A district-contracted therapist finishes a session with a fourteen-year-old in a converted counseling office at a middle school. The family wants a letter from the clinician on file with the IEP team. The school psychologist wants the clinician's input on the Functional Behavior Assessment. The district's special education director wants Behavior Intervention Plan language for next month's IEP meeting. And the clinician's agency just rolled out an AI scribe under a tidy HIPAA BAA that nobody checked against the district's technology contract requirements. Every one of those routine requests crosses a legal border most clinicians cannot see: the moment clinical information enters a school-held record, it stops being HIPAA-protected health information and becomes a FERPA education record, governed by a different statute, different access rights, and a district Data Processing Agreement the AI vendor never signed. By the end of this lesson you will be able to map the FERPA-versus-HIPAA boundary for every document you touch in school-based work, layer the district DPA on top of the BAA, handle the minor-consent statutes that can make a twelve-year-old, not the parent, the data subject, and hold the hard limit: AI does not draft IEP eligibility determinations and does not opine on educational placement, because those are district decisions.

Two Countries, One Child: The Border in the Middle of the Hallway

Hold this analogy for the whole lesson: school-based mental health work happens on a border between two countries with different laws, and the same document changes citizenship when it crosses. On the clinician's side of the border, records live under HIPAA: the therapy chart is PHI, the parent or the consenting minor controls disclosure through authorizations, the psychotherapy-notes carve-out can apply, and your AI vendor operates under a BAA. On the school's side, records live under FERPA, the Family Educational Rights and Privacy Act: education records belong to a regime where parents (and students at eighteen) hold inspection and amendment rights, where disclosure runs through FERPA's own consent and exception structure, and where your HIPAA paperwork means nothing.

The treacherous part is that the border runs through ordinary workflows. The clinician's letter to the IEP team, the moment the school files it, is an education record under FERPA, accessible to the parent through FERPA's inspection rights and handled under the school's disclosure rules, not the clinic's. The same facts, sitting in the clinician's chart at the agency, are HIPAA. Nothing about the content changed; the holder changed, and the holder determines the regime. Clinicians who learn this late learn it painfully: a document they assumed was clinically confidential turns out to be parent-accessible in the cumulative file, or a disclosure they assumed needed a HIPAA authorization actually needed FERPA handling on the school's side, and the paperwork protects no one.

So the first discipline of school-based AI work is knowing, for every document, which country it will live in before you draft it. The letter the family wants on file with the IEP team is being written for the FERPA side; draft it knowing the parent will read it, the team will rely on it, and it will sit in an education record for years. The session note documenting the same period stays on the HIPAA side, in the clinical chart, under clinical confidentiality. Two documents, two purposes, two regimes, and the AI workflow has to keep them as separate as the law does.

The Three School-Facing Documents and AI's Role in Each

School-based clinical work produces three recurring document types, and each has a defined AI lane. First, the school-facing letter: the clinician's letter to the IEP team that the family wants on file, describing the clinical picture in education-relevant terms, diagnosis where authorized, functional impacts on learning and behavior, and clinical recommendations the team may consider. AI drafts this well from the clinician's outline and the chart, but the drafting prompt must reflect its destination: written for a parent-readable education record, scoped to what the family authorized, free of psychotherapy-note content, and free of any sentence that decides what the school should do, as opposed to what the clinician observes and recommends.

Second, the FBA contribution. The Functional Behavior Assessment is the school's structured analysis of a student's behavior, its antecedents, and its functions, and the clinician is often asked to contribute clinical observations and formulation. AI's lane is assembling the clinician's contribution: organizing observation data the clinician collected, structuring the clinical formulation the clinician authored, and formatting it to the district's FBA template. The line: the FBA's behavioral conclusions and the school-context analysis belong to the school team's process; the clinician contributes clinical input into that process, and the AI drafts only the clinician's contribution, never the assessment's conclusions.

Third, BIP language. The Behavior Intervention Plan in the IEP integrates strategies the team will use, and the clinician's clinical formulation often shapes it: what regulation strategies work in session, what escalation signals look like, what de-escalation approaches the clinician recommends. AI can translate the clinician's formulation into BIP-style language that integrates cleanly with the district's template, without crossing into educational determination. The recurring test for all three documents is the same: does this sentence describe and recommend from clinical expertise, or does it decide an educational question? The first is the clinician's lane and AI may draft it for the clinician's verification and signature; the second belongs to the district, and the hard limit, stated fully in its own section below, keeps both the clinician and the AI out of it.

The District DPA: The Second Contract Your BAA Does Not Replace

Now the procurement trap. Your agency's AI scribe has a BAA, and the BAA is necessary, because your clinical records are PHI. But many school districts require their own Data Processing Agreement, a DPA, from any technology vendor that processes student data, citing student-privacy statutes like California's SOPIPA, the Student Online Personal Information Protection Act, or state equivalents. SOPIPA-style laws regulate operators of online services used for K-12 purposes, restricting targeted advertising, profiling, and secondary use of student data, independent of HIPAA and independent of FERPA. The district's DPA operationalizes those obligations contractually, and districts increasingly maintain approved-vendor lists keyed to signed DPAs.

The consequence for the school-based clinician is a two-contract rule: when your AI tool touches data in contexts the district governs, recordings or documents created on campus under a district contract, student information flowing into school-facing documents, anything the district's technology policies reach, the BAA covers the HIPAA side and the district DPA covers the student-data side, and you may need both. The failure mode is concrete: a contracted therapist runs an ambient scribe during sessions delivered on campus under a district services agreement; the district's contract requires all technology processing student data to appear on the approved list with a signed DPA; the scribe vendor signed a BAA with the agency and nothing with the district. The therapist is now in breach of the services agreement, the district's student-privacy obligations are unmet, and the agency learns about SOPIPA from the district's counsel rather than its own.

The diligence sequence: read the district services agreement's technology and data clauses before deploying any AI tool in school-based work; identify whether the district requires a DPA, an approved-vendor listing, or both; ask the vendor whether it will sign the district's DPA (many education-adjacent vendors will; many clinical scribes have never been asked); and if the vendor will not sign, the tool does not operate in district-governed contexts, whatever the BAA says. Map this in writing, because the same tool can be compliant at the clinic on Tuesday and out of contract at the school on Wednesday.

The same sentence about the same child changes legal citizenship when it crosses from the clinical chart to the school file: the holder, not the content, decides whether HIPAA or FERPA governs.

Minor Consent: When the Twelve-Year-Old Is the Data Subject

The boundary map has a third axis that school-based work cannot dodge: minor-consent statutes. In several states, a minor of a defined age may consent to their own outpatient mental health treatment, and when they do, the confidentiality rights attach to the minor, not the parent. California Family Code §6924 allows a minor twelve or older, meeting the statute's criteria, to consent to outpatient mental health treatment or counseling; New York Mental Hygiene Law §33.21 governs when minors may consent and how parental involvement and access to records operate; Texas Family Code §32.004 defines the narrower circumstances in which a Texas minor may consent to counseling without a parent. These statutes vary significantly, the playbook's standing warning applies with full force, never generalize across jurisdictions, and the variance is exactly why the artifact this lesson builds is jurisdiction-specific.

When a minor consents under such a statute, the parent is not the data subject for that treatment record, and that reshapes everything downstream. The AI consent conversation happens with the minor, in age-appropriate language, because the minor holds the consent rights for the treatment the statute covers. The school-facing letter requires the consenting minor's authorization, and the clinician must think hard before writing anything into a FERPA-side record, because once the letter sits in the education record, FERPA's parent-access rights govern that document even though the underlying treatment is minor-confidential on the HIPAA side. A clinician can breach a minor's statutory confidentiality with a well-meaning letter to the IEP team that the minor never authorized, and no AI tool will catch that error, because it is a legal-architecture error, not a drafting error.

The operational rule for the AI workflow: the client's consent posture, parent-consented or minor-consented under the applicable statute, is a chart-level flag, exactly like the Part 2 flag two lessons ago, and the school-facing document workflow checks it before drafting begins. For a minor-consented client, the prompt template carries a standing constraint: no content leaves the clinical chart for any school-facing document without the minor's documented authorization, scoped to that document. The flag is set by the clinician who verified the statute's application; the AI obeys the flag and never infers consent posture from context.

The Hard Limit: Eligibility and Placement Are District Decisions

State the boundary at full strength: AI does not draft IEP eligibility determinations, and AI does not opine on educational placement, because those are district decisions. Eligibility under IDEA, whether a student qualifies for special education under a category such as Emotional Disturbance, is a determination made by the IEP team through the district's evaluation process, applying educational criteria that are related to but distinct from clinical diagnosis. Placement, where and how the student receives services, is likewise the team's decision under IDEA's least-restrictive-environment framework. The treating clinician contributes clinical information into that process; the clinician does not make the determination, and a clinician who drafts determination language has exceeded the clinical role even before any AI is involved.

The AI version of the error is seductive because the model does not know the difference between describing and deciding. Ask a model to "draft my letter to the IEP team for a student with F41.1 and school refusal," and an unconstrained draft will happily produce "the student meets criteria for special education eligibility under Emotional Disturbance and requires placement in a smaller therapeutic setting." Both clauses are district decisions wearing clinical clothing. The constrained prompt forbids them by name: "Describe diagnosis as authorized, functional impacts observed, and clinical recommendations for the team's consideration. Do not state or imply any conclusion about special education eligibility, IDEA category, or educational placement; those determinations belong to the IEP team." The clinician's verification pass then reads for exactly those sentences, because models regress to the pattern of the documents they were trained on, and the internet is full of advocacy letters that cross the line.

Why does the line matter so much? Three reasons a senior supervisor would give. Legally, eligibility and placement language from a treating clinician invites due-process disputes in which the letter becomes an exhibit and the clinician becomes a witness. Clinically, the treatment relationship is damaged when the clinician becomes a party to an educational dispute rather than the child's therapist; this is the same role-boundary logic the forensic lessons taught. And practically, IEP teams discount letters that overreach: the letter that describes function precisely and recommends humbly is the one the team actually uses. The same discipline applies to 504 plans, the accommodation pathway under Section 504 of the Rehabilitation Act: the clinician describes the impairment and its functional impacts and suggests accommodations for consideration; the 504 team decides.

The School-Based Rollout: Consent, Contracts, and the Document Router

Assemble the deployment pattern for the school-based clinician, the district-contracted therapist, or the school-linked CMHC program. Phase zero, contracts and consent: the district services agreement read for technology clauses; the DPA-versus-BAA map completed per tool; the recording-consent posture resolved for the school setting, recording a minor on campus raises both the minor-consent statute and the district's own policies, and many school-based programs reasonably restrict AI to post-session drafting from clinician dictation rather than in-session recording; and the minor-consent flag built into the chart for every client whose treatment rests on their own consent.

Phase one, the clinical chart side: AI drafts session notes and treatment documentation exactly as the documentation chapters taught, under the BAA, on the HIPAA side of the border, with the clinician verifying and signing. Phase two, the school-facing document workflow, which is this lesson's center: a document router that asks, before any drafting, three questions. Which side of the border will this document live on? Whose authorization does it need, parent or consenting minor, and is it on file and scoped to this document? And which contract covers the tool for this context, BAA alone or BAA plus district DPA? Only then does the constrained prompt run, with the eligibility-and-placement prohibition embedded, and the clinician verifies the draft against the authorization's scope before signing.

Phase three is the collaboration layer: AI-drafted meeting-preparation summaries for the clinician's own use before IEP meetings, organized from the clinical chart; AI-structured FBA contributions and BIP language per the lanes above; and the standing rule that anything the clinician hands the school is treated as crossing the border permanently, drafted for parent eyes, FERPA residence, and years of file life. Train the whole pattern with one scenario: the well-meaning draft letter that says "qualifies for ED eligibility," caught at verification, rewritten into functional description, signed, and filed, because the catch is the competency this lesson exists to build.

The Applied Problem: The FERPA/HIPAA Boundary Map and District DPA Checklist

Your artifact has two pages. Page one is the FERPA/HIPAA Boundary Map for your school-based program: a table of every document type the program produces, session note, treatment plan, school-facing letter, FBA contribution, BIP language, 504 input, attendance-related correspondence, crisis communication, with five columns: where the document lives (clinical chart or school record), governing regime (HIPAA or FERPA once filed), whose authorization moves it across the border (parent or consenting minor under the applicable statute, cited exactly: CA Fam Code §6924, NY MHL §33.21, or TX Family Code §32.004 for the jurisdictions this lesson names, or your state's analogue verified against the statute), which tool may touch it (and under which contract, BAA or BAA plus DPA), and the named verifier who signs.

Page two is the District DPA Checklist: the district services agreement's technology and data clauses summarized with section citations; whether the district requires a DPA, an approved-vendor list, or both; each AI tool in the stack with its BAA status and its DPA status for this district; the vendor's answer, in writing, to "will you sign the district's DPA"; SOPIPA or the state-equivalent statute identified for your state; and the stop rule printed at the bottom: no tool operates in district-governed contexts without the district-required paperwork, regardless of BAA status. Draft both pages with AI from your actual contracts and document inventory, with the standing instruction to mark every legal conclusion [VERIFY] for counsel, because this is the lesson where two statutes' interaction decides who may even read the output.

The verification pass is three-handed. Your compliance lead verifies the contract citations against the actual district agreement. Counsel verifies the minor-consent column against the current statute for your state, not the model's memory of it. And you run the live test: take last month's three school-facing documents, route them through the map, and check whether the authorization, the tool, and the regime columns were honored in fact; every mismatch becomes a workflow fix. Done looks like both pages posted where the school-based team works, the eligibility-and-placement prohibition embedded in every school-facing prompt template, the minor-consent flag live in the chart, and a district relationship in which your program is the contractor that asked about the DPA before the district had to.

Key Takeaways

• School-based mental health work straddles a legal border: clinician-held records are HIPAA PHI, school-held records are FERPA education records, and the same content changes regime when the holder changes. The clinician's letter to the IEP team becomes a FERPA document, parent-accessible and long-lived, the moment the school files it, so every document is drafted knowing which country it will live in.
• The three school-facing document types each have a defined AI lane: the school-facing letter the family wants on file (drafted for parent-readable FERPA residence, scoped to the authorization), the clinician's FBA contribution (clinical observations and formulation only, never the assessment's conclusions), and BIP language that integrates the clinical formulation without crossing into educational determination.
• The district DPA sits on top of the BAA, not instead of it: many districts require their own Data Processing Agreement from any technology vendor processing student data, citing SOPIPA in California or state equivalents, and a scribe that is compliant at the clinic can be out of contract on campus. Read the district agreement's technology clauses first, get the vendor's DPA answer in writing, and apply the stop rule when the answer is no.
• Minor-consent statutes can make the minor, not the parent, the data subject: CA Family Code §6924 (minors twelve and older meeting the statute's criteria), NY MHL §33.21, and TX Family Code §32.004 vary significantly and must be cited and applied jurisdiction-specifically. For a minor-consented client, no content crosses to any school-facing document without the minor's documented, document-scoped authorization, and the consent posture is a chart-level flag the AI obeys and never infers.
• The hard limit: AI does not draft IEP eligibility determinations and does not opine on educational placement; those are district decisions made by the IEP team under IDEA, as is the 504 team's accommodation decision under Section 504. The constrained prompt forbids eligibility, category, and placement conclusions by name, and the clinician's verification pass hunts for exactly those sentences, because unconstrained models reproduce the advocacy letters they were trained on.
• The deployment pattern runs contracts and consent first, the clinical chart second, and the school-facing document router third: which side of the border, whose authorization, which contract covers the tool, then the constrained draft and the scope-checked signature. Recording on campus deserves special caution; post-session drafting from clinician dictation is often the defensible default.
• The deliverable is the two-page FERPA/HIPAA Boundary Map and District DPA Checklist: every document type mapped to its regime, authorization, tool, and verifier; every contract clause cited; every legal conclusion verified by counsel against the current statute; and the live test run on last month's real documents, with every mismatch converted into a workflow fix.