Texas FERPA and HIPAA Release for IEP Transition: What Changes at 18

The day your child turns 18, the right to control access to the school records you've accessed freely for years — IEP documents, evaluation reports, progress notes, disciplinary files — transfers to them. Not symbolically. Legally. FERPA rights transfer on their 18th birthday, and without a signed release or another FERPA exception, the school district can refuse to share records with you. If your child also receives medical or therapeutic services, HIPAA creates a separate wall around their health records. For families in the middle of IEP transition planning, this one-two punch can stall the entire process if you aren't prepared.

How FERPA Transfer Works in Texas

The Family Educational Rights and Privacy Act gives parents the right to access their child's educational records throughout K-12. On the student's 18th birthday, FERPA rights transfer to the student, subject to exceptions that can still permit certain disclosures to parents — regardless of who pays for school, who attends ARD meetings, or whether the student has a disability.

In Texas, the school district must notify both the student and the parents about this transfer of rights no later than one year before the student turns 18, per 19 TAC §89.1049. That notice is supposed to include information about alternatives like Supported Decision-Making Agreements and educational representatives. In practice, many families receive a form letter at the student's junior-year ARD and don't grasp the operational impact until the next meeting, when the school says "we need your child's signature, not yours."

Once FERPA rights transfer, the school generally cannot share grades, IEP documents, evaluation results, attendance records, or disciplinary files with a parent unless the student signs a FERPA release or a FERPA exception applies. The release must specify which records are covered, who can access them, and the purpose. A blanket "I consent to share everything with my parents" statement works legally, but many districts use their own forms that expire annually or cover only specific record categories.

The HIPAA Side: Medical and Therapy Records

HIPAA operates independently of FERPA. If your child receives services from a private therapist, psychiatrist, physician, or hospital-based program, those providers are covered by HIPAA — not FERPA — even if the school references their reports in the IEP.

At 18, a HIPAA authorization signed by the adult child is one way a parent can access medical records, therapy notes, or psychiatric evaluations. A parent may also have access when legally recognized as the adult's personal representative under applicable law. Unlike FERPA releases (which can be broad), HIPAA authorizations must describe the information, identify who may disclose it and who may receive it, state the purpose, and include an expiration date or event. Most providers supply their own authorization forms.

The complication during transition is that IEP teams often need medical documentation — evaluations, therapy progress reports, medication records — to write appropriate transition goals. If the now-adult student hasn't signed HIPAA authorizations for each provider, the ARD committee operates with incomplete information. A transition plan built without current medical data is a transition plan built on assumptions.

The Supported Decision-Making Connection

Under Texas's Supported Decision-Making Agreement statute (Estates Code Chapter 1357), an SDM agreement may be accompanied by separate FERPA and HIPAA/confidential-information releases. When a family executes an SDM agreement, they can include a FERPA release allowing the supporter (typically a parent) to access educational records, and a HIPAA release covering medical records.

This is significant because it lets families organize records access alongside decision-support — but it is not one universal signing event covering both domains. The FERPA release and each provider's HIPAA authorization remain separate documents, and providers may require their own forms.

The SDM agreement doesn't replace provider-specific HIPAA forms entirely — some providers require their own paperwork regardless — and families should confirm each school's and provider's requirements.

What to Do Before the 18th Birthday

Start at the student's 17th-birthday ARD meeting, or earlier:

1. Request the district's FERPA release form and review it with your child. Have them sign it at or just after their 18th birthday. Keep a copy.
2. List every medical provider whose records the IEP team uses — therapists, psychiatrists, pediatricians, neurologists. Obtain each provider's HIPAA authorization form.
3. Consider executing an SDM agreement alongside separate FERPA and provider-specific HIPAA releases. The statutory form is free, requires no court involvement, and can be completed with a notary or two witnesses.
4. Bring signed releases to the first post-18 ARD meeting. Schools cannot legally proceed as though nothing changed. Having the releases ready prevents a meeting from stalling on a records access issue.
5. Renew annually if your district's FERPA release has an expiration date. Set a calendar reminder.

When the Student Cannot Provide Informed Consent

If a student's disability is severe enough that they cannot understand what they're signing, FERPA releases and HIPAA authorizations present a genuine problem. A student who lacks the capacity to consent may not be able to execute a valid release.

In that situation, Texas law provides two paths: appointment of an educational representative under Texas Education Code §29.0171 (covers school records only, requires professional certification that the student cannot provide informed consent regarding the educational program), or guardianship through probate court (covers both educational and medical records, but costs $1,500–$5,000+ in legal fees). An SDM agreement is not appropriate here — it requires the adult to have the capacity to voluntarily enter the agreement.

The school district should help families identify the right path during the transfer-of-rights discussion at the age-17 ARD. If the district hasn't raised this, ask directly: "What is the process if my child cannot sign a FERPA release?"

Building Records Access Into the Transition Plan

The Texas IEP Transition to Adulthood Guide includes a records-tracking worksheet that maps every provider, the type of release needed (FERPA or HIPAA), and renewal dates. When you're managing releases across a school district, two therapists, a psychiatrist, and a vocational rehabilitation counselor, a tracking system prevents the gap that silently stalls your child's transition plan.

Records access isn't glamorous transition planning. But it's the infrastructure everything else depends on — and the families who handle it proactively at 17 never find themselves locked out of their own child's ARD meeting at 18.

See more Texas guides →