Somebody in your building has said the word HIPAA to you. Probably in a hallway, probably as a warning, probably without finishing the sentence. It has become the thing school staff say when they mean be careful what you repeat.
The warning is right. The law is usually wrong, and it matters which one you are actually working under, because the real one is stricter about exactly the situations paraprofessionals find themselves in.
Why does everybody say HIPAA then?
Because it is the privacy law people have heard of. You sign something about it at the dentist. It shows up in the news. So it became the generic word for medical privacy, the way people say Band-Aid for any bandage.
HIPAA covers specific organizations: health plans, health care clearinghouses, and health care providers who send certain information electronically. A public school district is normally none of those. The school is not your student's doctor, and the information you have about that student did not come to you through a medical practice.
So when a colleague tells you HIPAA stops you from mentioning a student's diagnosis in the staff room, the instinct is sound and the citation is off.
What law actually covers what you know?
For a public school, it is FERPA, the federal student records law. And here is the part worth sitting with: for your job, FERPA is the tighter rule, not the looser one.
A student's health information at school is generally part of their education record. FERPA lets school officials see a student's record when they have a legitimate educational interest in it. That phrase is the whole thing. It is not a rank and it is not a clearance. It is a question about the specific piece of information and the specific reason you need it.
Which means the honest test is not whether you are allowed to know something. You already know it, because somebody had to tell you in order for you to do your job. The test is whether this conversation, right now, with this person, is one your knowing it was for.
Does anything about that change at the classroom door?
The parts people get wrong are mostly not about diagnoses. They are about ordinary moments.
A parent catches you at dismissal and asks how another child is doing in the group. A colleague from a different grade asks why that student has an aide. Your own family asks about your day and you have a story that is genuinely remarkable. None of those feel like a records disclosure, and all three are.
The one I would flag hardest is the last one. You are allowed to have a hard job and talk about it. What you are not able to do is hand over the details that identify a child. A story told without the name is often still the story, if the person listening works in your town.
There is also a narrow set of circumstances in which a school's health services do fall under different rules, and some districts take a stricter internal line than federal law requires. That is a question for your supervisor rather than for the internet.
What does this change about tomorrow morning?
One habit, and it is faster than the hesitation it replaces.
Before you answer a question about a student, name who is asking and why they need it. If both halves land, answer. If either one does not, the move is not to refuse, it is to hand it to the person whose answer it is: that is a question for his teacher, let me point you to her.
Nobody has ever been in trouble for that sentence. Plenty of good people have been in trouble for the warm, generous, entirely well meant answer they gave in a parking lot.
The lesson that goes with this has the three questions on one page, a team list to fill in with your teacher, and the exact wording for a parent asking you directly. It is free to watch in the Film Room, no account and no card.
And if you are earlier than that and still working out what the role includes at all, start with what a paraprofessional can and cannot do.