Sharing your child's health information with and between his/her various health providers is an important part of the Medical Home concept, especially when several specialists are caring for your child. With access to all important information, your physicians can make the best decisions, avoid duplication of tests and services, and minimize the risks of using the wrong drugs or other treatments. Other providers can be sure that their services are consistent with the overall plan and can work with your Medical Home to make sure your child gets the best care possible.
You, as a health care consumer and a parent, have the right to control where your health information goes and the responsibility to make sure information is available to those who need it. In general, you should also try to limit access to your child's medical information to only those people who need it to provide care, to work with your providers (e.g., schools), or to provide funding/payment (e.g., insurance companies, Social Security, etc.). It is important to be careful about how the information is shared - transmitting records by fax or email may not be the safest way unless you are sure the fax will only be seen by the right people or that the email is appropriately encrypted. Federal legislation has mandated certain protections for health information.

What is HIPAA? And why is it important?

The Health Information Portability and Accountability Act (HIPAA) was established by the U.S. Department of Health and Human Services (HSS) in 1996. This national set of privacy regulations limits the ways that health plans, pharmacies, hospitals, physicians, and other "covered entities" can use patients' personal medical information. The regulations govern sharing of "protected health information" – any information about health status, provision of health care, or payment for health care that can be linked to an individual.
Listed below are some frequently asked questions pertaining to children's health care needs. Answers have been summarized from the Health and Human Services web site. For more detailed information, see Health Information Privacy (HHS) or HIPAA Frequently Asked Questions.

How does HIPAA affect the confidentiality of my child's medical records?

The privacy regulations prevent personal medical information from being given, without your permission, to an outside entity for purposes unrelated to your child's health care, such as a life insurer, a bank, or a marketing firm.

Do my child's physicians need my permission to share information with each other?

No, but... The HIPAA Privacy Rule permits a health care provider to disclose protected health information about an individual, without the individual's authorization, to another health care provider for that provider's treatment of the individual. Health care providers are equired by HIPAA to take all necessary precautions in sharing information in a confidential manner. But it can be very helpful to providers when parents are proactive in granting written permission to communicate with other providers and, particularly, with schools and mental health providers. Many people (including providers and their staff) don't fully understand HIPAA and may not be willing to communicate without your explicit permission, even when it would be perfectly legal and in your child's best interest.

What about communicating with my child's school personnel

Sharing health information with and from schools and school personnel is governed by yet another law, the Family Educational Rights and Privacy Act (FERPA), which is even more restrictive than HIPAA. Special forms will be needed to grant school personnel permission to share information. See Family Educational Rights and Privacy Act (FERPA), the Portal's School Types and Options section, and the Schools Information Release Form (PDF Document 49 KB).

Are parents entitled to copies of their child's medical records?

Patients and their parents should be able to obtain copies of their medical records and request corrections if they identify errors and mistakes. Health plans, doctors, hospitals, clinics, nursing homes and other covered entities generally should provide access to these records within 30 days of request and may charge patients for the cost of copying and sending the records.

What happens when I sign information release forms?

Most physicians and other providers will ask you to sign a "release form" giving them formal permission to share information with other providers, facilities, schools, etc. Examples of such forms can be found below under "Tools." These forms usually allow you to specify details about when, where, and how much of your medical records may be shared. It is also a good idea to indicate for how long they may be shared.

Can I fax or email medical information?

Yes, but it is a good idea to ask if these methods are protected for confidentiality.

What is FERPA and why is it important?

Family Educational Rights and Privacy Act (FERPA) is a Federal law that protects the privacy of public school student education records. The FERPA law does not apply to private schools. FERPA gives parents or guardians rights about their children’s education records. These rights become the student’s rights when the student:
  • Turns age 18
  • Starts school beyond the high school level, like college, even if the student is under age 18.
A student who has FERPA rights is called an eligible student. Generally, schools can’t release any information from a student’s education record without written consent from the parent or eligible student. However, because school nurses are providers under HIPAA, they can share information with other providers without consent.
FERPA gives parents and eligible students the right to:
  • Look at all the student's education records kept by the school
  • Ask that the school correct records if something isn't accurate

Health Information in Education Records: HIPAA or FERPA?

Health information contained in a medical record is protected by HIPAA. Health information given to anyone in the school goes into the student’s education record. Once it’s in the education record, it’s protected by FERPA, not HIPAA. Information is kept in a secure part of the school’s record and only shared on a need-to-know basis.


Information & Support

For Professionals

HIPAA Privacy Rule (NIH)
Basic information and links to detailed information about HIPAA, focused on research and researchers; from the National Institutes of Health

Family Educational Rights and Privacy Act (FERPA)
From the U.S. Department of Education, a description of FERPA.

For Parents and Patients

Health Information Privacy (HHS)
Overview and links to detail about HIPAA, for Consumers and for Covered Entities (physicians and health organizations); from the U.S. Department of Health and Human Services.

HIPAA Frequently Asked Questions
Search for information about HIPAA on the U.S. Department Health and Human Services site.

A scholarly article on the interface of HIPAA and FERPA (Family Educational Rights and Privacy Act) in the school environment. (2004)

Family Educational Rights and Privacy Act (FERPA)
From the U.S. Department of Education, a description of FERPA.


Release of Information Form (Medical) (Word Document 28 KB)
This sample form may be used to share information between designated providers. Check with your Medical Home for more information.

Schools Information Release Form (PDF Document 49 KB)
Sample form for a child's parent/guardian to authorize two-way communication between the health care provider and school teams, as it relates to the diagnosis/condition listed.

Authors & Reviewers

Initial publication: June 2008; last update/revision: April 2015
Current Authors and Reviewers:
Author: Chuck Norlin, MD
Contributing Authors: Alfred N. Romeo, RN, PhD
Mindy Tueller, MS, MCHES
Gina Pola-Money