HIPAA and FERPA on Campus: Key Considerations for Attorneys and Compliance Professionals Supporting Different Clinical Settings

• May 22, 2026

• Robert Hess , Husch Blackwell LLP
• Aleks O. Rushing , Husch Blackwell LLP
• Morgan Goulet , Husch Blackwell LLP

Attorneys and compliance professionals who work on campuses with student health clinics, counseling centers, teaching clinics, and clinical affiliate arrangements routinely navigate two different federal privacy regimes: the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). A policy or practice that is appropriate in one clinical setting may be incorrect, or even unlawful, in another. Universities determine the scope of their regulatory obligations through their decisions about the scope of patients seen, the involvement of student learners in providing care, whether to electronically bill insurance, whether to accept business associate obligations, and how to structure the university’s hybrid entity designation. When offering a new service or making a change to an existing service, keeping these considerations in mind will help the university anticipate the rules that will apply. This article identifies threshold questions that attorneys and compliance professionals should work through to determine when HIPAA applies, when FERPA applies, and when assumptions drawn from one setting may not transfer into another.

ARTICLE TAGS

• Academic Medical Centers and Teaching Hospitals Practice Group
• Health Information