Yes, a school can call your doctor’s office to verify a note you submitted for your child, and this happens routinely with absence excuses, medication orders, and accommodation requests. What the doctor’s office is allowed to say on that call is a separate question, and the answer is narrow: the office can confirm only what you have authorized it to confirm. Once the school has the note or the verification, that information becomes part of your child’s education record and is governed by the Family Educational Rights and Privacy Act (FERPA), not HIPAA.
What the Doctor’s Office Can Tell the School
HIPAA’s Privacy Rule sets the national standard for what a healthcare provider can disclose about a patient.1U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule A school is not a covered entity under HIPAA, and calling the doctor does not give the school any special right to information. The provider needs the patient’s authorization, or the parent’s authorization for a minor, before sharing protected health information with the school.
In practice, when a school calls to verify a note, the office is confirming information you already put in front of the school. If you submitted a note saying your child was seen on a specific date and cleared to return to school, the office can generally confirm that same fact if you have signed a release authorizing that communication. Without a release, the office should not confirm the visit, the diagnosis, or anything else, even if the school asks directly. Many pediatric practices ask parents to sign a general school communication release at intake for exactly this reason.
The narrower the note, the narrower the verification. A note that says only “seen on October 3, may return October 6” gives the office very little to confirm beyond those two facts. A note that lists a diagnosis, medications, and restrictions puts all of that on the table if you have authorized disclosure. You control how much detail leaves the office by controlling how much detail goes into the note in the first place.
What Happens to the Note Once the School Has It
The moment a doctor’s note reaches the school, it stops being a HIPAA document and starts being an education record under FERPA. The federal statute defines education records as records directly related to a student that are maintained by the school or someone acting for the school, and that definition sweeps in medical documentation submitted for absences, accommodations, or medication.2Office of the Law Revision Counsel. 20 USC 1232g – Family Educational Rights and Privacy Records maintained by a school nurse or counselor about a student are treated the same way, whether the underlying care happened on campus or somewhere else.3U.S. Department of Health and Human Services. Does FERPA or HIPAA Apply to Elementary or Secondary School Student Health Records
FERPA gives you the right to inspect and review those records, the right to ask for corrections, and the right to control most disclosures to outside parties.4U.S. Department of Health and Human Services. Joint Guidance on the Application of the Family Educational Rights and Privacy Act and HIPAA to Student Health Records The school cannot charge you a fee just to look at the file. It can charge a reasonable copy fee.
Because the note is an education record from the day it arrives, its confidentiality inside the school depends on FERPA rules, not on HIPAA. Parents sometimes assume that a medical document carries HIPAA protection wherever it goes. It does not. The rules change based on who holds the record.
How Much to Put in the Note
You have real control here, and it is worth using. The school needs enough information to act on your request. For an absence, that usually means the dates the student was unable to attend and, if relevant, when the student can return. For medication, the school needs to know what to give, when, and how much, and it typically needs written authorization from both the parent and the prescribing provider before staff will administer anything.
What the school does not need is your child’s full medical history, and you are not required to provide it. If a doctor’s note lists a diagnosis, testing results, or details about ongoing treatment that go beyond what the school needs to act, you can ask the provider to write a more limited note. A note that says “under my care, cleared to return on [date]” is often enough for an absence. Accommodation requests may need more detail, but even there, the school needs the functional limitation and the accommodation, not necessarily the underlying condition.
Who at the School Can See the Note
FERPA lets school officials with a “legitimate educational interest” access education records without your consent.5eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required That category covers teachers, administrators, the school nurse, and outside contractors performing institutional functions, but only if the school determines the person needs the information to do their job. A teacher who needs to know that a student has a peanut allergy has a legitimate interest in that fact. A teacher on the other side of the building does not.
This is where schools most often stumble. Copying a medical note or an accommodation plan to every teacher in the building, or leaving it in a shared file, spreads the information further than FERPA’s need-to-know standard allows. If you notice that staff members without a role in your child’s care seem to know medical details, you can ask the school in writing to explain who has access and why. The answer should map to specific responsibilities.
When the School Can Share the Note Without Asking You
FERPA generally requires your written consent before the school releases personally identifiable information from your child’s records to an outside party, and the consent must specify which records, for what purpose, and to whom.2Office of the Law Revision Counsel. 20 USC 1232g – Family Educational Rights and Privacy The statute then carves out several exceptions where the school can share without asking you:
- Transfer to another school when your child enrolls or seeks to enroll there.5eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required
- A court order or lawfully issued subpoena.
- A health or safety emergency where the school judges that disclosure is necessary to protect the student or others.
The emergency exception is the one that most often touches medical records. FERPA lets schools disclose records to appropriate parties, such as emergency responders or law enforcement, when there is an “articulable and significant threat” to health or safety, considering the totality of the circumstances.6eCFR. 34 CFR 99.36 – Conditions for Disclosure in Health and Safety Emergencies Disclosure has to be tied to an actual, impending, or imminent emergency and is limited to the period of the emergency.7U.S. Department of Education. When Is It Permissible to Utilize FERPA’s Health or Safety Emergency Exception for Disclosures A school can share your child’s allergy information with paramedics during a reaction. It cannot use this exception to hand a medical file to anyone who asks after the fact.
When Your Child Turns 18 or Enrolls in College
FERPA rights transfer from the parent to the student once the student turns 18 or enrolls in a postsecondary institution at any age. At that point, the school needs the student’s consent to share records, and the school will typically direct verification questions about a doctor’s note to the student rather than the parent. If the student is still claimed as a dependent for federal tax purposes, the school may provide the parent with access without the student’s consent, but it is not required to.8U.S. Department of Education. Eligible Student This trips up families every year when a high school senior turns 18 mid-year and the release forms suddenly need the student’s signature.
If You Think the School Mishandled the Note
Start with the school. Ask in writing who saw the note, how it is stored, and with whom it has been shared. That request alone often surfaces the problem and prompts a correction. You also have the right to ask the school to amend inaccurate information in your child’s record.
If the school will not fix the issue, you can file a complaint with the Student Privacy Policy Office at the U.S. Department of Education. The complaint has to be in writing, contain specific allegations, and be filed within 180 days of the violation or within 180 days after you learned about it.9U.S. Department of Education. File a Complaint FERPA does not give you a private right to sue the school. Enforcement runs through the Department, which conditions federal funding on compliance.2Office of the Law Revision Counsel. 20 USC 1232g – Family Educational Rights and Privacy Loss of funding is rare, but the investigation process itself tends to move schools toward compliance because federal inquiries get attention.
If the verification call itself went wrong, meaning the doctor’s office shared more than you authorized, that is a HIPAA question, not a FERPA question. Complaints about a provider’s disclosure go to the Department of Health and Human Services’ Office for Civil Rights rather than to the Department of Education.