HIPAA & FERPA Training Module

These are two different laws. They are frequently taught together, and that pairing causes a specific confusion worth clearing up before you start: people come away thinking of “HIPAA-and-FERPA” as one subject. It is not.

HIPAA governs protected health information held by health care providers. It applies to your counseling work here, to every client on your caseload, whether or not that client is a student and whether or not a school is ever involved. Most supervisees at Orchard need HIPAA and nothing else.

FERPA governs education records held by schools. It is not a health privacy law and it does not apply to Orchard’s chart. You need it if your caseload includes students, if you attend school meetings, if you advise families about school records, or if education records are ever sent to you.

They intersect in one situation: when information about a student moves between a clinic and a school. That is a real and consequential situation, and it is covered here as its own topic rather than as a blend of the first two.

By the end of whichever parts apply to you, you should be able to look at a request for information and know three things: which law governs the record, whether you may release it, and what you owe the client either way.

Confirm your pathway with your supervisor before you start. Most supervisees complete Part A only.

1. Read the tab before you take its external training. Each tab gives you the shape of the law so the federal training lands on something rather than washing over you.
2. Complete the external training for each part you are doing. All are free and all are published by the agency that actually enforces the law. Save your completion confirmation or a screenshot of the final screen.
3. Work the “At Orchard” tab. The HIPAA sections apply to everyone. The school-collaboration section belongs to Parts B and C.
4. Co-facilitate the psychoeducational process group. Use the facilitator guide on the “Lead the group” tab. The group is about holding confidences and works whichever pathway you are on.
5. Take the matching assessment sections and bring them to supervision. The assessment is divided into the same three parts. Answer the parts you completed. Your supervisor signs the completion block.

This module is orientation and professional development for supervisees. It is not legal advice, and it does not make you the privacy officer for anything.

• Federal law sets a floor. Georgia law, Virginia law, and the licensing board rules can be more protective, and where they are, the more protective rule governs. When state and federal rules seem to disagree, that is a supervision question, not a judgment call to make alone.
• Substance use disorder records created by a federally assisted SUD program carry a separate and stricter rule (42 CFR Part 2) that is outside the scope of this module. If you encounter one, stop and consult.
• Nothing in this module changes your mandated reporting obligations. Reporting suspected child abuse or neglect under Georgia law is not a privacy violation, and no privacy rule taught here excuses a failure to report.
• When a request arrives and you are not certain, the correct first move is to acknowledge receipt, release nothing, and bring it to your supervisor. Delay is recoverable. Disclosure is not.

This module covers which law governs a record. The Disclosures module covers what you tell a client about all of it — the limits of confidentiality, diagnosis, records requests, and your own supervision status. Complete this one first.

Disclosures module Consent & confidentiality policy

Required of every supervisee. The Health Insurance Portability and Accountability Act, and the Privacy, Security, and Breach Notification Rules written under it.

This part stands on its own. HIPAA governs the counseling work you do here regardless of whether your client is a student, whether a school is involved, or whether you ever encounter an education record. If your caseload is ordinary outpatient counseling, this tab and the HIPAA sections of “At Orchard” are the whole module for you.

HIPAA does not protect “health information” in the abstract. It regulates specific organizations — covered entities — and the vendors who handle information on their behalf, called business associates. A counseling practice that transmits health information electronically in connection with a covered transaction, such as an insurance claim or an eligibility check, is a covered entity. Orchard is one.

What HIPAA protects is protected health information: individually identifiable information about a person’s health, care, or payment for care, held or transmitted by a covered entity or business associate, in any form. Not just the chart. The appointment book, the voicemail, the text thread, the intake spreadsheet, the sticky note with a client’s name and a phone number.

Complete the material below from the U.S. Department of Health and Human Services, Office for Civil Rights, which is the office that writes and enforces the HIPAA Rules. Free, no account required for the core materials.

Orchard’s clients are disproportionately minors, families in crisis, and people whose care is coordinated across providers. These two OCR pages address exactly those situations.

Required if your caseload includes students. The Family Educational Rights and Privacy Act, administered by the U.S. Department of Education’s Student Privacy Policy Office.

FERPA is a separate body of law with its own history, its own enforcing agency, and its own remedies. It is not a health privacy law, it is not a companion statute to HIPAA, and nothing in it governs Orchard’s chart. Learn it as its own subject.

What it governs is education records — records directly related to a student and maintained by a school or by someone acting for the school — held by educational agencies and institutions that receive funding from the U.S. Department of Education. That is essentially every public school district and most colleges and universities.

You need this part if your clients are school-age or enrolled in college, if families ask you about their rights to school records, if a school sends you anything about a student, or if you advise on IEP or Section 504 matters. What happens when material moves between a clinic and a school is a separate topic, covered in Part C.

Complete the modules below from the U.S. Department of Education’s Student Privacy Policy Office and its Privacy Technical Assistance Center. Free, self-paced, interactive.

Our post-secondary clients hold their own FERPA rights, and their parents frequently do not understand that. This module covers that transition directly.

Required if you send records to schools or receive them. Where clinicians most often get this wrong, and why the error is usually invisible until someone asks for the record.

The two statutes were written to fit together, and the joint mechanism is simple once you see it: HIPAA’s definition of protected health information excludes education records covered by FERPA, and excludes postsecondary treatment records. The practical effect is that the same clinical fact is governed by whichever law attaches to the record it is sitting in, held by whoever is holding it.

So a public school district generally is not applying the HIPAA Privacy Rule to its student health records, even when the district employs nurses and counselors, because those records are education records under FERPA. And Orchard’s chart is squarely HIPAA, because we are a covered entity and not a school.

A teacher or counselor wants to know how therapy is going. You have no authorization on file. Confirming that the child is a client is itself a disclosure. The correct answer is that you can neither confirm nor deny, that you would welcome the collaboration, and that you will follow up if and when a release is in place. Then contact the parent.

A family in an eligibility dispute asks you to write that the child “has a disability requiring an IEP.” Eligibility is a team determination made by the school, not by you. You can describe what you have observed and assessed, and you can recommend evaluation. Writing beyond your scope harms the family later, because a letter that overreaches gets discounted entirely.

Access rights for a minor’s record turn on legal custody and on state law, and the HIPAA personal-representative analysis is not the same as the FERPA parent analysis. FERPA generally presumes either parent may access unless a court order says otherwise. Do not release anything on this one without your supervisor and, where relevant, sight of the custody order.

This is the hardest one, and it is a clinical problem before it is a legal one. Whether a minor may consent to their own care, and whether that consent limits parental access, is governed by Georgia law and by the terms of the informed consent you obtained at intake. Know Orchard’s policy before you make a promise to a teenager. A promise you cannot keep does more damage than an honest limit stated at the start.

Orchard-specific expectations. These are practice standards, not suggestions, and your supervisor will hold you to them.

Everyone completes the first three sections below — disclosure, telehealth, and errors. They are HIPAA practice and apply to all supervisees. School meetings belongs to Parts B and C and can be skipped if that is not your caseload.

• Confirm there is a current, signed, specific authorization covering this recipient, this information, and this purpose. Check the expiration date.
• Confirm the person signing had authority to sign — client, eligible student, or personal representative with the legal standing to act.
• Send the minimum that answers the question asked. Not the chart because the chart was easier to attach.
• Document the disclosure: what, to whom, when, under what authority.
• If any of the above is unclear, it goes to supervision before it goes anywhere else.

Do not rely on the client telling you they submitted the form. Confirm the signed release is on file yourself before you make any contact.

Orchard delivers care by telehealth, including to clients located in other states. That raises privacy questions on top of licensure questions.

• Use only the platforms and accounts Orchard has authorized. A platform is not acceptable because it is encrypted; it is acceptable because there is a business associate agreement in place. That is not a distinction you can evaluate on your own.
• Sessions happen in a room with a closed door, alone. Not a car, not a shared office, not a kitchen with family in it.
• Headphones, always. Screen locked when you step away. Never on public wi-fi.
• Client information does not live on a personal device, in personal email, in personal cloud storage, or in a personal notes app. Not even temporarily. Not even to move it somewhere else.
• Confirm at the start of each session where the client is physically located. This matters for licensure, for emergencies, and for who else might be in the room.

• Attend only with a current release naming the school and the purpose. Use the school release form, not the general one.
• Everything you say in an IEP or Section 504 meeting is likely to end up in the education record. Speak accordingly.
• Stay inside your scope: describe what you observed and assessed, recommend, and defer eligibility determinations to the team.
• Ask the family beforehand what they do and do not want shared, and honor that within the limits of honesty. If you cannot honor it, say so before the meeting rather than in it.

Wrong recipient on an email. A document left on a printer. A name said in a hallway. These happen, and they are reportable regardless of whether anyone appears to have been harmed.

• Report to your supervisor the same day. Not after you have investigated. Not after you have tried to recall the message.
• Do not contact the unintended recipient on your own initiative.
• Write down what happened while you still remember it accurately, including times.
• You will not be disciplined for reporting promptly. Concealment is the thing that ends a placement.

A 75-minute psychoeducational process group, co-led by two supervisees for the supervisee cohort. Facilitator guide below.

This is a leadership experience, not a presentation. You will co-facilitate with a peer, and the point is not to teach the regulations — the cohort has already read them. The point is to hold a room while people talk about the discomfort of confidentiality: the pull to reassure a worried parent, the loneliness of carrying something you cannot discuss, the moment you almost said too much.

Psychoeducational process groups are the format Orchard uses with clients constantly. Learning to run one on material you know well, with peers who will be generous with you, is the safest place to develop that skill.

• Whether you established safety early and maintained it under pressure
• Whether you balanced teaching against processing rather than defaulting to lecture
• How you handled the member who dominated, and the member who said nothing
• Whether you and your co-facilitator worked as a pair or took turns
• Whether you closed the group with containment or simply ran out of time

Facilitator Guide (PDF) Facilitator Guide (Word)

Twenty scenario-based items, divided into the same three parts as the module. Answer only the parts you completed.

The assessment is open-book and is meant to be. Nobody wants a clinician who memorized a rule; we want a clinician who knows where to look and who recognizes the moment that requires looking. Several items have more than one defensible answer, and the rationale explains why the keyed answer is the better one.

1. Finish the external trainings and content tabs for your pathway first.
2. Answer the items in the parts you completed, without checking the rationales.
3. Score yourself against the answer key, then read every rationale — including the ones you got right.
4. If you scored below the standard on any part, review that tab and retake that part. Retaking is expected and carries no penalty.
5. Bring the completed assessment to supervision. Discuss any item you found genuinely ambiguous; those are usually the most useful conversations.
6. Your supervisor completes the sign-off block. Keep a copy for your program.

Assessment & Answer Key (PDF) Assessment & Answer Key (Word)

Primary statutory, regulatory, and agency sources for this module. Learners are expected to verify any specific provision against the current text before relying on it in practice; regulations are amended, and this page is not the authority.

• Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g.
• Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936.
• Health Information Technology for Economic and Clinical Health Act, Pub. L. No. 111-5, div. A, tit. XIII, 123 Stat. 226 (2009).
• Individuals with Disabilities Education Act, 20 U.S.C. § 1400 et seq.
• Protection of Pupil Rights Amendment, 20 U.S.C. § 1232h.
• Section 504 of the Rehabilitation Act of 1973, 29 U.S.C. § 794.

• Family Educational Rights and Privacy, 34 C.F.R. pt. 99.
• Assistance to States for the Education of Children with Disabilities: Confidentiality of Information, 34 C.F.R. §§ 300.610–300.627.
• HIPAA Administrative Simplification: General Provisions, 45 C.F.R. pt. 160.
• HIPAA Security and Privacy, 45 C.F.R. pt. 164 (Subpart C, Security Rule; Subpart D, Breach Notification; Subpart E, Privacy Rule).
• Confidentiality of Substance Use Disorder Patient Records, 42 C.F.R. pt. 2.
• Protection of Pupil Rights, 34 C.F.R. pt. 98.

• Centers for Medicare & Medicaid Services. HIPAA basics for providers: HIPAA privacy, security, and breach notification rules (MLN Booklet). U.S. Department of Health and Human Services.
• Office of the National Coordinator for Health Information Technology. Guide to privacy and security of electronic health information. U.S. Department of Health and Human Services. healthit.gov
• U.S. Department of Education, Student Privacy Policy Office. FERPA 101: For local education agencies [Online training module]. studentprivacy.ed.gov
• U.S. Department of Education, Student Privacy Policy Office. FERPA 201: Data sharing under FERPA [Online training module]. studentprivacy.ed.gov
• U.S. Department of Health and Human Services, Office for Civil Rights. HIPAA training and resources. hhs.gov
• U.S. Department of Health and Human Services, Office for Civil Rights. HIPAA privacy rule and sharing information related to mental health. hhs.gov
• U.S. Department of Health and Human Services, Office for Civil Rights. Telehealth and HIPAA. hhs.gov
• U.S. Department of Health and Human Services & U.S. Department of Education. Joint guidance on the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to student health records. hhs.gov

• American Counseling Association. ACA code of ethics (see especially Section B, Confidentiality and Privacy, and Section F, Supervision, Training, and Teaching).
• Council for Accreditation of Counseling and Related Educational Programs. CACREP 2024 standards.
• National Board for Certified Counselors. NBCC code of ethics.

• O.C.G.A. § 19-7-5 (mandated reporting of suspected child abuse).
• O.C.G.A. § 43-10A-1 et seq. (Professional Counselors, Social Workers, and Marriage and Family Therapists Licensing Law).
• Ga. Comp. R. & Regs. ch. 135 (Rules of the Georgia Composite Board of Professional Counselors, Social Workers, and Marriage and Family Therapists).