Sharing Student Health Information at School: Consent, Privacy, and Questions

By the Healthy Learning Environments Guide Team

Does a School Need Consent to Share Student Health Information?

Sharing a student’s health information at school generally requires the parent’s or eligible student’s written consent under federal law. The Family Educational Rights and Privacy Act (FERPA) sets rules for when a school can share information from education records, and lists specific situations where consent is not required first.

This article explains what FERPA says about consent, privacy, and student health information — and turns those rules into questions you can bring to your school. It does not tell you what to disclose about a specific student, and it is not legal advice.

Who Holds These Privacy Rights — Parents or Students?

FERPA gives privacy rights over education records to a parent, and those rights transfer to the student once the student turns 18 or enrolls in any postsecondary school, whichever happens first.

Once that happens, the student is called an “eligible student.” From that point on, the eligible student — not the parent — generally holds the rights to consent to disclosures, inspect records, and request corrections.

What Must a FERPA Consent Form Include?

Before a school shares personally identifiable information from a student’s education records with most outside parties, FERPA requires a signed and dated written consent that names the records, states the purpose, and identifies the recipient.

Specifically, the written consent must:

• Name the specific records that may be shared
• State the purpose of sharing them
• Identify the person, group, or organization who will receive them

An electronic signature can satisfy this requirement if it identifies and authenticates the person giving consent and shows their approval of what the consent says.

Myths and Realities About Student Health-Information Sharing

Several common assumptions about student privacy do not match what FERPA actually says. The table below compares common beliefs with the regulation’s actual language.

Common Belief	What FERPA Actually Says	Why It Matters
Schools always need written consent before sharing any student information	FERPA lists specific exceptions — such as school officials with a legitimate educational interest, or properly designated directory information — where consent is not required	Families can ask which exact exception applies rather than assuming consent was skipped improperly
A school can share health details with anyone during an emergency, no questions asked	Disclosure is allowed only when there is an articulable and significant threat, and the school must document the threat and who received the information	Families can request that documentation after the fact
“Directory information” can include anything the school wants to share	Directory information is limited to defined categories, excludes a student’s Social Security number, and requires public notice plus a chance to opt out	Families who never opted out may not realize this category exists
Parents always control a student’s records, regardless of age	Rights transfer to the student at 18 or upon postsecondary enrollment	Consent forms signed by a parent may no longer be valid once a student becomes an eligible student

When Can a School Share Health Information Without Asking First?

FERPA permits, but does not require, disclosure without consent in several defined situations, including emergencies, enrollment transfers, and legally compelled disclosures.

• To school officials within the agency who have a legitimate educational interest in the record
• To another school where the student is enrolling or already enrolled, for purposes related to that enrollment or transfer
• In connection with a health or safety emergency, when knowledge of the information is necessary to protect the student or others
• As directory information, if the school gave public notice and the family did not opt out
• To comply with a judicial order or a lawfully issued subpoena

A party that receives information under most of these exceptions generally cannot redisclose it to someone else without the parent’s or eligible student’s prior consent, unless a separate FERPA provision allows it.

What Should Families Do During a Health or Safety Emergency?

If a student is in immediate danger, contact local emergency services first — FERPA’s emergency exception is not a substitute for that.

FERPA’s health-and-safety exception lets a school disclose information when it determines there is an articulable and significant threat to the student or others. When a school uses this exception, it must record what the specific threat was and which parties received the information, so families can ask to see that documentation afterward.

Are Treatment Records for Older Students Handled Differently?

Yes, in a narrow way. For students 18 or older, or attending a postsecondary program, records made and used only for treatment by a physician, psychiatrist, psychologist, or similar professional — and shared only with people involved in that treatment — are generally excluded from FERPA’s definition of an “education record.”

If your family is navigating this situation, ask the school or program directly how they classify and handle these particular records, since the distinction depends on how the records are made, used, and shared.

How Can Families Review or Correct a Student’s Records?

Parents and eligible students generally have the right to inspect and review education records, and a school must comply within a reasonable time, not to exceed 45 days.

If a parent or eligible student believes a record is inaccurate or misleading, they can ask the school to amend it. If the school declines, FERPA provides for a hearing on the request. Schools must also notify parents and eligible students annually of these rights, including how to file a complaint with the U.S. Department of Education’s Student Privacy Policy Office.

How Does Health-Information Sharing Connect to School Health Services?

Coordination between school staff and a student’s outside providers is a normal part of school health services — and it’s often exactly where privacy questions arise.

CDC’s Whole School, Whole Community, Whole Child framework highlights family engagement and provider coordination as part of good school health services, including educating students and caregivers about chronic conditions and coordinating care with external health care providers, and giving families opportunities to learn about chronic conditions and school health services. Any time that kind of coordination involves sharing a student’s health information outside the school, the FERPA consent questions above apply.

If This Happens, What Should You Do? A Quick Decision Path

Use these if/then steps as a starting checklist, not a substitute for reading the actual consent form or asking the school directly.

• If a school asks you to sign a consent form, then check that it names the specific records, states the purpose, and identifies the recipient before you sign.
• If a school discloses information and calls it an emergency, then ask to see the documented threat and the list of who received the information.
• If you believe a record is inaccurate or misleading, then request an amendment in writing, and ask about the hearing process if the school declines.
• If your student turns 18 or enrolls in a postsecondary program, then confirm with the school that consent and review rights have transferred to the student.

What Are the Limits of This Guidance?

• This article summarizes the federal FERPA regulations as published by the U.S. Department of Education. It does not cover state student-privacy laws, which can add requirements FERPA does not.
• It does not cover a specific school’s own forms, procedures, or timelines, which may go beyond what FERPA requires.
• It is not legal advice and does not tell you what to disclose or withhold about a specific student’s health information.
• If your situation is high-stakes or disputed, consider asking the school in writing and, if needed, consulting a professional familiar with student-privacy law.

What Should We Ask Before Health Information Is Shared? A Conversation Worksheet

Consider bringing these questions to a meeting with school staff before health information is shared:

1. What specific information do you want to share, and with whom?
2. Which FERPA exception, if any, allows this without our written consent — or do you need our signed consent first?
3. If consent is needed, does the consent form name the exact records, the purpose, and the recipient?
4. Who at the school has legitimate educational interest in this information, and why?
5. If this is an emergency disclosure, what is the specific threat, and will it be documented?
6. How can we review the records involved, and how long will that take?
7. If we believe something in the record is inaccurate, what is the process to request a correction?
8. Who do we contact if we have more questions about our rights under FERPA?

Write down the answers and the date. A written record makes it easier to follow up later.

Frequently Asked Questions

Does a school need my written consent to share my child’s health records?

Generally yes. FERPA requires signed, dated written consent before a school discloses personally identifiable information from education records, though specific exceptions—like a legitimate school-official interest or a health and safety emergency—don’t require consent first.

What happens to my FERPA rights once my child turns 18?

The rights to consent, inspect, and request amendments generally transfer from the parent to the student once the student turns 18 or enrolls in any postsecondary school, whichever comes first.

Can a school share health information during an emergency without asking first?

Yes, when the school determines there is an articulable and significant threat to the student or others. The school must document the specific threat and who received the information.

What information must a FERPA consent form include?

It must name the specific records to be shared, state the purpose of sharing them, and identify who will receive them. A dated signature, including a qualifying electronic signature, is required.

How long does a school have to let us review our child’s records?

A school must comply with a request to inspect and review education records within a reasonable time, not to exceed 45 days.

Related Reading on This Site

For a broader look at mapping roles and privacy boundaries when families, schools, and community groups coordinate, see Family–School–Community Coordination That Works. For this publication’s scope and safety limits, see Start Here. For how this publication sources and checks its guides, see How We Research. If you spot an error in this article, see Corrections.

Educational Disclaimer

This article is for general education only. It is not legal or medical advice and does not replace guidance from a school official, an attorney familiar with student-privacy law, or a healthcare provider. Laws and school policies can change; confirm current requirements directly with your school or the U.S. Department of Education’s Student Privacy Policy Office.

Production note: This article used AI-assisted drafting from named source material (34 CFR Part 99 and CDC’s WSCC school health services page) and requires independent review against those sources before publication.

Updated September 8, 2026. By Healthy Learning Environments Guide Editorial Team.

This article was drafted with AI assistance and editorially reviewed.