On this page
HIPAA covers health information held by health plans, health care clearinghouses, health care providers that conduct standard transactions electronically and their business associates; FERPA covers student education records at schools that receive federal Department of Education funds; and GDPR covers personal data of people in the EU and treats health data as a special category (HHS; 34 CFR 99.1; GDPR). HIPAA's own definition of PHI excludes education records covered by FERPA, so most school health records fall under FERPA, not HIPAA (45 CFR 160.103; joint guidance). Curve Compliance, a marketing and website tracking service for healthcare that signs a BAA on every plan, checked each law on eCFR, HHS, the Department of Education and EUR-Lex on November 2, 2026.
Book a call. Running a clinic site with visitors from several states or the EU? Curve Compliance helps with the website tracking side: Curve's consent management applies the right rule for each visitor's region, and Curve strips PHI before data reaches an ad platform while sending conversions server-side. Curve's team does the setup, typically live in about a week. Book a call with Curve.
The three laws at a glance
Each cell links to the law or the agency that wrote it, opened November 2, 2026.
| HIPAA | FERPA | GDPR | |
|---|---|---|---|
| What it is | A US federal law, Public Law 104-191 of 1996 (govinfo); its privacy and security rules are at 45 CFR Parts 160 and 164 (eCFR) | A US federal law at 20 U.S.C. 1232g, with regulations at 34 CFR Part 99 (Department of Education) | EU Regulation 2016/679, which applies from 25 May 2018 (EUR-Lex) |
| Who it covers | Covered entities and their business associates (HHS) | Educational agencies and institutions that receive funds under a Department of Education program (34 CFR 99.1) | Controllers and processors in the EU, and those outside it that offer goods or services to, or monitor, people in the EU (Article 3) |
| What data | Protected health information (PHI) (eCFR) | Education records and personally identifiable information from them (34 CFR 99.3) | Personal data: any information relating to an identified or identifiable person (Article 4) |
| Health data | The core subject | Student health records kept by a FERPA-covered school are education records or treatment records (joint guidance) | A special category: processing is prohibited unless an exception, such as explicit consent, applies (Article 9) |
HIPAA vs FERPA: school health records
The Department of Education describes FERPA this way: “The Family Educational Rights and Privacy Act (FERPA) is a federal law that affords parents the right to have access to their children’s education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records.” It adds: “When a student turns 18 years old, or enters a postsecondary institution at any age, the rights under FERPA transfer from the parents to the student” (Department of Education).
Education records are records “Directly related to a student” and “Maintained by an educational agency or institution or by a party acting for the agency or institution” (34 CFR 99.3). HIPAA steps aside for them. PHI excludes individually identifiable health information “In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g” and in the student treatment records FERPA describes (45 CFR 160.103).
The Department of Education and HHS walk through the common cases in joint guidance, first issued in November 2008 and updated in December 2019 (HHS):
- K-12 schools. Does the HIPAA Privacy Rule apply to an elementary or secondary school? “Generally, no.” Even a school that employs nurses or psychologists “is not generally a HIPAA covered entity because the providers do not engage in any of the covered transactions, such as billing a health plan electronically for their services” (joint guidance).
- Private schools. “In some circumstances a private school would be required to comply with the HIPAA Privacy Rule when it is a HIPAA covered entity and not subject to FERPA because it does not receive funds from the U.S. Department of Education” (joint guidance).
- Campus health clinics. Records on students at clinics run by colleges and universities “will be either education records or treatment records under FERPA, both of which are excluded from coverage under the HIPAA Rules, even if the school is a HIPAA covered entity.” If the institution is a HIPAA covered entity, records on its non-student patients are subject to the HIPAA Rules (joint guidance).
- University hospitals. A hospital that treats people regardless of student status is different: “Assuming the hospital is a HIPAA covered entity, these records are subject to all of the HIPAA Rules, including the HIPAA Privacy Rule” (joint guidance).
HIPAA vs GDPR: health data of EU visitors
HIPAA turns on who holds the data. GDPR turns on whose data it is and where they are. Article 3 says GDPR “applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union,” where the processing relates to offering them goods or services or to “the monitoring of their behaviour as far as their behaviour takes place within the Union” (GDPR).
GDPR defines health data as “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status” (Article 4). Article 9 prohibits processing it unless an exception applies, the first being that “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes” (GDPR). Personal data under GDPR includes identification by “an online identifier,” so a tracking identifier on an EU visitor's device can count as personal data even with no health detail attached (GDPR).
Breach timing differs too. HIPAA requires notice to individuals “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach” (45 CFR 164.404). GDPR asks the controller to notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it” (Article 33).
A US clinic that markets only to US patients is usually thinking about HIPAA and state laws. One that offers telehealth, second opinions or treatment travel to people in the EU, or tracks EU visitors' behaviour, needs to look at Article 3. Which law applies to your site depends on what you offer and to whom, so talk to your counsel. For consent tools, see consent management vs HIPAA authorization and Global Privacy Control on clinic sites.
Where PCI DSS fits for payments
Card payments bring a fourth framework. “The PCI DSS defines security requirements to protect environments where payment account data is stored, processed, or transmitted,” and it “provides a baseline of technical and operational requirements designed to protect payment account data” (PCI Security Standards Council). It applies to “Entities that store, process, or transmit cardholder data (CHD) and/or sensitive authentication data (SAD)” (PCI SSC).
At a covered entity, payment records can also be PHI, because health information includes information about “the past, present, or future payment for the provision of health care to an individual” (45 CFR 160.103). So a clinic's card processing can sit under PCI DSS and HIPAA at once. See HIPAA compliant payment processing.
Which applies to your marketing data
- A US clinic or telehealth brand that bills health plans electronically. HIPAA for PHI, plus any state health privacy law. See the state health privacy laws table.
- A school-based or campus clinic. FERPA for student records; HIPAA for non-student patients if the institution is a covered entity, per the joint guidance above.
- A site that offers services to people in the EU or tracks them there. GDPR under Article 3, on top of HIPAA if you are a covered entity.
- Card payments. PCI DSS through your payment brand or acquirer, and HIPAA for payment records at a covered entity.
Whichever law applies, the same habit lowers risk: keep diagnoses, student records and health details out of what goes to ad platforms. For the HIPAA side in full, see what HIPAA compliance means and what IIHI is.
How Curve Compliance helps
Curve Compliance works on the website tracking side: consent choices by visitor region, and what your site sends to ad platforms. Curve's consent management handles cookie choices on your site. Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok.
Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II and signs a BAA on every plan (BAA Directory entry). Curve's team does the setup, typically live in about a week. To see which trackers your site loads, run the free website scan.
Sources, checked November 2, 2026: Public Law 104-191 (govinfo); 45 CFR 160.103; 45 CFR 164.404; 34 CFR 99.1; 34 CFR 99.3; U.S. Department of Education, What is FERPA?; Department of Education and HHS, Joint Guidance on FERPA and HIPAA (2019); HHS, Joint Guidance page; HHS, Covered Entities and Business Associates; Regulation (EU) 2016/679 (GDPR), EUR-Lex; PCI Security Standards Council, Standards; PCI SSC, PCI DSS.
Frequently Asked Questions
What is the difference between FERPA and HIPAA?
FERPA protects student education records at schools that receive Department of Education funds, while HIPAA protects health information held by covered entities and their business associates (Department of Education; HHS). HIPAA's definition of PHI excludes FERPA education records, so the same school health record is not covered by both (45 CFR 160.103).
Does HIPAA exclude information considered education records under FERPA?
Yes. PHI excludes individually identifiable health information “In education records covered by the Family Educational Rights and Privacy Act” and in FERPA treatment records (45 CFR 160.103; joint guidance).
What is confidential under FERPA?
Education records and the personally identifiable information in them, such as a student's name, a parent's name, an address, a student number, and indirect identifiers like date of birth (34 CFR 99.3). FERPA gives parents, or students once they turn 18 or enter college, some control over disclosure (Department of Education).
Does GDPR apply to a US clinic website?
It can. GDPR reaches controllers outside the EU when they offer goods or services to people in the EU or monitor their behaviour there (Article 3). A site that does neither is mainly a HIPAA and state law question.
Is PCI DSS a law?
PCI DSS is a security standard published by the PCI Security Standards Council (PCI SSC). The Council says whether an entity must comply “is at the discretion of organizations that manage compliance programs, such as a payment brand, acquirer, or other entity” (PCI SSC).
Does HIPAA apply to a school nurse?
Generally not at a K-12 school: the joint guidance says a school that employs nurses is not generally a HIPAA covered entity unless its providers conduct covered transactions such as billing a health plan electronically, and its student health records are FERPA records (joint guidance).
Talk to Curve Compliance
Book a call. Want consent by visitor region and ad tracking that keeps PHI out of ad platforms? Curve Compliance handles consent, strips PHI before data reaches an ad platform, sends conversions server-side and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.