Sports medicine event coverage documentation away from the clinic
Care delivered at an event generates records under time pressure, on personal devices, sometimes for people who are not your patients. Which rules apply is genuinely less obvious than it looks.
Sports medicine event coverage documentation is governed by who holds the record and in what capacity, not by where the care happened. In school and collegiate settings, athletic training records are frequently FERPA education records, which are expressly excluded from the HIPAA definition of protected health information.
The most common statement made about sideline documentation is that everything an athletic trainer writes is HIPAA data. It frequently is not.
That is not a loophole or a technicality. It is a definitional carve-out written into the Privacy Rule, and getting it wrong in either direction causes real problems: withholding records that should be shared, or sharing records that should not be.
Which rulebook applies is the first question, and it is answerable before the season starts rather than during an incident.
Whether it is a HIPAA record at all
Start here, because everything downstream depends on the answer and most practices assume it.
HHS’s summary of the HIPAA Privacy Rule states that every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions is a covered entity. Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate, in any form or media, electronic, paper or oral.
Two exclusions matter here. Employment records held by a covered entity in its capacity as employer are excluded, and so are education records covered by the Family Educational Rights and Privacy Act.
That second exclusion is the one that catches people. The joint HHS and Department of Education guidance states that the HIPAA Privacy Rule specifically excludes from its coverage those records protected by FERPA, by excluding such records from the definition of protected health information, and that a school would not be required to comply with the Privacy Rule if it only maintains health information in FERPA education records.
- Location is irrelevant. A sideline is not a HIPAA-free zone, and a school athletic training room is not automatically a HIPAA space either. What governs is who holds the record and in what capacity.
Education records, and why the distinction is not academic
It is worth being concrete about what turns on this, because it is not paperwork.
If a record is a FERPA education record, the access, amendment and disclosure rules are FERPA’s, which are different from HIPAA’s in who may see the record, what a parent may demand, and what consent looks like. If the record is PHI, HIPAA’s rules apply instead. The two regimes do not produce the same answer to “may the coach see this”.
The joint guidance also notes that if a school that is a health care provider transmits any PHI electronically in connection with a transaction for which a standard has been adopted, it becomes a covered entity. So the answer can change based on billing behaviour, which is an unintuitive but real dependency.
For a private practice contracted to cover a school’s events, the question is usually which organisation’s record the note becomes. That should be settled in the contract before the first fixture, not inferred afterwards, and it is the kind of thing that belongs alongside HIPAA compliance work rather than in a clinical conversation.
Mobile device safeguards, where the record is actually made
Wherever the record lands, it is usually made on a phone or a tablet, and there is federal guidance on exactly that. The Security Rule’s technical safeguards at 45 CFR 164.312 apply to whatever device holds it, which for this specialty is frequently a device nobody enrolled.
HHS’s guidance on remote use and access organises the risk into accessing, storing and transmitting, and names specific strategies for each: two-factor authentication for remote access, session termination on inactive portable devices, encryption of appropriate strength on portable or remote devices that store such data, password protection on all portable or remote devices, a record of the movements of and persons responsible for hardware and media, backup processes for information entered into remote systems, and prohibiting transmission over open networks where appropriate.
One caveat on currency: that guidance is from 2006. Its substance holds and it remains HHS’s published position, but it predates the devices everybody now uses, and reading it as the newest word would be a mistake.
HHS has separately confirmed that mobile devices may be used to access such data in a cloud, provided appropriate physical, administrative and technical safeguards are in place and appropriate agreements exist with any third-party service provider for the device or the cloud that will have access.
Covering events with no settled answer on whose record it is?
We work through custody, the device safeguards that apply either way, and what your contracts should say. Written findings, no obligation.
Emergency action plans, and what no federal source says
Worth being honest here, because the confident version of this is not sourced.
There is no federal source that enumerates the components of an emergency action plan for athletic events. What exists is institutional and professional-society material. A publicly posted university plan, for example, sets out five components: emergency personnel, emergency communication, emergency equipment, roles of the first responder, and venue directions with a map.
That is a sensible structure and it is not a federal requirement, and anybody presenting it as one is overstating it. What is well supported is the underlying risk: NIH’s National Heart, Lung, and Blood Institute reports that each year more than 350,000 people have an out-of-hospital cardiac arrest, that roughly 1 in 50,000 to 1 in 80,000 young athletes die from the condition, and that if intervention does not happen soon enough, most often with CPR or a defibrillator, the condition usually causes death within minutes.
Record custody, settled before the season
The practical version of all of the above is a short conversation held early.
- Establish whose record it is. In the contract, before the first event.
- Do not assume HIPAA. FERPA records are excluded from PHI by definition.
- Apply the device safeguards regardless. Both regimes expect care.
- Do not cite an EAP standard as federal. There is not one.
Qventive works as a sports medicine event coverage documentation consultant for New Jersey practices, usually within IT support for sports medicine practices rather than as a standalone engagement.
Where documentation depends on mobile configuration or on access from outside the practice, that work runs through sports medicine EHR and IT support and managed IT support.
Event coverage: common questions
Is a sideline note HIPAA protected?
Why does the FERPA distinction actually matter?
What safeguards apply to documenting on a phone?
What are the HIPAA implications of personal devices at events?
Is there a required format for an emergency action plan?
Let’s meet
Qventive supports sports medicine practices across New Jersey. Thirty years healthcare-exclusive, from our office in Hackensack.
- Protected health information is individually identifiable health information held or transmitted by a covered entity in any form or media; employment and FERPA education records excluded. hhs.gov
- The HIPAA Privacy Rule specifically excludes from its coverage those records protected by FERPA by excluding such records from the definition of protected health information. hhs.gov
- Remote use strategies including two-factor authentication, session termination, encryption on portable devices and media movement records. hhs.gov
- More than 350,000 out-of-hospital cardiac arrests each year; about 1 in 50,000 to 1 in 80,000 young athletes die from the condition. nhlbi.nih.gov