How to send a speech-language evaluation to a school: HIPAA or FERPA?

A private speech-language pathologist sends an evaluation to a school district with the parent's signed HIPAA authorization. HIPAA covers the pathologist's own copy when the pathologist is a covered entity, and the district's copy becomes an education record under FERPA and IDEA.

Does HIPAA or FERPA apply when a private SLP sends a report to a school?

HIPAA covers a private speech-language pathologist's (SLP's) copy of the report when the SLP is a covered entity, and FERPA and IDEA cover the school district's copy, which becomes an education record. For this purpose a covered entity is a health care provider that sends health information electronically in connection with a covered transaction, such as a claim to a health plan (45 CFR 160.103).

The joint guidance from the Department of Education and HHS, in its December 2019 update, says records a school keeps on children with disabilities, including children referred under IDEA, are education records under both FERPA and IDEA. It adds that in most cases the HIPAA Privacy Rule does not apply to an elementary or secondary school.

The table shows whose copy falls under which law and what it means for the sender.

Do you need the parent's permission to send the evaluation?

The parent's signed HIPAA authorization (45 CFR 164.508) is the safe route for a private pathologist sending an evaluation to a district, because the joint guidance's treatment example is a physician talking to a school nurse who will give the student care, and a district's special education team is not obviously a treatment recipient.

Unless another HIPAA provision permits or requires the disclosure, a covered entity may not disclose protected health information without an authorization that is valid under 164.508 (164.508(a)(1)). A valid authorization names who may receive the information and describes each purpose of the disclosure (164.508(c)(1)). It also carries the redisclosure statement: information disclosed under it may be redisclosed by the recipient and no longer protected by the Privacy Rule (164.508(c)(2)(iii)). What must a HIPAA authorization include? lists the full set.

A parent is generally the child's personal representative under HIPAA unless State or other law says otherwise, which is why the parent signs. Once the district holds the report, IDEA's confidentiality rule governs the district's own disclosures: the school needs parental consent before disclosing personally identifiable information beyond participating agencies, unless the information is in education records and a FERPA exception applies (34 CFR 300.622(a)).

How do you send a speech-language evaluation to a school district?

Sending a speech-language evaluation to a school district takes the parent's signed authorization, a report written to educational impact, a district fax number confirmed with the district and a delivery record filed with the authorization.

1. Get the parent's signed HIPAA authorization that names the district, states the purpose and carries the redisclosure statement.
2. Write the report to educational impact, because IDEA defines a speech or language impairment as a communication disorder, such as stuttering, impaired articulation, a language impairment or a voice impairment, that adversely affects a child's educational performance (34 CFR 300.8(c)(11)).
3. Confirm the district's fax number with the district.
4. Send the report as one fax with a cover sheet.
5. File the delivery record with the authorization.

How long does a school district have to evaluate a child?

A school district must conduct an initial IDEA evaluation within 60 days of receiving the parent's consent, or within the State's timeframe if the State sets one (34 CFR 300.301(c)(1)). Either a parent or the school may ask for the initial evaluation (300.301(b)). Check whether your State sets its own timeframe.

Reevaluation is a separate rule with no day count. A reevaluation may occur no more than once a year unless the parent and the district agree otherwise, and it must occur at least once every 3 years unless they agree it is unnecessary (34 CFR 300.303(b)). A parent or a teacher may request one.

Does the school have to accept an outside speech-language evaluation?

A school district must consider an outside evaluation that the parent shares, if it meets agency criteria, in any decision about the child's free appropriate public education (34 CFR 300.502(c)). The IEP Team reviews evaluations and information the parents provide as part of an evaluation or reevaluation (34 CFR 300.305(a)(1)(i)). What fax service do psychologists use to send evaluation reports? covers both rules.

Do the same rules apply to occupational therapy, psychology, audiology and ABA evaluations?

The same two-law split applies to an evaluation from an occupational therapist, psychologist, audiologist or ABA provider: the provider's copy stays under HIPAA when the provider is a covered entity, and the district's copy is an education record. Speech-language pathologists have their own page, HIPAA compliant fax for speech therapists.

A psychologist's evaluation for an IEP or a 504 plan is covered in the psychologists' post linked above. A student who is 18 or older, or in postsecondary school, falls under FERPA's treatment records rule, which excludes treatment records from education records. Immunization records to a school are a separate job, covered in Can you fax immunization records to a school?

What fax setup suits evaluation reports?

A fax setup for evaluation reports is a HIPAA fax service that signs a BAA, a number the district can fax back to and a delivery record to file with the parent's authorization. Every Fax Pigeon plan includes a BAA signed at signup and delivery proof for each delivered fax, and on a paid plan the practice faxes from its own number, where the district's reply arrives. Cover sheets are optional, and a shared inbox with roles and assignment lets the front desk route that reply.

* Fax Pigeon prices and plan terms as of October 26, 2026. Outside sources were read on October 26, 2026.