School-based counseling documentation: FERPA vs. HIPAA for school counselors, psychologists, and social workers

The mental health professionals who work in schools — school counselors, school psychologists, and school social workers — are licensed clinicians with real clinical relationships with students. But the documentation framework they work under is not the one their private-practice counterparts know. FERPA, not HIPAA, governs their records. The privacy architecture is different: different access rights, different disclosure rules, different standards for authorizing third-party vendor access. And the boundary between the two frameworks is not always clean — especially for clinicians who work across both settings, and for private-practice therapists who coordinate care with school-based colleagues, receive copies of school records, or conduct independent evaluations of students.

This post unpacks the framework for each school-based role, identifies where the two regulatory regimes intersect, and examines what the distinction means for private-practice therapists treating students — including what it means for vendors like cloud AI scribes that process clinical records in either context.

Why FERPA governs instead of HIPAA

FERPA — the Family Educational Rights and Privacy Act — covers education records: records directly related to a student that are maintained by an educational agency or institution receiving federal funding, or by a party acting on that institution's behalf. Most public schools, school districts, and publicly funded educational programs are covered. The Act grants parents (and, at age 18 or post-secondary enrollment, students themselves) the right to inspect and review education records, request corrections, and control disclosure to third parties.

HIPAA's Privacy Rule contains an explicit carve-out for education records covered by FERPA (45 CFR 164.501). The two frameworks are designed not to overlap on the same copy of the same record: if a record is a FERPA education record, HIPAA does not apply to it. This means that a school counselor employed by a school district — whose records are maintained by the district and are directly related to students — works under FERPA, not under the HIPAA compliance framework that governs a private-practice clinician doing similar work outside the school setting.

The practical consequence is substantial. The full HIPAA compliance architecture — covered entity determination, Privacy Rule compliance, Security Rule administrative and technical safeguards, and the business associate agreement requirement for any vendor who processes protected health information — does not apply to a school district's school counseling records. FERPA has its own access and disclosure framework, its own consent requirements, and its own enforcement mechanism (through the Department of Education rather than HHS). But it does not map directly onto HIPAA's structure, and the differences matter when it comes to how third-party vendors are authorized to access student records.

School counselors: education records and the sole possession exception

A school counselor's day-to-day documentation includes intake notes, session notes, referral documentation, correspondence with teachers and parents, and any records related to academic planning, behavioral intervention, or crisis response. All of these are education records under FERPA when they are maintained by the school and are directly related to identifiable students. Parents have the right to inspect them. The school controls their disclosure to third parties under FERPA's consent framework.

FERPA provides one specific exception that school counselors sometimes rely on: the sole possession records exception. Records that are in the sole possession of the maker and are not accessible or revealed to any other person except a temporary substitute for the maker are not education records under FERPA. A school counselor's purely personal notes — clinical thinking, observational impressions, private hypotheses — kept entirely separate from any shared file and never disclosed to any other school employee could qualify. But the exception is narrow in practice. As soon as a note is shared with a teacher, a vice principal, a school psychologist on the same team, or an administrative staff member, it loses its sole possession character and becomes a full education record. Notes placed in any shared system — even a digital file shared only among the counseling team — are typically no longer sole possession records.

For school counselors using any shared platform or digital system for their notes, the sole possession exception is essentially not available for the shared records. Those records are education records with FERPA's full access and disclosure obligations attached.

School psychologists: IEP evaluations and dual-role documentation

School psychologists occupy a particularly complex documentation position because their work includes two distinct types of activity: direct service provision (individual counseling, behavioral consultation, crisis intervention) and formal evaluation work for IEP eligibility and special education placement. Both produce records under FERPA when the psychologist is a school employee, but the evaluation records receive specific treatment under IDEA's procedural safeguards framework, which layers additional rights on top of FERPA for students with disabilities.

A school psychologist's evaluation for IEP eligibility — including cognitive testing, behavioral rating scales, classroom observation, and the formal evaluation report — is a FERPA education record from the moment it is created. Parents have specific IDEA rights to inspect and review these records, request independent educational evaluations at school expense, and present them in due process hearings. The records also have mandatory retention requirements that vary by state.

The picture changes when a private clinician — not a school employee — conducts a parallel or independent educational evaluation. As we covered in the ADHD and autism evaluation records post, a private psychologist's independent evaluation is a HIPAA-covered health record in the private clinician's possession. When that report is sent to the school to support an IEP process, the school's copy becomes a FERPA education record while the private clinician's own copy remains under HIPAA. The same report operates under two different legal frameworks depending on which party holds it. For the private clinician, this means full HIPAA compliance obligations — including the requirement for a business associate agreement with any vendor who processes the evaluation records, including an AI scribe that was used during the clinical interview or feedback session.

School social workers: mandated reporting and community coordination records

School social workers carry a distinctive documentation burden relative to their school counselor and school psychologist counterparts: their work regularly extends beyond the school building into community coordination, home visits, and family service planning. The records generated by this work have a more complex legal profile than records generated in a school-based session.

Notes from school-based meetings with students and families are education records under FERPA when maintained by the school. But mandated reporting obligations create a second record track entirely outside FERPA. When a school social worker files a report with child protective services, that report and the CPS records it generates belong to a separate agency with its own records management framework — neither FERPA nor the school's records management system governs the CPS file. A subpoena or discovery request aimed at the CPS record reaches an entirely different custodian than the school's records or the social worker's own files.

Community referral records — notes about referrals to outside mental health providers, social services agencies, housing resources, or domestic violence shelters — occupy a similar space. Once the referral documentation leaves the school's records system (whether by fax, by portal, or by phone conversation), it enters the receiving agency's records management framework. The school social worker's own notes about the referral are education records; the receiving agency's intake records are not.

How records flow between school settings and private practice

The boundary between school-based and private-practice mental health services is frequently crossed in coordinated care. A student may see a school counselor during the school day and a private therapist outside school hours. The private therapist may request school records to inform treatment. The school counselor may send behavioral observation notes to the private clinician. IEP documents may be shared with the private therapist to align treatment goals with accommodation plans.

When private-practice therapists receive copies of school records as part of care coordination, those received documents become part of the therapist's own clinical file. In the therapist's possession, they are maintained as part of a HIPAA-covered designated record set. A cloud AI scribe processing the therapist's records would be processing a HIPAA-covered file that may include copies of FERPA education records — and the vendor's processing obligations run under HIPAA rather than FERPA, regardless of the origin of the documents. A business associate agreement with the AI scribe vendor is required by HIPAA for the therapist's own records, and that BAA obligation applies to the entire clinical file, including any school documents within it.

This also means that a student who has an active school counseling relationship and an active private therapy relationship generates records under two different frameworks simultaneously. The school's file is FERPA; the private therapist's file is HIPAA. A subpoena in a custody proceeding, a disability determination, or a guardianship matter may reach both. The private therapist has no control over the school's response to legal process directed at the school, and the school has no control over the private therapist's response to legal process directed at the therapist. Each set of records is a separate subpoena target under the jurisdiction of a different records custodian.

Cloud AI scribe authorization in school settings

For school-employed clinicians who use AI scribe tools for their session documentation, FERPA's vendor authorization framework operates differently from HIPAA's business associate agreement structure. Under FERPA, a third-party vendor may access student records only if it qualifies as a "school official" — defined as an entity that performs a function that the school would otherwise use employees for, is under the direct control of the school with respect to the use and maintenance of education records, and uses the records only for legitimate educational purposes. This is a tighter authorization standard than HIPAA's BAA in some respects: the school must maintain direct control over how the vendor uses the records, and the vendor's use must be limited to legitimate educational interests.

Most commercial AI scribe products are designed and marketed within HIPAA's business associate agreement framework, which is the compliance architecture that private-practice therapists operate under. Their Terms of Service and data processing agreements are structured to meet HIPAA BAA requirements. The FERPA "school official" authorization standard is a different framework that requires different contractual terms and different operational controls. A school district deploying a commercial AI scribe product without a specific FERPA-compliant authorization agreement in place may be creating a FERPA compliance gap — and unlike HIPAA, FERPA enforcement runs through the Department of Education's complaint process and can result in loss of federal funding for the district.

On-device documentation for private-practice therapists treating students

For private-practice therapists whose clients include students — minors in active school placements, post-secondary students with disability accommodation histories, adults being evaluated for childhood ADHD diagnoses — the session content regularly includes sensitive material about academic performance, family dynamics around school placement decisions, developmental histories that bear on IEP eligibility, and disclosures that may intersect with the client's school records. This content is categorically different from routine therapy session notes.

A session with a fifteen-year-old discussing the impact of an IEP process on the family's relationship, or an adult recounting a childhood evaluation that was traumatic to receive, contains disclosures the client has often not made to anyone outside the family and the school system. Cloud vendor records of those sessions can be subpoenaed independently — in custody proceedings, disability determinations, or civil litigation involving school placement decisions — by legal process directed at the vendor rather than the therapist. Whether the therapist's own notes qualify as psychotherapy notes with enhanced HIPAA protections does not govern the vendor's response to legal process directed at the vendor as a separate legal entity.

When session audio is processed on the therapist's own hardware rather than transmitted to a cloud vendor, the vendor's independent record disappears from the custody chain. TherapyDraft processes session audio entirely on the therapist's Mac — Whisper.cpp for transcription, an on-device language model for note drafting on Apple Silicon, no data transmitted to cloud infrastructure for audio, transcript, or note text. For therapists treating student clients, the session content — whatever the client discloses about their school history, current educational experience, family dynamics around academic performance, or long-standing neurodevelopmental diagnoses — stays on the therapist's device. The therapist's clinical documentation is the complete record, in one location, under one legal framework. Solo plan starts at $49/month with a 10-session free trial and no card required.

Further reading

• ADHD and autism evaluation records: what AI scribes capture in psychological assessment practice — the distinction between FERPA and HIPAA for private-practice evaluation records, and what cloud AI scribes hold from clinical interviews and feedback sessions
• The 7 things Mentalyc, Upheal, and Blueprint actually send to their servers — what intermediate records cloud scribes retain beyond the final note
• Can an AI therapy note be subpoenaed? A 2026 legal-risk explainer — how civil and criminal subpoenas reach cloud AI vendors directly and what the therapist cannot control about the vendor's response
• What is a BAA, actually — and what it does NOT cover — the structural limits of business associate agreements and why a signed BAA does not prevent a vendor's records from being subpoenaed in separate proceedings
• HIPAA for private-practice therapists — the 2026 rewrite — the full compliance posture for a solo practice and the AI scribe subsection of the 2026 risk landscape

This post is educational commentary, not legal, clinical, or compliance advice. FERPA, HIPAA, IDEA, and state privacy law requirements applicable to school-based and private-practice mental health records vary by jurisdiction, by the clinician's employment status, and by the specific records at issue. FERPA's "school official" authorization standard and HIPAA's business associate agreement framework have different requirements and do not substitute for each other. Mandated reporting obligations and child protective services records management are governed by state law frameworks separate from both FERPA and HIPAA. Consult a licensed healthcare attorney and, where relevant, an education law attorney before making documentation or technology decisions based on this content.