School Mental Health Privacy, FERPA & Information-Sharing Field Guide

Use a five-question privacy check

• 1. What record or information is being requested?
• 2. In what role was it created and who maintains it?
• 3. What is the purpose of the proposed disclosure?
• 4. What authority permits or requires the disclosure — consent, school-official access, emergency exception, mandated reporting, another law, or a defined program agreement?
• 5. What information is actually needed for that purpose, and how will the disclosure be documented when required?

Do not promise absolute confidentiality in a school setting

• Explain confidentiality and its limits in developmentally appropriate language before sensitive work begins.
• Clarify what routine school-team communication may occur under the program's structure and what remains within the clinical relationship.
• Explain safety, abuse/neglect reporting, and other legal exceptions without making students responsible for interpreting the law.
• When family involvement is clinically useful, explain what you hope to share and why instead of surprising the student after the fact when possible.

FERPA health/safety emergency disclosures are case-specific

Federal FERPA guidance permits disclosure without consent when the school determines, based on the totality of circumstances, that there is an articulable and significant threat to the health or safety of a student or others and the recipient needs the information to help protect against that threat. The exception is tied to the emergency; it is not a blanket authorization for routine information sharing.

• Use the actual circumstances and current threat, not a standing assumption that all mental-health information is safety information.
• Share with an appropriate party whose knowledge is necessary to support protection or response.
• Follow the school's documentation requirements for emergency disclosures, including the basis for the disclosure and the recipients when FERPA requires that record.

Threat-assessment and multidisciplinary teams need defined information rules

Outside mental-health or law-enforcement partners may sometimes participate in school threat-assessment teams under FERPA's school-official framework when the regulatory conditions are met. Participation on a team does not make unrestricted redisclosure permissible. The team's written structure should define purpose, access, use, and redisclosure expectations before a live case tests the boundaries.