School-based health center marketing: FERPA, HIPAA, parental consent and student privacy

A health center inside a school, or a health program that runs clinics, screenings or vaccine days on school grounds, markets to a very particular audience. Its patients are students, its decision makers are parents and guardians, and its partner is a school with its own privacy law, its own forms and its own rules about what can be sent home. The marketing questions sound simple: can we send a flyer home, can we use the enrollment list for reminders, can we post photos from the health fair, can we tell parents what we will share with them. The answers depend on which federal privacy law covers the records, and that depends on who runs the program.

Several neighboring topics have their own guides and are not repeated here. Writing for parents, children’s websites and COPPA, and reviews from parents are covered in pediatric practice marketing. Sliding fee wording, federal funding acknowledgments and outreach for federally funded health centers are covered in community health center marketing. The full process for a signed marketing authorization for photos is in patient photo consent for marketing, and the HIPAA marketing rules in full are in HIPAA marketing rules. For how lice services may advertise school clearance notes, see our guide to lice clinic marketing rules. Enrollment help for families is covered in Marketplace and Medicaid enrollment help.

First question: whose records are these?

Two federal privacy laws can reach a student’s health information, and for any one record only one of them applies. FERPA, the Family Educational Rights and Privacy Act, protects education records held by schools and districts that receive funds from the U.S. Department of Education. The HIPAA Privacy Rule protects health information held by covered entities, which include health care providers that bill health plans electronically. The HIPAA definition of protected health information in 45 CFR 160.103 expressly excludes individually identifiable health information in education records covered by FERPA, and in the student treatment records described at 20 U.S.C. 1232g(a)(4)(B)(iv).

The joint guidance from the Department of Education and HHS explains how this sorts out in practice. Asked whether the HIPAA Privacy Rule applies to an elementary or secondary school, it answers: “Generally, no.” A school is either not a HIPAA covered entity, or it is one but holds student health information only in education records. Student health records maintained by a health care provider acting for a FERPA-covered school are education records “regardless of whether the health care provider is employed by the school.” Records kept by a provider that serves students directly and is not acting for the school are not education records, and HIPAA applies to them if that provider is a covered entity. The guidance gives the example of a public health nurse who gives immunizations on school grounds but does not act for the school.

For marketing, this is the first thing to settle in writing with the school or district. If the health center acts for the school, its student records are education records and FERPA governs what can be shared and how. If the health center is an outside provider that rents space or partners with the school, its records are its own patient records, and HIPAA governs them if it is a covered entity. Some programs are a mix: the joint guidance notes that a college clinic open to students and nonstudents follows FERPA for the student patients and HIPAA for everyone else. Every consent form, reminder and outreach plan below depends on which side of that line the program sits.

What the school can share with you, and what it cannot

A health center that is not acting for the school does not get the school’s records just because it works in the building. Under 34 CFR 99.30, a school subject to FERPA needs a signed and dated written consent from the parent, or from the student once the student is an eligible student, before it discloses personally identifiable information from education records, unless an exception in 34 CFR 99.31 applies. The consent must specify the records, state the purpose and identify who may receive them. 34 CFR 99.3 defines an eligible student as one who has reached 18 or attends a postsecondary institution.

That rules out the easy shortcuts. A class roster, a list of students missing immunizations, or a list of students the school nurse has seen is not a marketing list for an outside provider. The joint guidance adds the point in the other direction: if a school wants to give its records to an outside public health nurse, “the school would have to comply with FERPA and obtain prior written parent or eligible student consent or satisfy an exception.” Any data flow from the school to the health center, even for a reminder about a free screening day, needs a FERPA basis that the school confirms.

Directory information is narrower than it sounds. 34 CFR 99.3 lists items a school may designate as directory information, including name, address, grade level and photograph. Under 34 CFR 99.37, a school may disclose directory information only after giving public notice of what it has designated, of a parent’s or eligible student’s right to refuse, and of the time to opt out. Whether to release directory information, to whom and for what is the school’s decision under its own notice. A health program should not ask a school to release directory information as a mailing list, and should not treat a yes as covering health marketing unless the school’s notice and counsel say so.

Send information home through the school, not around it

The safe route for outreach is the school’s own channel. The school sends its families a flyer, an email or a notice in its regular communications, the health center’s materials explain what is offered and how to enroll, and the family chooses whether to contact the health center. No student data moves from the school to the health center to make that happen. The materials themselves are advertising, so 15 U.S.C. 45 applies: they must be accurate about what services are offered, who provides them, when the center is open and what it costs.

Be precise about the services. A flyer that says the center treats students for anything they need, when it offers a defined list of primary care, screening, dental or behavioral health services, leaves a false impression. List what is offered, say where students go for services the center does not provide, and say that anyone with a medical emergency should call 911. If behavioral health services are listed, include 988, the Suicide and Crisis Lifeline, for anyone in crisis, and do not promise outcomes from counseling or any other service.

Enrollment, parental consent and what parents will be told

Enrollment forms are where marketing promises meet the law. Who may consent to a minor’s care, which services a minor may consent to without a parent, and what a parent may see afterward are set state by state, and some services carry their own rules. HIPAA does not override those rules. Under 45 CFR 164.502(g)(3), a parent is treated as the minor’s personal representative where applicable law gives the parent authority to make the health care decision, but not where the minor lawfully consents to the service, or where the parent agrees to a confidential relationship between the provider and the minor. Where HIPAA applies, whether a parent may see records in those cases also depends on state or other law.

This is why outreach wording needs care in both directions. Telling parents they will be informed about every visit can be false for services a student may lawfully receive on their own consent. Telling students that everything is confidential can be false for services that need a parent’s consent, or where FERPA gives the parent access to education records. Describe the actual policy in plain words, have counsel check it against the state rules that apply to the program, and use the same wording on the enrollment form, the flyer, the website and the parent handbook page.

Keep the consent to treat separate from any consent to use information for marketing. A signature on an enrollment form that agrees to care is not an authorization to feature the student in a story, add the family to a newsletter about unrelated services or share their details with a sponsor. Where HIPAA applies, 45 CFR 164.508(a)(3) requires a written authorization for any use or disclosure of protected health information for marketing, apart from face-to-face communications and promotional gifts of nominal value. Where FERPA applies, the 34 CFR 99.30 consent must name the records, purpose and recipients.

Immunization proof for school entry

Vaccine days and back-to-school physicals are a natural campaign for a school health program, and families want to know whether the center will send proof of immunization to the school. HIPAA has a specific rule for this. Under 45 CFR 164.512(b)(1)(vi), a covered entity may disclose proof of immunization to a school about a student or prospective student if three conditions are met: the information disclosed is limited to proof of immunization, the school is required by state or other law to have that proof before admitting the student, and the covered entity obtains and documents the agreement of a parent or guardian, or of the student if the student is an adult or emancipated minor. For how to word sports physical offers and handle school forms, see our guide to DOT and sports physical marketing.

The agreement does not have to be a full written authorization, but it has to be obtained and documented, and the disclosure is limited to proof of immunization. Marketing for the event can say the center will send immunization proof to the school when the family agrees, and the sign-up form can collect that agreement. It should not say that a visit’s other results will go to the school, or that the school will be told who attended. For flu clinics specifically, see flu shot clinic marketing.

Talking to the school nurse

Families also ask whether the health center will coordinate with the school nurse, for example about a medication given during the school day. The joint guidance says HIPAA permits covered health care providers to disclose protected health information to school nurses, physicians or other health care providers for treatment purposes without the authorization of the student or parent. In the other direction, a school’s records about a student remain education records, and the school shares them under FERPA’s rules. Say what coordination the center does, and with whose agreement, in the same plain wording the enrollment form uses.

Photos, stories and events

School programs produce good images: a health fair, a dental screening day, a ribbon cutting. Do not use photos of students in marketing without written consent. Where HIPAA applies, a photo of a patient receiving care is protected health information, and using it in marketing requires an authorization under 45 CFR 164.508 signed by the person with authority, which for a minor depends on the personal representative rules above. Where the records are FERPA records, a photo directly related to a student and kept by the school, or by a program acting for it, can be an education record, and the 34 CFR 99.30 consent rules apply. Photographs appear in the FERPA list of possible directory information, but that is a decision for the school under its own notice and opt-out process, not a permission for a health program’s ads.

Background faces count. A wide shot of a screening line or a waiting area shows students who did not consent, and in a school, classmates and teachers can recognize them. Shoot event photos of the setting, the equipment and staff who have agreed, or of students whose parents have signed for that specific use. The full authorization process, revocation and record keeping are covered in patient photo consent for marketing. Do not name the school or district in materials without the school’s written permission.

Websites, apps and forms that children use

If the health center’s website, app or sign-up form is aimed at students under 13, the FTC’s COPPA Rule may apply. 16 CFR 312.2 defines a child as an individual under the age of 13, and lists the factors the FTC considers in deciding whether a website or online service is directed to children, including subject matter, visual content, animated characters, child-oriented activities and the age of models. Under 16 CFR 312.3 and 312.5, an operator of a site directed to children, or one with actual knowledge that it is collecting personal information from a child, must give notice and obtain verifiable parental consent before collecting, using or disclosing that information. The rule was amended effective June 23, 2025, so check the current text.

The simplest design is to aim the website and every form at parents and guardians, not at children, and to keep health questions off public forms. How COPPA applies to a pediatric website, and what to watch for with tracking tools, is covered in pediatric practice marketing, and the form side in online patient intake forms.

Illustration: one back-to-school campaign checked against the rules

Illustration: an outside health provider runs a clinic in a school building under an agreement with the district and bills health plans electronically. Before the school year, it wants to promote sports physicals and vaccine catch-up days. It confirms in writing with the district that it is not acting for the school, so its patient records are its own and HIPAA governs them. It asks the school to send a notice home through the school’s usual channel rather than asking for a student list. The notice lists the services, the hours, that anyone with a medical emergency should call 911, and a contact number for enrollment. The sign-up form asks a parent or guardian to agree, in a separate checkbox, to the clinic sending proof of immunization to the school, and the clinic records that agreement.

Illustration: the same clinic wants photos from its first vaccine day for its website. It photographs the room, the signage and two staff members who signed a release. It does not photograph students in line. A parent offers a quote for the newsletter; the clinic uses it only after the parent signs a marketing authorization that names the quote, the newsletter and the website, and it leaves out the student’s name and the school’s name.

Checklist

• Confirm in writing with the school or district whether the program acts for the school (FERPA education records) or is an outside provider (its own records, HIPAA if a covered entity).
• Do not ask for or use rosters, nurse lists or immunization gap lists for outreach without a FERPA consent or exception the school confirms.
• Treat directory information as the school’s decision under its own notice, not as a mailing list.
• Send outreach through the school’s own channels, with the family choosing whether to contact the program.
• List the services offered, where students go for other care, call 911 for emergencies, and 988 for anyone in crisis.
• Describe parental consent, minor consent and what parents will be told in wording counsel has checked against the state rules for the program.
• Keep the consent to treat separate from any marketing authorization or FERPA consent.
• For immunization proof, limit the disclosure to proof of immunization and document the parent’s or adult student’s agreement.
• Use no student photos or stories without written consent for that specific use, and watch the background of event photos.
• Aim websites, apps and forms at parents and guardians, and check COPPA if anything is directed to children under 13.
• Do not name the school or district without its written permission.

How we help

We build websites, local search, Google Ads and AI front desk tools for independent practices and health businesses. For a school-based health center or school health program, we can build a website and enrollment and inquiry flows aimed at parents and guardians, with the services, consent and immunization proof wording kept the same on every page and form. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We do not sell lead lists and we do not pay for referrals. For the wider rules, see our healthcare marketing rules hub.

Sources

• 34 CFR 99.3: FERPA definitions (education records, eligible student, directory information)
• 34 CFR 99.30: Under what conditions is prior consent required to disclose information?
• 34 CFR 99.37: What conditions apply to disclosing directory information?
• 45 CFR 160.103: Definitions (protected health information)
• 45 CFR 164.502(g): Personal representatives and unemancipated minors
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.512(b)(1)(vi): Disclosure of proof of immunization to a school
• HHS: Joint Guidance on the Application of FERPA and HIPAA to Student Health Records (content last reviewed September 23, 2020)
• U.S. Department of Education and HHS: Joint Guidance on FERPA and HIPAA to Student Health Records, December 2019 update (PDF)
• 16 CFR Part 312: Children’s Online Privacy Protection Rule (312.2, 312.3, 312.5)
• 15 U.S.C. 45: Unfair methods of competition unlawful; prevention by Commission

More in Facilities, care services and pharmacy