College counseling centers, FERPA, and cloud AI scribes: the regulatory gap no BAA covers

What college counseling sessions contain — and why the regulatory context matters

College counseling centers serve a population at a particular point of vulnerability. The 18–24 age range is the peak onset window for many serious mental health conditions: first episodes of major depression, generalized anxiety disorder, bipolar disorder, and schizophrenia spectrum presentations frequently emerge during undergraduate years. Students disclose material in college counseling that they have never shared with anyone — with parents, with primary care physicians, with school counselors — because they are living independently for the first time and the college counseling center is often the first mental health resource they have accessed on their own terms.

The content of college counseling sessions reflects this:

First mental health disclosures. A student who has managed depression, anxiety, or trauma without formal treatment through high school often enters therapy for the first time in college. That first disclosure session captures material that has never been in any clinical record: the onset history, the coping strategies used to mask symptoms, the family dynamics around mental health, the prior experiences that the student connects to their current distress. This is a unique record with no prior clinical parallel.

Academic crisis content. College counseling often intersects directly with academic performance — failing grades, academic probation, accommodations requests, suspension or dismissal proceedings. Sessions regularly address the student's academic record explicitly: the courses they're failing, the professors involved, the accommodations they need, the academic misconduct allegations they're facing. This is content that touches both the clinical record (what the counselor documents as protected health or treatment information) and the formal academic record (which is definitively an education record under FERPA).

Sexual assault and Clery Act intersections. Campus sexual assault disclosures create a particularly complex legal environment. Counselors who are confidential resources under campus policy hear disclosures that may not trigger mandatory Clery Act reporting — but the fact of the disclosure, the details provided, and the student's ongoing distress are in the counseling record. In Title IX proceedings, these records become relevant. The intersection of FERPA's education record protections, Title IX investigation requirements, and the counselor's confidentiality obligations creates an environment where the records of these sessions are already heavily scrutinized.

Suicidality and safety documentation. College counselors conduct suicidality assessments and document safety plans at rates that reflect their population. Those records carry clinical, legal, and liability weight: if a student dies by suicide, the institution's documentation of counseling contacts and safety assessments becomes central to litigation. The cloud AI scribe vendor holds the verbatim session audio behind that documentation — including the student's disclosures about means access, intent, and plan that informed the counselor's assessment but may not appear word-for-word in the formal safety plan.

FERPA versus HIPAA: the regulatory framework at college counseling centers

FERPA — the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g — governs education records at institutions that receive federal funding. Nearly every college and university in the United States qualifies. FERPA gives students the right to access their own education records, the right to request corrections, and protection against unauthorized third-party disclosure.

HIPAA's Privacy Rule at 45 CFR § 164.501 includes a specific exemption: education records subject to FERPA are excluded from HIPAA's definition of protected health information. This is not ambiguous or contested — HIPAA explicitly yields to FERPA when both would otherwise apply. A college counseling center operating as part of a FERPA-covered educational institution maintains records under FERPA's framework, not HIPAA's.

This matters for cloud AI scribes in a direct way: a cloud AI scribe vendor offering a HIPAA Business Associate Agreement is premising that agreement on HIPAA coverage of the records it processes. If the college counseling center's records are FERPA education records rather than HIPAA protected health information, the BAA describes the wrong regulatory regime. The vendor's HIPAA compliance program, breach notification procedures, and data handling commitments are structured around HIPAA obligations — not FERPA's distinct requirements for educational institutions and the vendors they engage.

The FERPA treatment records exception — and what it doesn't reach

FERPA recognizes that clinical treatment records maintained by professionals purely for treatment purposes are different from ordinary education records. The treatment records exception at 34 CFR 99.3 excludes from FERPA's definition of education records those records that are: made or maintained by a physician, psychiatrist, psychologist, or other recognized professional acting in their professional capacity; made, maintained, or used only in connection with the provision of treatment to the student; and not available to anyone other than persons providing such treatment.

Records meeting all three criteria are excluded from FERPA's definition of education records. That has a counterintuitive implication: the student who has FERPA rights to access their academic transcript, enrollment records, and financial aid records does not have the same FERPA access rights to their counseling session notes if those notes qualify as treatment records under 34 CFR 99.3. The treatment records exception gives counselors a measure of clinical confidentiality that ordinary FERPA doesn't provide.

But the treatment records exception governs records maintained by the institution's clinical professionals. It describes what the institution holds and who at the institution can access those records. It says nothing about what a third-party cloud AI scribe vendor does with session audio it independently retains after processing a counseling session.

When a college counselor uses a cloud AI scribe to transcribe and draft notes from a session, the vendor receives the audio, processes it, and retains the audio (and often the transcript) as the vendor's own business records. The vendor is not the physician, psychiatrist, or psychologist the treatment records exception contemplates. The vendor is not operating in a professional capacity for treatment purposes — it is providing a commercial software service. The vendor's retained audio is not in the institution's custody; it is in the vendor's infrastructure under the vendor's terms of service. The treatment records exception that partially shields college counseling notes from FERPA's disclosure requirements does not reach into the vendor's data centers.

The school official exception and the AI scribe gap

FERPA's framework for allowing third-party access to education records runs primarily through the school officials exception at 34 CFR 99.31(a)(1). Schools can disclose education records to school officials with a legitimate educational interest. A school official can include contractors and other outside parties performing services that the institution would otherwise perform itself — but only if the institution: (a) has included the outside party in its annual notification of school officials; (b) maintains direct control over the outside party with respect to the use and maintenance of education records; and (c) requires the outside party to comply with FERPA's use and redisclosure restrictions.

Whether a commercial cloud AI scribe qualifies as a school official under this framework involves a genuine legal determination that most institutions have not made — and most AI scribe vendors have not sought. The school official exception requires the institution to have direct control over the vendor "with respect to the use and maintenance of education records." A commercial cloud AI scribe that operates under its own terms of service, retains audio under its own data retention policies, and handles data across thousands of institutional and non-institutional customers is not straightforwardly under the institution's direct control. The vendor's data practices are not governed by the institution's FERPA policies — they are governed by the vendor's commercial contracts.

The practical reality for most college counseling centers that have adopted cloud AI scribes is that this FERPA analysis has not been formally completed. The vendor offered a HIPAA BAA; the institution, focused on HIPAA compliance for other health services it provides, signed it. The question of whether the FERPA school official exception applies to the AI scribe vendor's access to counseling session audio has not been asked — let alone answered by institutional counsel, the registrar, or the privacy office.

Discovery pathways: Title IX, campus litigation, and the vendor archive

College counseling records face disclosure pressure in several specific contexts that differ from standard clinical practice:

Title IX proceedings. Campus Title IX investigations into sexual assault and harassment operate under federal procedural requirements, including due process protections for respondents (the accused) that have expanded significantly under regulatory interpretation. Respondents' advisors have asserted access to counseling records of complainants as relevant to the investigation. FERPA's protections for education records have been litigated in this context, with courts addressing the tension between FERPA's privacy framework and Title IX's procedural requirements. A cloud AI scribe vendor holding session audio from counseling sessions referenced in a Title IX investigation is a third-party record holder outside the institution's FERPA framework — a separately reachable data source that the institution's lawyers may not even know exists.

Student lawsuits against universities. Students and their families increasingly pursue civil litigation against universities for campus mental health service failures: inadequate response to a mental health crisis, failure to refer, negligent supervision, premises liability following a suicide. In these cases, the university's documentation of the student's counseling contacts is central evidence. The cloud AI scribe vendor's independently retained audio of those counseling sessions is a separately discoverable record in the civil litigation — reachable through Rule 45 subpoena to the vendor as a third party holding materials relevant to the suit.

Post-age-18 parental access changes. FERPA gives students, not parents, access rights once the student reaches 18 (unless the student is still a tax dependent under the parents' tax return). This is a common source of conflict: parents who have been receiving information from the institution throughout their child's K-12 education lose that access when the student reaches college age. A cloud AI scribe vendor's data retention and access policies are governed by the vendor's own terms of service, not by the student's FERPA rights. A parent who subpoenas the AI scribe vendor directly — in a guardianship proceeding, in a custody dispute, or in a personal injury case involving the student — encounters a vendor with no independent obligation to enforce the student's FERPA-based access restrictions.

The graduation transition: when one student's record spans two regulatory regimes

When a student completes college and begins seeing a therapist in private practice, their regulatory situation changes entirely. The private practice therapist is a HIPAA covered entity or business associate of one; the records are protected health information under HIPAA; the cloud AI scribe vendor's processing is governed by a HIPAA BAA. This is the standard clinical scenario that a BAA addresses — imperfectly, but within the right legal framework.

But if the same student was already using a cloud AI scribe at the college counseling center — or if their college counselor was using one — the vendor may now hold a longitudinal record of that student's mental health history spanning both their college years (FERPA treatment records, educational institution, no clear HIPAA coverage) and their post-graduation private therapy (HIPAA protected health information, covered entity, BAA-governed). The vendor has retained audio from two distinct regulatory regimes, applied its own commercial terms of service uniformly to both, and has no mechanism for segregating the governance frameworks applicable to each portion of its archive.

When that student's mental health history becomes relevant in litigation years later — a disability claim, a custody proceeding, a personal injury case, a professional licensing inquiry — the vendor is a potential discovery target for records spanning the student's entire adult mental health history, with regulatory mismatches baked in from the start. The independent vendor archive that cloud AI scribes create for any individual clinical relationship is the underlying problem; for patients who received care in both FERPA-governed and HIPAA-governed settings through the same vendor, the complexity compounds.

On-device processing for college counselors

The regulatory gap between FERPA and HIPAA at college counseling centers has a clean architectural resolution: process everything locally. A college counselor using on-device transcription and note generation — where audio is captured and processed entirely on the counselor's own Mac, with no audio transmitted to any external vendor — generates no separately retained vendor audio archive. There is nothing for a Title IX investigation to subpoena from a third-party vendor. There is nothing in a vendor's commercial data retention pipeline for a student's parents, the student's adversary in civil litigation, or a plaintiff's attorney to reach.

The regulatory question of whether the counseling center's institutional records are FERPA education records, FERPA treatment records, HIPAA protected health information, or something in between — still matters for how the institution handles its own documentation. But the vendor archive problem disappears: the vendor has nothing, because the vendor received nothing. The counselor's documentation judgment governs the complete record.

For college counselors who work both at a university counseling center and in private practice — a common arrangement for counselors who maintain part-time private practice alongside institutional work — this also resolves the governance framework confusion at the individual session level. The same tool, the same workflow, the same on-device processing. No session produces a vendor archive regardless of which institutional context it takes place in.

The distinction between psychotherapy notes and progress notes under HIPAA is one layer of the documentation protection framework for private practice. For college counselors operating under FERPA, the treatment records exception at 34 CFR 99.3 is the analogous protection — applied to the institution's own records, not to a third-party vendor's independently retained audio. On-device processing is the only approach that makes the vendor archive question irrelevant regardless of which regulatory framework applies.

Frequently asked questions