What Privacy Laws Actually Say: HIPAA, FERPA, ADA—and the Myths That Block Inclusion
We hear it all the time:
“Sorry, we can’t give you that information. It’s HIPAA.”
“We can’t let the students exchange numbers. It’s FERPA.”
“We’d love to include your child in after-school activities, but...”
HIPAA doesn’t govern schools.
FERPA protects records, not relationships.
And ADA requires access—not avoidance.
Here’s what these laws actually say—and how they’re misunderstood in ways that fuel ableism and exclusion.
HIPAA: The Law That Doesn’t Even Apply to Schools
What HIPAA does:
Protects health information held by health care providers, insurers, and health plans.
What HIPAA does not apply to:
K–12 schools
Teachers
School districts
Students communicating with each other
Peer-to-peer interaction or access support
“Most schools are not covered by HIPAA because they do not provide health care services as covered entities.”
— U.S. Department of Health and Human Services (HHS)
“In general, the HIPAA Privacy Rule does not apply to elementary or secondary schools.”
If a school says it’s “HIPAA” preventing name sharing or support planning—they’re misapplying the law.
FERPA: The Law That Protects Records—Not Relationships
What FERPA does:
Protects access to and disclosure of educational records like transcripts, IEPs, and disciplinary history.
What FERPA does not do:
Ban students from knowing each other’s names
Prevent kids from exchanging phone numbers or contact info
Stop families from talking to each other about shared experiences
Justify isolation or exclusion
“FERPA applies to the privacy of education records. It does not prevent students or parents from exchanging information with each other.”
— U.S. Department of Education – FERPA FAQ
“FERPA does not prohibit a school from identifying a student as having a disability when it is necessary for health or safety, or for the provision of services.”
Bottom line: FERPA guards what’s in the file—not who your child is allowed to talk to.
ADA: The Law That Demands Equal Access
The Americans with Disabilities Act (ADA) and Section 504 of the Rehabilitation Act require schools to provide equal opportunity for students with disabilities—including in nonacademic and extracurricular settings.
This includes:
After-school programs
Sports teams
Field trips
Clubs
Peer mentoring
Any service or activity available to nondisabled students
“Students with disabilities must be afforded an equal opportunity to participate in nonacademic and extracurricular services and activities.”
“A recipient may not, on the basis of disability, deny a qualified student with a disability the opportunity to participate in or benefit from an aid, benefit, or service.”
ADA is a civil rights law. “Privacy” is not a valid excuse to deny access, support, or friendship.
So Why Are These Laws Misused So Often?
Most of the time, it’s not malice—it’s confusion. But that confusion causes real harm.
Schools and districts may invoke privacy laws:
To avoid liability
Because staff lack training on inclusion law
As a default “no” in place of real planning
Out of fear of “doing it wrong”
When “privacy” becomes a reason to withhold support, deny friendships, or block participation?
That’s not safety.
That’s ableism wearing a badge of legalese.
Summary: The Law Is Not the Problem. Misuse Is.
❌ "It's HIPPA."
✅ HIPAA doesn’t apply to schools.
📎 Legal source: HHS.gov
❌ "FERPA doesn't allow that."
✅ FERPA protects records. Not peer interaction or relationships.
📎 Legal source: DOE FERPA FAQ
❌ “We can’t. It would disclose their disability.”
✅ ADA requires inclusion. Denying access = discrimination.
📎 Legal source: OCR Guidance
❌ “Legally, our hands are tied.”
✅ The law actually mandates equal opportunity and support.
📎 Legal source: 34 CFR § 104.4
Final Word: Privacy Law Should Never Be Used to Isolate Kids
HIPAA was made for hospitals—not school hallways.
FERPA protects files—not friendships.
ADA exists to open doors, not excuse institutions from building ramps.
So the next time someone cites “privacy” as a reason to block connection, limit participation, or deny support, ask for the policy in writing. Ask which law it references. Ask what statute backs the decision.
Because inclusion is a civil right—not a loophole.
And our kids deserve better than acronym armor masking exclusion.