Summary

FERPA typically governs student records maintained by educational institutions, and in many cases FERPA — not HIPAA — is the primary regulation. However, if your EdTech platform works with covered entities or handles clinical health data outside the school record context, HIPAA compliance becomes mandatory. - [ ] Assess whether any school district or healthcare partner requires a Business Associate Agreement (BAA) HIPAA’s Security Rule requires a thorough and accurate assessment of potential risks to PHI. This isn’t optional — it’s a foundational requirement.

HIPAA Checklist for EdTech: What Education Technology Companies Need to Know

Educational technology platforms are collecting more student data than ever before — from learning analytics and behavioral assessments to mental health screenings and disability accommodations. When that data crosses into protected health information (PHI), HIPAA enters the picture. For EdTech companies, understanding when HIPAA applies and how to stay compliant can mean the difference between building trust with school partners and facing significant regulatory penalties.

This comprehensive HIPAA checklist for EdTech will walk you through the key requirements, common pitfalls, and practical steps your organization needs to take.

Does HIPAA Actually Apply to EdTech Companies?

This is where many EdTech companies get confused — and sometimes dangerously overconfident. HIPAA and FERPA (the Family Educational Rights and Privacy Act) often overlap in the education space, but they are not the same law.

HIPAA applies to EdTech when your platform:

Provides telehealth, mental health counseling, or therapy services to students
Integrates with healthcare providers or school-based health clinics
Stores or processes health records on behalf of covered entities (like hospital-affiliated school programs)
Acts as a Business Associate to a HIPAA-covered entity

When in doubt, consult legal counsel to determine which regulation governs your specific data flows.

HIPAA Checklist for EdTech Companies

Use this checklist as a starting framework. Every organization’s situation is unique, so tailor these steps to your specific platform and data practices.

1. Determine Your HIPAA Status

[ ] Identify whether your company is a Covered Entity or a Business Associate
[ ] Review all data flows to determine if you create, receive, maintain, or transmit PHI
[ ] Assess whether any school district or healthcare partner requires a Business Associate Agreement (BAA)
[ ] Document your legal basis for handling health-related student data

2. Conduct a Risk Analysis

HIPAA’s Security Rule requires a thorough and accurate assessment of potential risks to PHI. This isn’t optional — it’s a foundational requirement.

[ ] Identify all systems and locations where PHI is stored or transmitted
[ ] Assess the likelihood and impact of potential threats (cyberattacks, insider threats, accidental disclosure)
[ ] Document vulnerabilities in your current technical and administrative controls
[ ] Prioritize risks and create a remediation plan
[ ] Review and update your risk analysis at least annually or after significant changes

3. Implement Administrative Safeguards

[ ] Designate a HIPAA Privacy Officer and a Security Officer (can be the same person in smaller organizations)
[ ] Develop and implement written HIPAA policies and procedures
[ ] Conduct workforce training on HIPAA requirements at the time of hire and annually thereafter
[ ] Establish access management policies — employees should only access PHI necessary for their job function (minimum necessary standard)
[ ] Create a sanctions policy for employees who violate HIPAA rules
[ ] Implement procedures for managing Business Associate Agreements with vendors and partners

4. Implement Physical Safeguards

Even in cloud-based EdTech environments, physical safeguards matter.

[ ] Control physical access to servers, workstations, and devices that store PHI
[ ] Implement workstation use policies (screen locks, clean desk policies)
[ ] Establish device and media disposal procedures (secure wiping, physical destruction)
[ ] Document policies for mobile device use, including BYOD scenarios
[ ] Restrict unauthorized physical access to data centers or office areas containing PHI

5. Implement Technical Safeguards

This is often where EdTech platforms have the most work to do.

[ ] Implement role-based access controls (RBAC) with unique user IDs
[ ] Enable automatic logoff for inactive sessions
[ ] Use encryption for PHI at rest and in transit (TLS 1.2 or higher for data in transit; AES-256 for data at rest)
[ ] Implement audit logging to track access to and modifications of PHI
[ ] Deploy multi-factor authentication (MFA) for all systems accessing PHI
[ ] Conduct regular vulnerability scans and penetration testing
[ ] Maintain an incident response plan for potential breaches

6. Execute Business Associate Agreements (BAAs)

If your EdTech platform handles PHI on behalf of a covered entity, a signed BAA is legally required.

[ ] Identify all covered entity partners who require a BAA
[ ] Ensure BAAs include all required HIPAA provisions (permitted uses, safeguard requirements, breach notification obligations)
[ ] Maintain a BAA tracking log with expiration dates and renewal reminders
[ ] Extend BAA requirements to your own subcontractors who may access PHI
[ ] Review BAAs when partnerships change or services expand

7. Establish Breach Notification Procedures

HIPAA’s Breach Notification Rule requires prompt action when PHI is improperly disclosed.

[ ] Define what constitutes a reportable breach vs. a security incident
[ ] Document your breach notification timeline:
- Notify affected individuals within 60 days of discovery
- Notify the HHS Office for Civil Rights (OCR) within 60 days for breaches affecting 500+ individuals; annually for smaller breaches
- Notify prominent media outlets for breaches affecting 500+ residents in a state
[ ] Assign responsibility for breach investigation and notification
[ ] Maintain breach logs and documentation for at least 6 years

8. Manage Patient/User Rights

Even in EdTech contexts where HIPAA applies, individuals retain rights over their PHI.

[ ] Implement processes to fulfill access requests (individuals can request copies of their PHI)
[ ] Establish procedures for amendment requests (correcting inaccurate PHI)
[ ] Honor accounting of disclosures requests
[ ] Maintain a Notice of Privacy Practices (NPP) and make it readily available
[ ] Process restriction requests in a timely manner

Common HIPAA Mistakes EdTech Companies Make

Understanding what not to do is just as important as knowing the requirements.

Assuming FERPA exempts you from HIPAA. These laws can apply simultaneously. Don’t assume one automatically displaces the other without legal analysis.

Skipping the risk analysis. OCR consistently cites failure to conduct a proper risk analysis as a top HIPAA violation. This document is your compliance foundation.

Neglecting Business Associate Agreements with SaaS vendors. If you use third-party cloud services, analytics tools, or communication platforms that touch PHI, those vendors need signed BAAs.

Undertrained staff. A single uninformed employee can create a reportable breach. Annual training isn’t a checkbox — it’s a genuine risk mitigation strategy.

Treating compliance as a one-time project. HIPAA compliance is ongoing. Technology changes, partnerships evolve, and regulations get updated. Build compliance into your operational rhythm.

FAQ: HIPAA Compliance for EdTech

Is HIPAA or FERPA more relevant for EdTech companies?

It depends on your specific services and data flows. FERPA typically governs student education records held by schools, while HIPAA governs PHI held by covered entities and their business associates. Many EdTech platforms primarily fall under FERPA, but if you offer health-related services (like telehealth or mental health support) or work directly with healthcare providers, HIPAA likely applies as well.

Do school counseling records fall under HIPAA?

Generally, no. Records created and maintained by school counselors as part of the student’s educational record are typically governed by FERPA, not HIPAA. However, if your EdTech platform connects students with outside licensed therapists or healthcare providers, those records may be subject to HIPAA.

What happens if an EdTech company violates HIPAA?

Penalties range from $100 to $50,000 per violation (up to $1.9 million per violation category per year), depending on the level of negligence. Willful neglect that is not corrected can result in criminal referrals. Beyond financial penalties, a breach can cause significant reputational damage and loss of school district contracts.

Does a HIPAA-compliant cloud provider mean my EdTech platform is HIPAA compliant?

No. Using a HIPAA-compliant cloud provider (like AWS or Google Cloud with a signed BAA) is one piece of the puzzle, but your application-level controls, policies, training, and procedures must also meet HIPAA standards. Compliance is your responsibility, not just your vendor’s.

How often should EdTech companies update their HIPAA policies?

At minimum, review your policies annually. You should also trigger a review whenever you launch new features that handle health data, onboard new covered entity partners, experience a security incident, or when HHS issues new guidance.

Build Your HIPAA Compliance Program Faster

Working through HIPAA compliance from scratch is time-consuming, complex, and easy to get wrong. Missing a single required policy or overlooking a BAA requirement can expose your EdTech company to significant legal and financial risk.

That’s where our ready-to-use compliance templates come in.

Our HIPAA compliance template bundle for EdTech companies includes:

HIPAA Risk Analysis Template — pre-structured to meet OCR requirements
Privacy and Security Policies — customizable for EdTech environments
Business Associate Agreement Template — attorney-reviewed and HIPAA-compliant
Employee Training Acknowledgment Forms
Breach Notification Procedures and Log Templates
Notice of Privacy Practices (NPP) Template

These templates are designed by compliance professionals who understand the unique intersection of education technology and healthcare privacy law. Download them today, customize them for your platform, and build a defensible compliance program in a fraction of the time.

[Browse HIPAA Compliance Templates for EdTech →]

Stop guessing and start building compliance with confidence.