Your student may still call when the laundry changes color, the car makes a mysterious noise, or a roommate situation becomes complicated.
But when your student enrolls in college, the rules governing access to academic and medical information change, sometimes before either of you realizes it.
A parent may pay tuition, provide health insurance and remain the student’s emergency contact, yet still be unable to call the college, receive grades, speak freely with a campus health provider or obtain details about a medical visit.
This can feel surprising and even frightening. The good news is that families can prepare. The first step is understanding two federal privacy laws that are often confused: HIPAA and FERPA.
First, a quick spelling note
It is HIPAA, with one P and two As. The acronym stands for the Health Insurance Portability and Accountability Act. FERPA stands for the Family Educational Rights and Privacy Act.
Both laws protect privacy, but they protect different records in different settings. And for college students, the dividing line is not always where parents expect it to be.
What HIPAA generally protects
HIPAA applies to protected health information maintained by covered healthcare providers, health plans, and healthcare clearinghouses. For a college student, HIPAA may govern records held by an off-campus physician, urgent-care center, specialist, or hospital that is a covered entity.
Being a parent or carrying the student on your insurance does not automatically entitle you to the student’s medical information. A provider may share relevant information with family or others involved in care when the patient agrees, does not object, or when another HIPAA permission applies. Providers may also use professional judgment in certain circumstances, including when a patient is incapacitated, but those provisions are not a substitute for planning.
What FERPA generally protects
FERPA governs education records at schools receiving applicable U.S. Department of Education funding. Once a student turns 18 or attends a postsecondary institution at any age, FERPA rights transfer to the student.
That means the student, not the parent, generally controls access to records such as grades, schedules, academic standing, and many disciplinary or advising records. The fact that a parent pays tuition does not, by itself, create automatic access.
FERPA contains exceptions that may permit, but do not necessarily require, a college to disclose information without the student’s consent. For example, a school may disclose education records to a parent when the student is a tax-dependent, and it may disclose necessary information during a health or safety emergency. Institutional policy still matters, which is why relying on an exception is far less dependable than having the student complete the college’s authorization process.
The surprising part: campus health records may fall under FERPA
Many parents assume that HIPAA protects every medical record. At many colleges, however, health records maintained for student patients by a campus health clinic are considered FERPA education or treatment records and are excluded from the HIPAA Privacy Rule.
By contrast, records maintained by a university-affiliated hospital that treats people regardless of student status are typically governed by HIPAA, assuming the hospital is a HIPAA-covered entity. An off-campus physician or urgent-care center will also commonly operate under HIPAA.
In other words, the law governing a student’s health information may depend on who provided the care, who maintains the record, and whether the provider was acting on behalf of the institution. Parents should ask the college and provider directly rather than assuming one law applies everywhere.
What parents should do before the semester begins
- Talk with your student, not around your student
Privacy protections recognize that your student is becoming an independent adult. Begin with a respectful conversation about what support they would want if they were ill, injured, or struggling academically.
Ask: Who should be contacted? What information may be shared? Would your student want you involved in an appointment? Are there circumstances in which they would prefer another trusted adult or advocate?
- Complete the college’s FERPA authorization
Ask the registrar where students can authorize access to education records. Many institutions use an online portal that allows students to name specific people and choose which categories of information may be released.
Do not ask your student to share their portal password. Use the institution’s approved proxy or authorization process. Confirm whether access expires, must be renewed annually, or differs among academic, financial, and conduct records.
- Review healthcare privacy forms separately
A FERPA release for grades is not the same as permission for an off-campus hospital to discuss medical information. Ask the campus health center what law governs its student records and what form it uses to authorize communication. Ask the student’s hometown and college-area providers about their HIPAA authorization processes as well.
Because one provider’s form may not bind another, families may need separate authorizations for separate organizations.
- Discuss healthcare decision-making documents
An authorization to receive information does not necessarily give a parent authority to make healthcare decisions. Families may wish to consult a qualified attorney about a healthcare power of attorney, advance directive, or other documents appropriate under the laws of the student’s home state and college state.
These documents serve different functions. A privacy authorization permits information sharing; a healthcare power of attorney may identify someone to make decisions if the student cannot. Do not assume one form accomplishes everything.
- Create a secure healthcare information kit
- Insurance information and photographs of both sides of the card
- Current medications, dosages, and pharmacy information
- Allergies and significant medical history
- Names and contact information for physicians and specialists
- Emergency contacts
- Copies or locations of relevant authorizations and legal documents
- Campus health, local urgent care, and nearby hospital information
- A plan for contacting Solenne Collegiate Care
The student should be able to access this information securely from their phone. Parents should know where authorized copies are kept without asking the student to share private account passwords.
- Review insurance coverage near campus
Confirm whether your health plan covers routine and urgent care at the student’s school. Review the local network, referral requirements, prescription coverage, and out-of-state limitations. Identify an in-network urgent care center and hospital before you need them.
Do emergency exceptions guarantee that parents will be called?
No. HIPAA and FERPA both contain pathways that may permit disclosure during certain emergencies, but these are fact-specific. Under FERPA, the school determines whether there is an articulable and significant threat and whether disclosure is necessary to protect the student or others. Under HIPAA, providers apply the Privacy Rule and their professional judgment to the situation.
An exception is permission to disclose in qualifying circumstances, not a standing family communication plan and not a promise that every institution will call a parent.
The safest approach is preparation: clear conversations, institution-specific authorizations, appropriate legal guidance, and a plan everyone understands.
Where Collegiate Care fits
Paperwork can make communication possible. It cannot place an experienced person beside your student when you are hours away.
Solenne Collegiate Care adds that human layer. With the student’s consent and appropriate authorization, a nurse advocate can accompany the student during an urgent visit or appointment, help prepare questions, listen carefully, document important information, and provide clear updates to authorized family members.
Our purpose is not to take independence away from a young adult. It is to help the student participate more confidently in their own care while giving the family a trusted local resource when distance makes everything harder.
HIPAA and FERPA protect your student’s privacy. Thoughtful preparation helps privacy and family support work together.
Prepare before the call comes.
Solenne Collegiate Care helps families prepare for medical situations away from home, and provides experienced nurse advocacy when students need support.
Schedule a Collegiate Care consultation: https://solennehealthservices.com/contact/
Notes and disclaimer
This article is general educational information, not legal or medical advice. Laws, state requirements, institutional policies, and individual circumstances vary. Families should consult the college, healthcare providers, and qualified legal counsel about their specific needs.
Primary sources
U.S. Department of Education, FERPA regulations and FAQs: https://studentprivacy.ed.gov/ferpa
U.S. Departments of Education and Health and Human Services, Joint Guidance on HIPAA and FERPA: https://www.hhs.gov/sites/default/files/2019-hipaa-ferpa-joint-guidance-508.pdf
U.S. Department of Health and Human Services, Family Members and Friends: https://www.hhs.gov/hipaa/for-individuals/family-members-friends/index.html