Legal, Ethical, and Regulatory Issues
Which law applies
FERPA governs education records, and school health records maintained by the school are generally education records under FERPA, even when the nurse is custodian - HIPAA usually does not apply to the school itself. HIPAA matters for outside providers and for school-based health centers that bill electronically. IDEA and Section 504/ADA govern services and accommodations; the state nurse practice act governs licensure, delegation, and scope; state law governs immunization exemptions, minor consent, and reporting.
Core obligations
- Mandated reporting: reasonable suspicion of abuse or neglect triggers a report to child protective services; good-faith reporters generally have immunity, and the nurse does not investigate or notify parents first.
- Consent: minors generally need parental consent for care, with statutory exceptions (emergency, emancipated minors, certain sensitive services).
- Confidentiality: share only the minimum necessary with those who have a legitimate educational interest; use an authorized release for outside providers; know directory-information rules.
- Records: subpoena versus court order versus parental request; route through district legal counsel; follow retention schedules.
- Medication and delegation: state law defines who may administer, self-carry, and be delegated to; standing orders require medical direction.
- Custody disputes: the school follows the court order on file, not a parent's verbal claim.
Traps
Answering "HIPAA" for a question about school records. Reporting abuse only after "confirming" it. Releasing records on an informal phone request. Treating a 504 plan as identical to an IEP. Forgetting that the nurse's own notes are discoverable.
Rule of thumb
Identify the legal framework before choosing the action: education records → FERPA; services → IDEA/504; practice → nurse practice act; safety → mandated reporting. When laws conflict, follow the most protective requirement and consult counsel.