Summary

This guide breaks down everything EdTech companies need to know about HIPAA, including when it applies, what it requires, and how to build a compliant infrastructure from the ground up. The Security Rule focuses specifically on electronic Protected Health Information (ePHI) and requires three types of safeguards: Achieving HIPAA compliance requires more than signing a BAA. You need a systematic approach to building and maintaining a compliant organization.

HIPAA Complete Guide for EdTech: What Education Technology Companies Need to Know

The intersection of healthcare and education technology is growing rapidly. EdTech platforms increasingly collect sensitive student health data — from mental health apps used by universities to disability accommodation systems and school-based telehealth services. Understanding HIPAA compliance in this context is no longer optional. It’s a legal and ethical necessity.

This guide breaks down everything EdTech companies need to know about HIPAA, including when it applies, what it requires, and how to build a compliant infrastructure from the ground up.

Does HIPAA Apply to EdTech Companies?

This is the first question most EdTech founders and compliance officers ask — and the answer is nuanced.

HIPAA (the Health Insurance Portability and Accountability Act) applies to covered entities and their business associates. Covered entities include healthcare providers, health plans, and healthcare clearinghouses. EdTech companies are not automatically covered entities.

However, HIPAA becomes relevant to your EdTech platform when:

Your platform processes, stores, or transmits Protected Health Information (PHI) on behalf of a covered entity
You partner with school-based health clinics, telehealth providers, or insurance companies
You offer mental health tools, disability management systems, or medical record integrations used by healthcare providers within educational settings
You act as a Business Associate (BA) — meaning you handle PHI for a covered entity under a contract

If any of these apply, you are likely subject to HIPAA requirements and must comply fully.

HIPAA vs. FERPA: Understanding the Overlap

One of the most confusing aspects of EdTech compliance is the relationship between HIPAA and FERPA (the Family Educational Rights and Privacy Act).

When FERPA Takes Precedence

FERPA generally governs student education records, including health records maintained by schools. Under a specific HIPAA exception, school health records that fall under FERPA are excluded from HIPAA coverage. This means a K-12 school nurse’s records are typically FERPA-protected, not HIPAA-protected.

When HIPAA Applies in Educational Settings

HIPAA applies when:

A healthcare provider operates independently within a school (e.g., a contracted telehealth service)
A university health center bills insurance for services rendered
A third-party mental health app integrates with a healthcare provider’s system

Bottom line: If your EdTech platform serves both educational institutions and healthcare providers, you may need to comply with both FERPA and HIPAA simultaneously. Always consult legal counsel to determine which law governs specific data sets.

Core HIPAA Requirements for EdTech Platforms

If HIPAA applies to your EdTech company, you must meet the requirements of three key rules.

1. The Privacy Rule

The Privacy Rule establishes standards for how PHI can be used and disclosed. Key requirements include:

Minimum Necessary Standard: Only access or share the minimum amount of PHI needed for a specific purpose
Patient Rights: Individuals have the right to access, amend, and request restrictions on their PHI
Notice of Privacy Practices: Covered entities must provide clear notices about how health information is used
Authorization Requirements: Most uses of PHI beyond treatment, payment, and operations require written patient authorization

For EdTech companies acting as Business Associates, the Privacy Rule obligations flow through your Business Associate Agreement (BAA) with the covered entity.

2. The Security Rule

The Security Rule focuses specifically on electronic Protected Health Information (ePHI) and requires three types of safeguards:

Administrative Safeguards:

Designate a HIPAA Security Officer
Conduct regular risk assessments
Implement workforce training programs
Develop contingency plans for data breaches

Physical Safeguards:

Control physical access to systems storing ePHI
Implement workstation use policies
Manage device and media controls

Technical Safeguards:

Use access controls and unique user identification
Implement automatic logoff and encryption
Maintain audit logs and activity monitoring
Use transmission security (e.g., TLS encryption)

3. The Breach Notification Rule

If a breach of unsecured PHI occurs, HIPAA mandates specific notification timelines:

Affected individuals: Notify within 60 days of discovering the breach
HHS (Department of Health & Human Services): Report annually for small breaches; within 60 days for breaches affecting 500+ individuals
Media: Required for breaches affecting 500+ individuals in a specific state

Business Associate Agreements: What EdTech Companies Must Know

If your EdTech platform handles PHI on behalf of a covered entity, you must have a signed Business Associate Agreement (BAA) before accessing any PHI.

What a BAA Must Include

A compliant BAA should specify:

Permitted uses and disclosures of PHI by the Business Associate
Obligation to implement safeguards to protect PHI
Requirement to report breaches and security incidents
Subcontractor requirements — your vendors who touch PHI also need BAAs
Return or destruction of PHI upon contract termination
Access rights for the covered entity to audit compliance

Never begin processing PHI without a fully executed BAA. Operating without one exposes both parties to significant regulatory penalties.

Building a HIPAA-Compliant EdTech Infrastructure

Achieving HIPAA compliance requires more than signing a BAA. You need a systematic approach to building and maintaining a compliant organization.

Step 1: Conduct a Risk Assessment

A HIPAA risk assessment identifies vulnerabilities in how your platform creates, receives, maintains, or transmits ePHI. This is not a one-time exercise — it should be conducted:

Before launching any PHI-handling features
Annually as part of ongoing compliance
After significant system changes or incidents

Step 2: Develop Policies and Procedures

Document clear policies covering:

Data access and user authentication
Incident response and breach notification
Employee onboarding and offboarding
Vendor management and subcontractor oversight
Data retention and destruction

Step 3: Train Your Workforce

Every employee who accesses or could potentially access PHI must receive HIPAA training. Training should cover:

What constitutes PHI and ePHI
How to handle and protect health information
How to recognize and report potential breaches
Consequences of non-compliance

Step 4: Implement Technical Controls

From a product development perspective, HIPAA compliance requires:

End-to-end encryption for data in transit and at rest
Role-based access controls (RBAC) to limit PHI access
Multi-factor authentication (MFA) for all users accessing ePHI
Comprehensive audit logging to track all PHI access
Secure APIs with proper authentication tokens

Step 5: Manage Vendors and Subcontractors

Any vendor your EdTech platform uses that touches PHI — cloud storage providers, analytics tools, customer support platforms — must also be HIPAA-compliant and sign a BAA with you. Common compliant vendors include AWS, Google Cloud, and Microsoft Azure, all of which offer BAAs.

HIPAA Penalties: What’s at Stake

Non-compliance can be extraordinarily costly. HIPAA violations are categorized into four tiers:

Tier	Description	Penalty Range
1	Did not know	$100 – $50,000 per violation
2	Reasonable cause	$1,000 – $50,000 per violation
3	Willful neglect (corrected)	$10,000 – $50,000 per violation
4	Willful neglect (not corrected)	$50,000+ per violation

Annual caps can reach $1.9 million per violation category. Criminal charges are also possible in cases of intentional misuse of PHI.

Frequently Asked Questions

Q: Is a student mental health app automatically subject to HIPAA?

Not automatically. If the app is used independently by students without involving a covered entity (like a health insurance provider or licensed clinical provider billing insurance), HIPAA may not apply. However, if the app integrates with a university health center or telehealth provider, HIPAA likely applies. Always assess your specific data flows and partnerships.

Q: Do EdTech companies need a dedicated HIPAA compliance officer?

If HIPAA applies to your organization, yes — the Security Rule requires you to designate a Security Officer, and best practice is to also designate a Privacy Officer. For small companies, one person can hold both roles, but the responsibilities must be clearly assigned and documented.

Q: Can we use Google Workspace or Slack for PHI?

Standard versions of Google Workspace and Slack are not HIPAA-compliant by default. However, both offer enterprise versions with BAAs available. You must sign a BAA with the provider and configure the platform according to HIPAA requirements before using it to communicate or store PHI.

Q: How often do we need to update our HIPAA policies?

At minimum, review and update your HIPAA policies annually or whenever there are significant changes to your technology, operations, or applicable regulations. Document every review, even if no changes are made.

Q: What’s the difference between a HIPAA audit and a risk assessment?

A risk assessment is an internal process you conduct to identify vulnerabilities in your own systems. A HIPAA audit is conducted by HHS or a third-party auditor to verify your compliance. Regular internal risk assessments are the best way to prepare for and avoid the consequences of an external audit.

Start Your HIPAA Compliance Journey the Right Way

Building HIPAA compliance from scratch is time-consuming, complex, and easy to get wrong. Missing a single required policy or using an outdated BAA template can expose your EdTech company to significant legal and financial risk.

Don’t start from a blank page.

Our ready-to-use HIPAA compliance template bundle for EdTech companies includes everything you need to get compliant quickly:

✅ Business Associate Agreement (BAA) template
✅ HIPAA Risk Assessment framework
✅ Privacy and Security Policy templates
✅ Breach Notification procedures
✅ Employee training acknowledgment forms
✅ Vendor management checklists

These templates are drafted by compliance experts, regularly updated to reflect current regulations, and designed specifically for EdTech and SaaS environments.

[Browse HIPAA Compliance Templates →]

Save weeks of legal research and launch your compliant platform with confidence.