You are not required to hand your child’s school a full medical history, but you do have to provide proof of the immunizations your state requires, and you should share any condition the school needs to know about to keep your child safe during the day. Everything beyond that is voluntary. The tradeoff worth understanding before you decide what to disclose: once medical information reaches the school, it becomes an education record under the Family Educational Rights and Privacy Act (FERPA), and FERPA lets the school share it in several situations without asking you again.
What You Actually Have to Provide
Two categories of medical information are effectively mandatory.
The first is immunization records. All 50 states and Washington, D.C. require students to receive certain vaccinations before attending school, and schools collect proof of immunization during enrollment.1National Conference of State Legislatures. State Non-Medical Exemptions From School Immunization Requirements Every state allows medical exemptions for children who cannot safely receive vaccines. Some states also allow religious exemptions, and a few allow personal or philosophical exemptions, but the specifics vary and several states have tightened these rules in recent years. The documentation schools accept also varies: some require a physician’s form, some accept records from a state immunization information system, and some use their own school-specific paperwork.2Centers for Disease Control and Prevention. State School Immunization Requirements and Vaccine Exemption Laws
The second is safety-critical health information. If your child has a severe allergy, asthma, diabetes, epilepsy, or a similar condition that could produce a medical emergency at school, the staff need to know. That information drives real decisions: whether to stock epinephrine auto-injectors, where allergen-free zones sit in the cafeteria, which staff receive training on insulin administration, and who gets called when something goes wrong. Federal law doesn’t hand you a checklist here, but withholding a condition the school realistically needs to manage puts your child at risk and can limit the school’s ability to accommodate them.
Anything outside those two buckets is optional. A past diagnosis your child has moved past, a medication that has no bearing on the school day, a mental health history your child manages with an outside provider — none of that has to go on a school form.
Why Parents Volunteer More Than the Minimum
Schools that know about a student’s health needs can offer targeted accommodations, alert the right staff, and respond faster when something goes wrong. Telling a teacher about a child’s anxiety diagnosis, emailing the principal about a new medication, or completing an optional health questionnaire can genuinely improve the support your child receives.
The catch is that voluntary disclosure creates records the school then has to protect and, in some situations, is allowed to share without asking you.
What Happens to the Information Once the School Has It
Many parents assume the Health Insurance Portability and Accountability Act (HIPAA) governs medical information wherever it sits. It doesn’t. HIPAA’s privacy rule specifically excludes records that qualify as education records under FERPA, and at the K–12 level, health records maintained by the school are education records. That covers immunization forms, allergy documentation, nursing visit logs, and emergency care plans.3National Center for Education Statistics. Health Records – FERPA and HIPAA
HIPAA still applies to your outside pediatrician. If the pediatrician sends records to the school, the doctor’s office follows HIPAA when releasing them. But the moment those records land in the school’s file, FERPA takes over.3National Center for Education Statistics. Health Records – FERPA and HIPAA
Under FERPA, you have three core rights over your child’s records. You can inspect and review them, request corrections to anything inaccurate or misleading, and control most disclosures to outside parties.4Protecting Student Privacy. What Is FERPA When you ask to see the records, the school must respond within 45 days.5eCFR. 34 CFR 99.10 – What Rights Exist for a Parent or Eligible Student to Inspect and Review Education Records
One boundary worth knowing now, before it surprises you later: when your child turns 18 or enrolls in any postsecondary institution at any age, those FERPA rights transfer entirely from you to the student. The school can no longer share records with you without your child’s written consent, even if you are paying tuition or claim them as a tax dependent.6Protecting Student Privacy. Who Is an Eligible Student
Who Inside the School Can See It Without Asking You
FERPA’s default rule requires written parental consent before the school discloses records. The rule has several exceptions, and the one you’ll encounter most often is disclosure to school officials with a legitimate educational interest.
Teachers, administrators, counselors, and other staff who need medical information to do their jobs can receive it without your separate consent. A teacher whose student has a severe peanut allergy has a legitimate educational interest in knowing. So does the coach supervising a student with exercise-induced asthma, and the bus driver responsible for a student with a seizure disorder. The school must define in its annual FERPA notification what counts as a “school official” and what qualifies as a “legitimate educational interest,” and that definition can also cover contractors or volunteers performing services the school would otherwise handle in-house.7Protecting Student Privacy. Under FERPA, May an Educational Agency or Institution Disclose Education Records to Any of Its Employees8Protecting Student Privacy. Who Is a School Official Under FERPA
This exception has a real limit. It authorizes sharing with staff who need the information, not blanket circulation. Every employee in the building does not automatically get a copy of your child’s full health plan.
When the School Can Share It Outside Without Your Consent
Several situations let the school release medical information to people outside the building without going back to you.
Health and safety emergencies. When an emergency threatens a student’s health or safety, the school can disclose relevant information to paramedics, hospital staff, law enforcement, or anyone else who needs it to address the situation. This exception is broad during an active crisis, but it is time-limited and applies only to what’s relevant to the emergency. It doesn’t authorize handing over a student’s entire file. The threat must be real, imminent, or impending — a campus shooting, an outbreak of an epidemic disease, or a natural disaster. Vague concern that a student “might” have a problem later doesn’t qualify.9U.S. Department of Education. When Is It Permissible to Utilize FERPAs Health or Safety Emergency Exception for Disclosures During a disease outbreak, the same exception can let the school share immunization status with public health authorities without asking you first.
Transfer to a new school. When your child enrolls or seeks to enroll somewhere else, the current school can forward records for purposes related to that transfer.
Court orders and subpoenas. Courts can compel the school to disclose records, though the school generally must make a reasonable effort to notify you first.
Certain government authorities. Juvenile justice and child welfare officials may access records when authorized by state statute, and accrediting organizations can receive information tied to their accreditation work.
The full list is codified in federal regulation.10eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required to Disclose Information
Special Education Records Get Extra Protection
If your child receives special education services under the Individuals with Disabilities Education Act (IDEA), medical and psychological information often runs through their evaluations, therapy notes, and Individualized Education Program (IEP). IDEA layers its own confidentiality requirements on top of FERPA, and in several respects goes further.11U.S. Department of Education. Understanding the Confidentiality Requirements Applicable to IDEA Early Childhood Programs Frequently Asked Questions
Any agency that collects, maintains, or uses personally identifiable information about a student with a disability counts as a “participating agency” under IDEA and must follow its confidentiality provisions. Federal guidance directs schools to apply IDEA’s rules first and turn to FERPA for anything IDEA doesn’t specifically address.11U.S. Department of Education. Understanding the Confidentiality Requirements Applicable to IDEA Early Childhood Programs Frequently Asked Questions The practical upshot: information you share as part of the IEP process gets protections at least as strong as FERPA, and often stronger.
Questions to Ask Before You Volunteer Information
A general assurance that “everything stays confidential” is not enough. Before you share anything beyond the minimum, ask the school:
- Who specifically will see this information, and in what role?
- Where will it be stored, and who has access to that system?
- Under what circumstances could you share it without asking me again?
- Will it travel with my child if we move to another school?
- Does our state have privacy protections stronger than the federal baseline?
Some states impose additional privacy protections beyond FERPA, so the answer to that last question can matter. Get the responses in writing when you can.
If the School Mishandles the Information
FERPA does not give you the right to sue the school in court. The Supreme Court confirmed in Gonzaga University v. Doe (2002) that FERPA’s provisions don’t create individually enforceable rights that support a lawsuit. Enforcement runs through the federal government instead.
If you believe the school violated FERPA — a staff member disclosed your child’s medical condition without a lawful basis, the school refused to let you review records, or records were shared with someone who had no legitimate need — you can file a written complaint with the Student Privacy Policy Office at the U.S. Department of Education. The complaint must include specific factual allegations and must be filed within 180 days of the violation or within 180 days of when you learned about it.12Protecting Student Privacy. File a Complaint
The Department recommends trying to resolve the issue directly with the school first, but that step isn’t required.12Protecting Student Privacy. File a Complaint If the Department finds a violation, it can require the school to change its practices, issue a cease and desist order, or in severe cases withhold or terminate federal education funding.13U.S. Department of Education. 34 CFR Part 99 – Family Educational Rights and Privacy Funding is rarely pulled in practice; most complaints end with the school agreeing to change its policies. The complaint still creates a federal record of the violation, which often pushes schools to take privacy more seriously than an informal grievance would.