Speech therapy compliance for US school districts: what changed for 2026

The short version for 2026

• School Medicaid has a July 1, 2026 state-compliance deadline tied to CMS's 2023 guidance - the biggest moving piece.
• Children's online privacy (COPPA) picked up new vendor duties requiring full compliance by April 22, 2026.
• State student-data-privacy enforcement is real - a $5.1M multistate settlement landed in November 2025.
• A widely-watched proposal to drop a Medicaid parental-consent step was withdrawn - so that consent is still required.

Why this matters now: both the July 1 and April 22, 2026 deadlines land before the new school year, so the summer is the practical window to run vendor reviews and get data agreements in place for a fall start. If you are evaluating tools this summer, use the district checklist below and see the For Schools & Districts page.

1. IDEA and the IEP: the foundation that has not moved

Under the Individuals with Disabilities Education Act (IDEA), speech-language services must be delivered the way the student's IEP specifies: the frequency, type, duration, and location of services are documented in the IEP, and services follow that plan (34 CFR 300.320(a)(7)). States must also ensure personnel are appropriately qualified (34 CFR 300.156(a)), and IDEA removed the option for states to waive those qualification standards on an emergency basis. This is settled law, not a 2026 change - the practical point is that whatever tool you adopt has to fit inside the IEP, not rewrite it.

2. School Medicaid: the July 2026 deadline is the headline

In May 2023, CMS released Delivering Service in School-Based Settings: A Comprehensive Guide to Medicaid Services and Administrative Claiming - developed with the US Department of Education, and the first comprehensive school-Medicaid update in about 20 years. It consolidates guidance and adds flexibilities (the random moment time study, billing, telehealth, and provider qualifications). States that do not already meet the standards have until July 1, 2026 to comply.

• Who you can bill for. Since CMS reversed its "free care" policy in 2014, states may bill Medicaid for any Medicaid-enrolled student, not only students with an IEP or 504 plan. Check locally - this is operational only where a state adopted it through a State Plan Amendment (about 25 states as of October 2023).
• The five conditions. For IDEA-related services, reimbursement generally requires that the student is Medicaid-enrolled, the service is medically necessary, the service is covered in the state plan, the service is in the IEP, and the district is an authorized Medicaid provider. Check locally - group-size limits, documentation, supervision, sign-off, and payment rates vary by state.
• Telehealth is billable. CMS treats telehealth as a delivery method and names therapy services as well-suited to it; states generally do not need a separate State Plan Amendment unless they pay for telehealth differently than in-person services.

The consent step that did not go away. A May 2023 proposal would have removed the requirement to get parental consent before billing Medicaid for the first time. That proposal was formally withdrawn in December 2024. So the rule at 34 CFR 300.154(d)(2)(iv) stands: districts must obtain one-time written parental consent before accessing a child's public benefits for the first time to pay for IDEA services. Do not assume this was relaxed.

3. Telepractice and practicing across state lines

ASHA recognizes telepractice as an effective school service-delivery model, conditioned on meeting licensure and teacher-certification requirements, protecting privacy and security, and meeting IDEA documentation and notification requirements. Cross-state delivery also got easier: the Audiology and Speech-Language Pathology Interstate Compact (ASLP-IC) went operational in 2025, letting licensed SLPs practice across member states without a separate license in each. Check locally - it is rolling out state by state (Louisiana and West Virginia were first to issue privileges in October 2025, and large states including California, New York, and Texas were not yet members at that point).

4. Student data privacy: the stack districts will hold a vendor to

This is where most procurement reviews live, and where 2025-2026 added the most new vendor duty.

FERPA and the "school official" exception

Most cloud tools operate under FERPA's "school official" exception (34 CFR 99.31(a)(1)(i)(B)) - and FERPA's definition of "education records" expressly covers records held by "a party acting for" the school, which is what lets a vendor sit inside FERPA rather than as an outside third party. Per the US Department of Education's Privacy Technical Assistance Center (PTAC), a provider qualifies when it:

1. performs a service the district would otherwise use its own employees for;
2. meets the legitimate-educational-interest criteria in the district's annual FERPA notification;
3. is under the district's direct control over the use and maintenance of education records; and
4. uses records only for authorized purposes and does not re-disclose them.

To preserve that direct control, PTAC advises that the contract or DPA bar use and re-disclosure for any other purpose, stop the vendor from unilaterally changing its terms, support parental access to records, and include a security plan, breach procedures, and a data-destruction plan. For special-education records, IDEA's confidentiality rules defer to these same FERPA exceptions. The district still makes the final "legitimate educational interest" determination through its annual notification.

COPPA - new duties, compliance by April 22, 2026

The FTC's amended Children's Online Privacy Protection Rule took effect June 23, 2025, with full compliance required by April 22, 2026. For vendors handling data from under-13 students it adds: data minimization and a written retention policy (no indefinite retention); separate verifiable consent before disclosing a child's data to third parties such as ad networks; behavioral advertising off by default; and a rule that refusing third-party-disclosure consent cannot cut off the service. One nuance: the FTC deliberately did not finalize new ed-tech and school-authorization rule text (it deferred to a planned Department of Education FERPA rulemaking), so the mechanism by which a school consents on parents' behalf still rests on existing COPPA guidance.

PPRA and state laws

The Protection of Pupil Rights Amendment (PPRA) governs surveys collecting any of eight protected categories (including mental or psychological information, religious beliefs, and income), requiring parental consent or notice-and-opt-out depending on funding source. Check locally - state student-data-privacy laws add their own contract terms. Two illustrations: New York (Education Law 2-d / Part 121) requires a vendor to report a breach to the district within 7 calendar days, reimburse breach-notification costs attributable to it, and never sell student data or use it for marketing; California (SOPIPA) prohibits selling K-12 student data, targeted advertising, and non-educational profiling.

The contract you will be asked to sign - and that enforcement is real

The National Data Privacy Agreement (NDPA) from the Student Data Privacy Consortium (part of the nonprofit Access 4 Learning) is the standardized K-12 data-privacy contract many districts use - more than 275,000 executed since 2016. It standardizes core terms and uses state-specific exhibits. Enforcement is not theoretical: in November 2025 a New York, California, and Connecticut coalition secured a $5.1M settlement from an ed-tech vendor over a data breach, with required controls including encryption, network monitoring, vulnerability management, access limits, and data minimization. Check locally - whether your district requires a SOC 2 report, FedRAMP, or a specific state certification varies; ask what your review committee expects.

5. Caseload and workload reality

Check locally - there is no federal caseload cap, and ASHA recommends no specific maximum (it favors a workload-analysis model). State caps vary widely - roughly half of states set none, while numeric ceilings range from about 30 (Alabama) to 80 (Ohio), often with workload qualifiers. ASHA's 2022 schools survey put the median full-time monthly caseload at 48.

6. Funding after ESSER

The last and largest round of federal pandemic relief (ESSER III / ARP, about $122B) had to be obligated by September 30, 2024, and roughly half of it went to labor. As that funding ends, many districts that used one-time money for recurring staffing face budget pressure and are looking for sustainable ways to fund student services - part of why school Medicaid is getting renewed attention. (This is a broad sector trend, not a claim about any specific effect on SLP staffing or tool budgets.)

A district evaluation checklist for any digital or VR therapy tool

Use this when reviewing Therapy withVR or any competitor:

How Therapy withVR is built for school-based practice

Therapy withVR is clinician-led VR for speech-language therapy, designed to fit school constraints: FERPA-aligned by design, IEP / Section 504 / MTSS compatible, with a Student Data Privacy Agreement (SDPC / National DPA compatible) and a FERPA agreement available on request, and PO/invoice purchasing for districts. The full compliance position - GDPR, HIPAA stance, FERPA, the EU AI Act, and the state student-privacy matrix - is on the Compliance page, and the school-specific detail is on Therapy withVR for Schools.

Last reviewed: 2026-06-14. This page covers fast-moving rules and is reviewed periodically; it is general information, not legal advice - verify current requirements with your state agencies and counsel. Sources include CMS, the US Department of Education and its Privacy Technical Assistance Center, the FTC, MACPAC, ASHA, and the Federal Register.