HIPAA Certification for EdTech Companies

EdTech companies increasingly intersect with healthcare, whether through school nursing portals, student health records, mental health support services, or special education platforms. When educational technology handles student health information on behalf of healthcare providers or schools acting in a healthcare capacity, HIPAA requirements may apply alongside FERPA.

EdTech platforms handling PHI must implement HIPAA safeguards while balancing educational requirements: technical controls protecting health records, administrative policies for staff handling health data, physical security for any on-premise systems, BAAs with school districts or healthcare providers, and careful attention to the FERPA-HIPAA intersection for student health records.

The FERPA-HIPAA overlap creates complexity—school health records may fall under FERPA, while treatment records may fall under HIPAA. Solutions include clearly documenting which regulatory framework applies to each data type, implementing controls that satisfy both regulations, and working with school districts to clarify data governance responsibilities.

HIPAA compliance for EdTech typically takes 4-6 months. Begin by identifying which student data qualifies as PHI, understand the FERPA-HIPAA exclusion rule, implement appropriate technical safeguards, establish BAAs where required, create clear data handling policies for staff, and ensure parental consent mechanisms meet both regulatory frameworks.