your clinical record into an education record. You are a health care provider who happens to be working in a classroom, and your chart is your chart.

Most ABA clinics providing insurance-funded services in school settings live in this second case, and the practical answer is the reassuring one: your records are your records, HIPAA applies, keep doing what you do.

Where it actually gets hard

The difficulty begins when the clinic is not merely working in the school but working for the school.

If a district contracts your clinic to provide services to its students, as part of the education the district owes them, and you are creating records for the district about its students, then those records can become education records maintained by a party acting for the school, and FERPA can govern them rather than HIPAA. Same clinicians, same building, different rulebook, because the answer follows the relationship rather than the address.

This is not a fine distinction; it changes almost everything downstream. Who the parent asks for records, and under which timeline. Whether a disclosure to the district is a routine internal use or a disclosure of PHI requiring authorization. Whether your BAA obligations apply. Whether your right-of-access process or the school’s applies when a parent demands a copy.

And the honest thing to say next is that the answer depends on facts this page cannot see: what the contract says, who funds the service, whose student the child is in that arrangement, how the district characterizes the records, and how your state implements FERPA. Anyone who tells you there is a single answer for all school-based ABA is selling you something. What we can tell you is exactly which questions decide it, and that the time to ask them is before the contract is signed, not after a parent’s lawyer sends a letter.

The mixed case, which is most clinics

In practice many clinics are in both worlds at once: an insurance-funded client whose care happens partly in a school, with some records that are clearly the clinic’s, some information that flows to the district, and a parent in the middle. That is workable, and it requires two disciplines.

Keep the records separable. Your clinical record stays yours, in your systems, with your safeguards. What you share with the school is a disclosure, made deliberately, not a merger of two record systems. A shared spreadsheet where the clinic and the district both write is a document that will someday need to be classified, and nobody will be able to.

Get authorization for what you share. A disclosure of your client’s PHI to the school is not treatment, payment, or health care operations from your side; the school is not a covered entity and is not treating the child. Absent an exception, sharing your clinical information with the district needs a written authorization from the parent (45 CFR 164.502). In practice this is easy to obtain and routinely forgotten: parents want the school and the clinic talking. Get it in writing, scope it (what information, to whom, for how long), and put it in the file.

Settle it in the contract

Before signing anything with a district, get these answered in the document, in language a non-lawyer can check:

• Whose records are these? Is the clinic creating records for the district about its students, or maintaining its own clinical records about its clients?
• Which law does each party say governs? Get the district’s position in writing, because they have one.
• Who answers a parent request? And under which timeline: HIPAA’s 30 days, or FERPA’s 45.
• What flows to the district, and under what authority? An authorization, a listed exception, or an education-records relationship.
• What happens at termination? Who keeps what, and for how long.
• If the clinic is a business associate or a school official under FERPA, say which, and paper it accordingly.

A district that cannot answer these has not thought about it either, and the two of you working it out in writing beforehand is worth more than either side’s confident assumption.

The honest summary

For the ordinary case (insurance-funded ABA, your own client, your own chart, delivered in a school building), you are under HIPAA and your records are PHI. For the contracted case (services provided for the district, records created for the district about its students), FERPA may govern instead, and the details of the contract decide it.

The failure mode is not choosing wrong. It is never asking, and then discovering the answer in the middle of a records dispute with a parent, when both you and the district reach for the rulebook and find you were reading different ones.