EHR for University Research and Teaching Clinics 2027: Supervision, FERPA and Research Data

A university clinic is rarely just a clinic. The same building may train students, serve the public or the student body, and feed data into faculty research, often on a department budget. An EHR for university research and teaching clinics has to support all three jobs at once: trainees write notes that a licensed supervisor signs off, students see only what their role allows, and any research use of the records runs through consent, an IRB and the right privacy law. This guide covers what to look for, where FERPA and HIPAA split, and how to keep costs within reach.

Quick Answer

A university teaching or research clinic needs an EHR with supervised documentation (trainees sign, a named supervisor countersigns before the note is final), role-based access that limits students to the patients and pages they need, an audit trail, and a clean path for research: electronic consent and HIPAA authorization, participant tracking and de-identified export. Which privacy law applies depends on who the clinic serves: records of a campus clinic that treats only its own students are generally covered by FERPA rather than HIPAA, while a teaching clinic open to the public is usually a HIPAA covered entity. Confirm your clinic's status with your institution's counsel. Budget matters too: free tiers exist, but signed and locked notes, co-signature and audit trails usually sit on a paid plan.

Note: This guide is educational, not legal advice. For the student health center market specifically, see our comparison of the Top 5 EHR for College & University Health Centers 2027.

What Kinds of University Clinics Need an EHR?

"University clinic" covers very different operations. A student-run free clinic staffed by medical students on Saturday mornings has little in common with a psychology department training clinic that bills insurance, or with a research clinic that runs sponsored trials. The right EHR depends on which of these you are, and many clinics are more than one.

Start by writing down which rows apply to you. A counseling training clinic that also recruits clients into a faculty study needs the teaching row and the research row, and its privacy analysis may differ from the campus counseling center down the hall.

How Should Trainee Notes Be Supervised and Co-Signed?

In a teaching clinic the note has two owners: the trainee who saw the patient and wrote it, and the licensed supervisor who is responsible for the care. Licensing boards, accreditors and payers each have their own rules about what a supervisor must review and sign, and those rules differ by profession and state. The EHR's job is to make the supervision visible and impossible to skip.

Look for four things:

• A named supervisor for each trainee. The relationship should be set up when the trainee joins, so the system knows whose notes go to whom without anyone remembering to forward them.
• A clear status for unfinished notes. A note signed by a trainee but not yet reviewed should look different from a final note, and should not be treated as final until the supervisor signs.
• A queue for the supervisor. Faculty supervising several students need one place that lists everything waiting for their signature, not a search through the day's charts.
• Sign and lock. Once the supervisor countersigns, the note should become read-only, with any later change recorded as an addendum or an unlock that requires re-signing.

Think through the edge cases before you choose. What happens when a supervisor is away and a colleague covers? What happens when a student leaves mid-term with notes still waiting? If a trainee picks the wrong supervisor when signing, can the note be redirected? The best time to answer these questions is during a demo, with your own clinic's workflow in mind.

Supervision is also a training record. Counseling and social work trainees, for example, often need to document supervised hours toward licensure. The EHR will not replace a supervision log, but a clean record of which notes each supervisor reviewed makes that log easier to keep. Our counselor licensure guide covers the hours side.

How Should You Set Up Access for Students, Residents and Faculty?

Students rotate. A clinic may onboard a new cohort every semester and lose the previous one in the same week. Access control in a teaching clinic has to be quick to grant, quick to remove, and narrow by default.

A practical model:

1. Give each person their own account. Shared logins make an audit trail meaningless and break any signature requirement.
2. Start from the role, then narrow. A first-year student observer does not need billing, reports or the full patient list. A second-year clinician-in-training may need the charts of their assigned clients only.
3. Assign patients to the people caring for them. Restricting a record to its care team keeps classmates out of each other's cases, which matters in a small program where students may know the patients socially.
4. Allow emergency access with a reason. Someone who needs a record to provide care should be able to get it, with the access logged and time-limited.
5. Protect sensitive notes. Behavioral health, substance use and reproductive health records may need tighter limits than the rest of the chart.
6. Require multi-factor sign-in for anyone with clinical access, including students.
7. Remove access on the last day. Build removal into your end-of-term checklist, and review who still has access at least each term.

Faculty often wear two hats: some supervise only, while others also see their own patients. Check how the EHR prices each kind of account, because a department with ten supervising faculty and four practicing clinicians should not be paying for fourteen full clinician seats if it does not have to.

FERPA or HIPAA: Which Applies When Students Are the Patients?

This is the question university clinics get wrong most often, and the answer depends on the facts of your clinic. Two federal laws are in play. The Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. 1232g and 34 CFR Part 99) protects education records at schools that receive U.S. Department of Education funding. The HIPAA Privacy Rule protects health information held by covered entities: health plans, clearinghouses and health care providers that conduct standard electronic transactions such as insurance billing.

The HIPAA Privacy Rule excludes education records and "treatment records" covered by FERPA from its definition of protected health information. The joint guidance from HHS and the Department of Education, Joint Guidance on the Application of FERPA and HIPAA to Student Health Records, explains the practical result. At a postsecondary institution, records that a campus clinic makes about its students, used only for their treatment, are generally treatment records under FERPA rather than PHI under HIPAA, even if the clinic bills insurance electronically.

The picture changes when the clinic serves people who are not students. A university teaching clinic open to the public, a faculty practice, or a hospital affiliated with the university is typically a HIPAA covered entity for those patients. Some institutions operate as hybrid entities, with HIPAA applying to some units and FERPA to others. And a student who is seen at a university hospital as a member of the public may have their records covered by HIPAA, not FERPA.

A few practical consequences:

• Know which law governs each population your clinic serves, and write it down in your privacy policies.
• If a student is also a research participant, the research consent and any HIPAA authorization or FERPA consent must match the law that actually applies to the records you plan to use.
• Treat both sets of records as confidential. FERPA status does not mean fewer safeguards; your EHR should still have access control, an audit trail and a signed agreement with the vendor.

This is general information, not a legal opinion. Check with your institution's counsel and privacy office. For a deeper comparison, see FERPA vs HIPAA for student health records.

Can University Clinic Data Be Used for Research?

Often, yes, but not by default. A teaching clinic's records are attractive to faculty researchers: a steady patient population, standardized measures collected at every session, and documentation already structured by the training program. Before anyone pulls data for a study, three questions need answers.

Is it research? Quality improvement and program evaluation may not be research under the Common Rule; a project designed to produce generalizable knowledge usually is. Your IRB decides, so ask it rather than assuming.

Which privacy law covers the records? For HIPAA-covered records, the clinic can use or disclose information for research with a signed authorization, with an IRB or Privacy Board waiver, as a limited data set under a data use agreement, or once the data are de-identified. HHS describes each route on its research page, and its de-identification guidance explains the two methods: removing the 18 Safe Harbor identifiers, or an Expert Determination that the risk of re-identification is very small. For FERPA-covered records, the rules for disclosure without consent are different, so involve your registrar or privacy office.

Who approves it? The IRB reviews the protocol. The clinic director and the institution's privacy office decide how data leave the clinic. Faculty who are also treating clinicians need to keep those roles separate.

We cover the HIPAA research pathways in detail in using EHR data for research under HIPAA.

How Do You Recruit Clinic Patients Into Studies With Consent?

Recruiting from your own clinic is efficient, and it is also where the power imbalance is highest. A patient being treated by a trainee may worry that saying no will affect their care. Your IRB will expect the process to protect against that.

Common safeguards include having someone other than the treating clinician make the approach, stating plainly in the consent that care will not change if the patient declines, and giving time to decide. Under HIPAA, a clinician may discuss a study with their own patients; researchers outside the care team generally need an authorization, a waiver, or a review preparatory to research before they use records to identify candidates.

Once a patient agrees, electronic informed consent makes the record stronger: the IRB-approved version is the only one sent, identity is verified, comprehension questions are answered and saved, and a certificate of completion shows who signed and when. Our guide to electronic informed consent for research covers the requirements and a step-by-step workflow.

What About Cohort Tracking and De-Identified Export?

Once a study is running inside a clinic, two data jobs follow. The first is knowing who is in it: which patients consented, to which version, which cohort or arm they belong to, and where each one is in the study schedule. Without this, re-consent after an amendment turns into a manual hunt, and withdrawals get missed. The second is getting data out for analysis in a form the IRB approved, which for many clinic-based studies means de-identified.

When you evaluate an EHR for this, ask:

• Can we mark patients as participants and group them into cohorts, separate from their clinical record?
• Can we see, for each participant, which consent and authorization they signed and when?
• Can we export a de-identified data set, and what identifiers does the export remove?
• Who can run an export, and is each export logged?
• Does the export include the standardized measures the clinic collects, such as scored questionnaires?

Keep in mind that an EHR is not an electronic data capture (EDC) system. Case report forms, randomization, monitoring and safety reporting belong in a dedicated EDC or clinical trial management system. The EHR's role is the clinical record, consent, participant tracking and a clean export. See best EHR and research data software for clinical research sites for how the pieces fit together.

What Does an EHR Cost a University Clinic?

University clinics usually buy on a department budget, sometimes supplemented by a grant that ends. That makes three cost questions more important than the headline price.

What does the free or entry tier really include? Many vendors offer a free plan, but check whether it allows signed and locked notes and supervisor countersignature. For a teaching clinic, those are not extras: without them, the record of supervision lives outside the EHR.

How are seats counted? Student cohorts can double a headcount overnight. Ask whether students, supervising-only faculty and front-desk staff each count as a full clinician seat, whether there is a cap per plan, and how quickly a seat can be released when a student leaves.

What happens when the grant ends? Make sure you can export all records, including signed documents, in a usable format, and that downgrading does not lock you out of records you created.

Large universities with a campus-wide EHR contract may be able to add a teaching clinic to it. Smaller programs and student-run clinics usually cannot, and benefit from a vendor with transparent monthly pricing. Our guide to free EHR software for private practice compares what free tiers actually include.

Checklist: Choosing an EHR for a Teaching or Research Clinic

Use this list in vendor demos:

1. Trainees can sign notes, and a named supervisor must countersign before the note is final.
2. Supervisors have a queue of notes waiting for them.
3. Signed notes lock, and changes are recorded.
4. Access can be limited by role and by assigned patients, with emergency access logged.
5. Sensitive notes can be restricted further.
6. There is an audit trail, and access to restricted records is logged.
7. The vendor signs a BAA, whether or not your clinic is a HIPAA covered entity.
8. Consent and HIPAA authorization can be collected electronically, with a certificate of completion.
9. Participants can be tracked in cohorts, and data can be exported de-identified.
10. Seat pricing works for rotating students and supervising faculty.
11. You can export everything if you leave.

How ClinikEHR Handles Teaching and Research Clinics

ClinikEHR's Solo & Team edition covers the core of a teaching clinic, and its research capabilities cover the consent and data side. Here is what applies, with the plan each feature is on.

Supervised notes and countersignature. When you invite a clinician, the staff wizard has a Supervisor step where you name who supervises them and record their license. Notes signed by a trainee then appear in the supervisor's Waiting on you list, and, as the Help Center puts it, they are not final until the supervisor countersigns. Signing uses a Sign & Lock sheet with a typed or drawn signature and an attestation; a locked note is read-only, and unlocking it means it must be signed again. Co-signature workflows and version history are listed on the clinical notes feature page. One plan detail matters for budgets: signing and locking notes needs Essential or above. On Free, clinicians can write and save drafts but cannot sign and lock them, so a teaching clinic that needs countersignature should plan for Essential.

Access for students and faculty. On every plan, including Free, you can restrict a client's record to the staff looking after them, with emergency access that requires a reason and a time limit, and an access report on the Security tab. Each person's permissions are set when they are invited, including a switch to require multi-factor sign-in. From Essential, you can lock individual sensitive notes (behavioral health, substance use, reproductive health and others) to the author, the care team and the owner, and every opening of a restricted record is logged. The audit trail is listed from Essential.

Seats for rotating cohorts. The Help Center describes the Supervisor role as being for someone overseeing a pre-licensed clinician. Supervisor, biller and scheduler roles carry a Free badge when you invite them and, on plans where that badge shows, neither fill a seat nor add to the bill. A faculty member who also sees their own patients is a clinician and does use a seat. Before you invite faculty, check that the role you give them includes countersigning.

Research consent and data. ClinikEHR supports research informed consent and HIPAA authorization through ClinikForms, with an e-signature, a certificate of completion, and the signed document stored on the participant's record. It supports participant and cohort tracking, and de-identified data export. ClinikEHR supports 21 CFR Part 11 requirements for audit trails and electronic signatures; ask us for validation documentation. For case report forms, randomization, monitoring and safety reporting, use a dedicated EDC or CTMS alongside ClinikEHR.

Forms and measures. ClinikForms includes signature questions on every plan. Sending an uploaded document for signature starts on Essential (100 envelopes a month; 500 on Team). Scored clinical measures, recorded on the client's chart, are on Essential and above, which suits training clinics that track outcomes session by session.

Pricing. From the pricing page:

A ClinikEHR business associate agreement applies to every account. You can try Essential for 30 days for $29.90 with a card; the Free plan needs no card.

Frequently Asked Questions

Does a campus clinic that treats only students follow FERPA or HIPAA?

Generally FERPA. Under the joint HHS and Department of Education guidance, records a university clinic makes about its own students for treatment are treatment records under FERPA, not protected health information under HIPAA. Confirm your clinic's status with your institution's counsel.

How do trainee notes get co-signed in ClinikEHR?

When you invite a trainee, you name their supervisor. Notes the trainee signs appear in the supervisor's Waiting on you list and are not final until the supervisor countersigns. Signing and locking notes needs Essential or above.

Can a student-run clinic use ClinikEHR for free?

The Free plan covers 2 staff/providers and 50 clients with no card. It does not include signing and locking notes, so a clinic that needs supervisor countersignature should plan for Essential.

Can we use our teaching clinic's records for faculty research?

Often, with the right approvals. Your IRB decides whether the project is research, and HIPAA-covered records need an authorization, a waiver, a limited data set with a data use agreement, or de-identification. FERPA-covered records follow different rules.

Does ClinikEHR support research consent and de-identified export?

Yes. ClinikEHR supports research informed consent and HIPAA authorization through ClinikForms with a certificate of completion, participant and cohort tracking, and de-identified data export.

Do supervising faculty need a paid seat?

Not always. The Supervisor role, meant for someone overseeing a pre-licensed clinician, carries a Free badge and does not fill a paid seat. A faculty member who also sees their own patients is a clinician and uses one.

Conclusion

A university teaching or research clinic asks more of an EHR than a typical practice does. Supervision has to be built into the note, not tracked beside it. Access has to follow students in and out every term. Privacy depends on who the clinic serves, and research needs consent, tracking and a clean export that the IRB has approved. Map your clinic to the table at the top of this guide, settle the FERPA or HIPAA question with counsel, and test the supervision workflow with real faculty before you commit.

Key takeaways:

• Require named supervisors, a countersignature queue and sign and lock.
• Limit student access by role and assigned patients, and remove it each term.
• Know whether FERPA or HIPAA governs each population you serve.
• Route research use of clinic data through the IRB, with electronic consent and de-identified export.
• Check how seats are counted for students and supervising faculty.

Related Articles

• Top 5 EHR for College & University Health Centers 2027
• Electronic Informed Consent for Research 2027: E-Signatures, IRB Approval and Part 11
• Can You Use EHR Data for Research? HIPAA Authorization, De-identification and IRB (2027)
• FERPA vs HIPAA for Student Health Records 2027: Which Law Applies to Your Campus Clinic?
• Best EHR and Research Data Software for Clinical Research Sites (2027)
• Best EHR for Associate & Pre-Licensed Counselors in 2027
• Counselor Licensure Guide 2027: From Associate to Fully Licensed
• Free EHR Software for Private Practice 2027: Is There a Truly Free EHR? (11 Compared)