aeh my understanding is that when schools bill only the billing transaction is subject to HIPAA stipulations. It discusses this in the link. I certainly don't see any reason for the school to put the information on a report card but it does not appear that they are doing anything illegal. I know there is a stipulation under FERPA that allows parents to request that special education records be destroyed. If I was really concerned about the records going to the new school, I would get a copy of the records and make a formal request to eliminate the records.
