45 CFR § 160.103Student records that are covered by the FERPA are not subject to the privacy rules of HIPPA . Although a school district as such is not generally subject to the privacy rules, some school-based services, such as a school-based health center, may be required to comply with the privacy rules. To the extent a state law provides greater privacy protection than the HIPAA privacy rules, the state law continues to apply and is not preempted by HIPAA.