For years, the education sector has operated on the belief that FERPA (Family Educational Rights and Privacy Act) is the only law that matters when it comes to student data. And for much of the traditional classroom environment, that’s true. But the moment health-related services intersect with educational technology—whether through telehealth platforms, mental health apps, or digital IEP tools the ground shifts. Suddenly, the boundary between FERPA and HIPAA isn’t just academic. It’s operational, legal, and reputational.