FERPA, not HIPAA, governs the notes you write in schools

If you contract with a school district as a solo OT or SLP, the session note you write on a Tuesday afternoon is probably not your record. ASHA's practice portal guidance on documentation in schools states that treatment notes and Section 504 plans are school records, and that records belong to the school district or, for a private school, the entity running it. That one fact decides whether the AI note tool on your laptop saves you an evening or creates an unauthorized disclosure.

The pressure to use one is real. The Center for Democracy and Technology (CDT) reported in October 2025 that 57% of teachers used AI for IEP or 504 work in the 2024-25 school year, up from 39% the year before, and that 15% used it to write a full plan, up from 8%. Roughly 7.5 million students received IDEA services in 2022-23, about 15% of public school students, and CDT cites a national survey finding 65% of public schools understaffed in special education. Districts are short of people, contractors fill the gap, and the paperwork arrives with the same deadline as before.

Three records, and only one of them is yours

A school-based caseload generates three different kinds of record, and they do not follow the same law. The first is the education record: session logs, progress notes, evaluation reports and IEP contributions. Per ASHA's guidance, these belong to the district and sit under FERPA (20 U.S.C. 1232g). Parents have the right to inspect them, and ASHA notes that emails and texts containing identifiable student information may count as education records too.

The second is your own private practice record, for the clinic patients you see outside any district contract. That is ordinary HIPAA territory, and the AI scribe questions we have covered before apply directly, including who is entitled to consent to a recording.

The third is the Medicaid billing trail. ASHA's guidance says parental permission is needed before records are sent to Medicaid (34 CFR 99.30), and that once they are sent, the transaction falls under HIPAA. So a single session can create a FERPA record on Monday and a HIPAA record on Friday, with a consent step in between.

So what for you: before choosing any tool, label every document you produce as district record, private record or Medicaid record, because the tool question has a different answer for each.

A signed BAA settles the wrong question

Most of the AI scribe advice written for therapists asks whether the vendor will sign a business associate agreement. That is the right question for your private caseload. For school notes it is the wrong one. A BAA is a HIPAA instrument, and the HIPAA Privacy Rule generally does not apply to health information kept in a student's education record, per a 2023 explainer for school-based therapists from Pink Oatmeal, a secondary source that points back to the federal FERPA and HIPAA joint guidance from the Department of Health and Human Services and the Department of Education. That joint guidance is not itself binding law, so treat the statute and your contract as the authority.

What governs the school note is FERPA, and a BAA does nothing to satisfy it. Our August 2026 consent Q&A reached the same point: FERPA and HIPAA are separate statutes covering separate record categories. A parent saying yes to an AI tool does not replace the district's own approval of that vendor either.

So what for you: if a vendor answers your compliance question with "we sign BAAs", they have answered the private-practice question only.

What the district has to be able to prove

FERPA lets a district share education records with an outside provider without parental consent under the school official exception (34 CFR 99.31(a)(1)). TrueMadeAI's district guide, published 11 August 2026 and citing the regulation text, lists the conditions. The provider must perform an outsourced institutional function. The district must keep direct control over how the provider uses and maintains the records. The provider is bound by FERPA's limits on use and redisclosure (34 CFR 99.33). And the district's annual FERPA notice must cover the criteria for school officials.

You, as a contracted therapist, probably already qualify as a school official under your contract. Your AI vendor is a second step removed. The same guide says a privacy policy the provider can change unilaterally "may be poor evidence of district control," and suggests tests such as whether the district can disable accounts, require return or destruction of data, and enforce remedies after a breach. It also warns that a no-training commitment limits one downstream use only, and does not mean no retention, no human access or no redisclosure. A free consumer account you opened yourself fails every one of those tests, because the district cannot see it, disable it or audit it.

So what for you: ask the district's technology or compliance contact for a written yes or no on the named tool and plan. A verbal "that should be fine" will not help you if a parent files a complaint.

The IEP problem is separate from the privacy problem

Suppose you solve the data question. A second one remains, and it concerns the content. CDT's October 2025 brief argues that AI-generated IEPs copied in full, especially with little editing, likely fail IDEA's requirement that each IEP be a truly individualized document. It also notes the trap in de-identification: strip out the personal details to protect privacy and the model has less student-specific information to work with, so the output drifts toward generic goals.

CDT's testing found ChatGPT first asked for a student's first name and diagnostic results, then later advised using only general descriptions. TCEA's March 2026 guidance makes the practical point that student ID numbers count as personally identifiable information, and that any combination of details specific enough to point to one child is the same problem. Its test is simple: could someone use this prompt to identify a specific student? If yes or maybe, rewrite it.

So what for you: use AI for the parts of a school note that do not need the child (formatting, phrasing, goal-bank structure) and write the individualized present-levels and progress content yourself.

A rule set you can adopt before the next term

The evidence points toward a split workflow, and frankly, if you have no written district approval for any AI tool today, the sensible default is to keep student-identifiable content out of every tool until you do. The split looks like this.

For school notes, use the district's approved system only. If the district has no approved AI tool, dictate or type notes in the district's own platform and use AI only on generic material: a blank template, a goal-wording bank with no names, a parent letter skeleton. For your private caseload, use a scribe with a signed BAA on the exact plan you pay for, as covered in our piece on free scribe tiers and the BAA check. For Medicaid, confirm that parental permission is on file before billing detail leaves the education record.

Two further steps cost almost nothing. Add a line to your next contract renewal asking the district to name its approved AI tools, or to state that there are none. And keep a one-page log of which tool touched which category of document, so a complaint or audit does not become a reconstruction exercise. Our earlier guide to AI and treatment plan documentation covers the Medicare side of the same workflow.

If you want a scored, independent read on which of your workflows can safely use AI and which cannot, the AI Opportunity and Growth Assessment maps this by record type, and you can start with a free 20-minute discovery call.

So what for you: you do not need to stay out of AI. You need to know, document by document, whose record you are holding, and that clarity is what lets a cautious practice set the pace instead of reacting.

Frequently asked questions

Does HIPAA apply to my school-based OT or SLP notes? Usually not. Health information kept in a student's education record falls under FERPA, and the HIPAA Privacy Rule generally does not apply to it. Check your district contract, because notes you keep in a separate private practice record may be treated differently.

Can I paste a student's session notes into ChatGPT or another AI tool? Not unless the district has approved that specific tool for student data. Under FERPA's school official exception, the district must keep direct control of the vendor, so a consumer account you opened yourself generally does not qualify.

Does a BAA make an AI scribe safe for school sessions? No. A business associate agreement is a HIPAA instrument. For records held under FERPA, the district's own data-sharing approval is what counts, and a parent's willingness to consent does not replace it.

Can I use AI to draft IEP goals? You can use it for generic wording with no student information, then individualize by hand. The Center for Democracy and Technology (October 2025) warns that fully copied AI-generated IEPs may fail IDEA's requirement of a truly individualized document.

Sources: ASHA Practice Portal, Documentation in Schools (undated); Center for Democracy and Technology, "From Personalized to Programmed", October 2025; TrueMadeAI, "FERPA and AI in K-12 Schools: A District Guide", 11 August 2026 (vendor publication, cites 34 CFR 99.31, 99.33, 99.7); TCEA TechNotes, 12 March 2026; Pink Oatmeal, 20 April 2023 (secondary source). This article is general information, not legal or clinical advice. State law, your district contract and your district's policies vary, so confirm before acting.

See also: who can consent to an AI recording in home and school sessions.

Related: Who can consent to an AI scribe recording · Free AI scribe tiers rarely include a BAA · AI and OT/SLT treatment plan documentation