Every youth sports season starts the same way: a stack of forms. Birth dates, home addresses, allergies, medications, emergency contacts, sometimes a copy of a birth certificate. Most of it ends up in a coach's email, a group chat, a shared spreadsheet or a binder in a car trunk. This guide covers what gets collected, which federal rules actually apply (including the HIPAA question everyone asks), and what parents, coaches and league admins can do this week to keep kids' information from drifting where it shouldn't.
Short version: HIPAA probably isn't the law that governs your team's medical form, but that doesn't mean anything goes. Other rules, and plain good habits, matter more.
TL;DR
- HIPAA covers health plans, clearinghouses and health care providers that transmit health data electronically. A club, league or volunteer coach generally isn't one of those, so the team's medical form usually isn't a HIPAA document.
- Schools are different: health records a school holds can fall under FERPA, which limits sharing without consent.
- COPPA, enforced by the FTC, governs online services that collect personal information from kids under 13. Updated rules became enforceable on April 22, 2026.
- The safest policy for organizers: collect less, share only what a coach needs to keep a kid safe, lock it down, and delete it when the season is over.
- Parents can ask any organizer three questions: what do you collect, who sees it, and when do you delete it?
Table of Contents
- What youth sports organizations actually collect
- Does HIPAA apply to youth sports forms?
- COPPA: the rule for kids under 13 online
- State rules: Ohio and beyond
- How organizers should handle medical forms
- What parents can do
- Our perspective
- Where Athlo fits
- FAQ
- Download Athlo
- Sources
What youth sports organizations actually collect
It's more than most parents realize. Take a national soccer organization as an example. AYSO's privacy policy says players provide a name, date of birth, home address, parent contact details, emergency contact information and any medical conditions that may affect safe participation. That's a normal list. Tournaments, travel teams, camps and school programs often add more: insurance details, physician names, immunization records, school info, photos and sometimes government ID.
Each item has a legitimate reason. A coach does need to know about a kid's asthma or a severe peanut allergy. An organizer does need a way to reach a parent in an emergency. The privacy problem isn't collection itself. It's collection without a limit, followed by storage without a plan.
Where the risk really comes from
The scary scenario is a hacker. The common one is far more boring:
- A spreadsheet of every player's medical notes, emailed to 15 parents and three assistant coaches.
- A group chat where someone posts a kid's injury details or a photo of a form.
- A free sign-up tool nobody on the board has read the terms for.
- A binder of paper forms from 2019 that nobody ever threw out.
- A third-party registration site that sells or shares contact data.
The Ohio Attorney General's office has warned consumers that data brokers gather and sell information from public records, apps and online browsing, which can expose people to fraud and targeted scams. A child's name, birthday and address, paired with a parent's phone number, is exactly the kind of record that gets recycled. You don't need to be paranoid. You do need to know that data doesn't stay where you put it.
Does HIPAA apply to youth sports forms?
This is the most common question, and the answer surprises people.
The HIPAA Privacy Rule applies to what it calls covered entities: health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with certain standard transactions. Notice what's not on that list. Sports leagues, clubs, travel organizations, booster groups and volunteer coaches aren't health plans or health care providers. When a parent hands a coach a form listing their kid's asthma, that coach didn't get it from a covered entity acting under HIPAA. A parent shared it voluntarily to keep the child safe.
That's the general picture, and the details matter. If you want a plain walkthrough of when HIPAA applies and what to do when it doesn't, that's a good place to start. The practical takeaway: don't tell families "this is HIPAA protected" unless you're sure it is. It's an easy promise to make and a hard one to keep.
Where HIPAA does show up
HIPAA enters the picture when a doctor, clinic or athletic trainer employed by a health care provider holds your child's records. That clinician is bound by it. The Ohio High School Athletic Association explains that HIPAA generally prohibits health care providers from releasing health status information without a signed authorization, and for a minor, a parent or guardian signs it. That's why your pediatrician's office asks you to sign a release before sending anything to a school.
A vendor can also be pulled in. If a company provides services to a covered entity and stores protected health information on its behalf, it can be a HIPAA business associate. That is a specific legal relationship set up by contract. It doesn't spread to every team that happens to use an app.
And what about schools?
Schools sit under a different law. Per the OHSAA, once a school receives a student's health information from a health care provider, it becomes subject to FERPA, which limits further disclosures without consent. The federal HHS and Department of Education guidance says student health records kept by an educational agency or institution generally count as education records under FERPA. So a high school athletic department is usually thinking about FERPA, not HIPAA, for its physicals and eligibility paperwork.
If your kid plays for a school team and a club team, that means two different legal setups for the same kid's information. Ask both who holds what.
The coach-communication problem
Even the doctors find this part tricky. The American Academy of Pediatrics notes that physicians face complex privacy and ethical challenges when telling coaches and schools whether an athlete is medically eligible while protecting the rest of that athlete's medical history. The principle is simple: a coach needs to know a kid is cleared, and what to do in an emergency. A coach rarely needs the full history.
COPPA: the rule for kids under 13 online
If your team uses a website, app or online registration tool, COPPA is the rule to know. Enforced by the FTC, it requires operators of online services directed to children under 13, or that have actual knowledge they're collecting personal information from kids that age, to give parents notice and get verifiable parental consent. The original rule took effect April 21, 2000.
Two more points matter for organizers:
- Data minimization is built in. Under the rule, an operator can't make a child's participation in an online activity depend on handing over more personal information than is reasonably necessary for that activity.
- The rule got tougher. Updated COPPA amendments had a compliance deadline of April 22, 2026. They include separate parental consent to disclose children's information to third parties, new data retention limits and a broader definition of personal information.
COPPA mostly targets the companies running the tools, not the volunteer parent who set up a signup sheet. But it tells you what to look for in a tool: clear notice to parents, real consent, limited collection, and a retention policy. Back in 2012, when the FTC updated the rule, it kept email plus as an acceptable consent method for operators using children's information internally only. In plain terms, consent is supposed to come from a parent, not a kid clicking "I agree."
State rules: Ohio and beyond
There's no single national youth sports privacy law. Federal rules cover specific slices (HIPAA, FERPA, COPPA), and states fill in around them. The patchwork changes often, so check your own state attorney general's site.
Ohio is a good example of how states focus on kids online. Under the state's Social Media Parental Notification Act, parental approval is required for children under 16 before they create new social media accounts, according to the Ohio Attorney General. That has a direct team-life impact: a 14-year-old can't just spin up a new account for the team's social page without a parent in the loop. Other states have their own children's privacy and social media laws, with different age cutoffs and different definitions. If your league plays across state lines, the strictest rule you touch is the safest one to follow.
How organizers should handle medical forms
Here's the playbook. It works whether you run a rec league of 40 kids or a travel club of 400.
1. Collect the minimum
Ask what you'd actually use in an emergency. The Missouri State High School Activities Association's guidance, as discussed in the AAP's material, says schools should collect only the Medical Eligibility Form as documentation of the physical exam and release to participate, rather than collecting and storing the full examination and medical-history forms. Clubs can borrow the idea. Keep "cleared to play" separate from "here's the whole medical file."
A good test for each field on a form: if we deleted this question, would anyone be worse off? If not, delete it.
2. Decide who sees what
A useful split:
- Head coach and team admin: clearance status, allergies, emergency contacts.
- Assistant coaches: only what they need on game day.
- Everyone else: nothing. That includes other parents and the team chat.
If a kid has a condition that affects play, the parent should decide how widely it's shared. Don't announce it for them.
3. Keep it out of the group chat
Group chats are great for rides and rainouts. They're terrible filing cabinets. Photos of forms, insurance cards and doctors' notes shouldn't live there. We wrote a separate guide on youth team chat safety for coaches and parents that goes deeper.
4. Pick tools you've actually read
Before a league adopts a registration or scheduling tool, read the privacy policy. The Ohio AG's advice to consumers is to limit app permissions and read privacy policies so you know what's being shared, and to be selective about free apps and online quizzes. Look for:
- What data it collects about kids, and whether it's tied to a parent account.
- Whether it sells data or shares it with advertisers.
- How payments are handled. (AYSO, for one, says it doesn't store card details used for a payment; ask any tool the same.)
- Who at the organization can see forms, and whether you can remove access when a coach leaves.
- How long data is kept and how to ask for deletion.
AYSO also states that its systems use security, encryption and firewall protection and are tested regularly. You don't need a corporate security team, but you should be able to ask your vendor a comparable question and get a straight answer.
5. Set a deletion date
The forgotten binder is a real liability. Pick a retention rule, such as "medical forms are deleted or shredded 60 days after the season ends," write it down and tell families. Your insurer or state association may have its own requirement, so check before you pick a number. For paper, a shredder beats a recycling bin. For digital files, delete the copies in email and downloads too.
6. Screen the adults, too
Privacy and safety travel together. A coach who has access to kids' information should be vetted. Our guide to background checks for youth coaches explains how to clear people before the season starts, and the concussion protocol checklist shows what injury information a coach genuinely needs.
What parents can do
You have more leverage than you think. Organizers want your kid on the roster, and most will answer reasonable questions.
- Ask before you fill out. "Who will see this form, and where is it stored?"
- Give what's needed, not everything. If a field doesn't relate to safe participation, it's fine to ask why it's required.
- Share medical needs directly with the adults who need them. A quick word with the coach beats posting in a chat of 30 parents.
- Say no to photos or posting if you want to. Many leagues have a photo policy; ask for yours.
- Check app permissions. Does the team app need your location, contacts or camera all the time? Limit what it doesn't need.
- Ask about deletion. At season's end, ask the organizer to remove your child's records.
One more thing: waivers are a different animal from medical forms. A waiver is about liability, not privacy, but it often travels with the same paperwork. Here's what a youth sports waiver actually protects you from, and what it doesn't.
Our perspective
We build a sports app, so we've seen how this plays out. Most privacy slips in youth sports aren't malicious. They happen because someone needed a form by Friday, and the fastest route was a group text.
Here's what we believe. A kid's safety info should reach the adult who needs it, at the moment they need it, and almost nobody else. Parents shouldn't have to hand over their kid's whole medical life to sign up for a Saturday league. And an organizer shouldn't be stuck as the accidental records manager for 200 families.
That's the thinking behind how Athlo handles waivers and medical forms: keep them in one place instead of scattered across inboxes, and let parents manage their child's sports life from a single account, without the child needing their own device or account. We'd rather you ask hard questions of any tool, ours included, than trust a badge. Read the policy, limit the permissions, collect less.
— Abdulazeez
Where Athlo fits
If you're an organizer tired of chasing paper, Athlo's digital waivers and medical forms are built for team use, so forms live in one spot rather than in six email threads. Parents get a single account to follow their kid's schedule, forms and games. Core features like scores, chat and forms management are free; coaching sessions, pickup games and event tickets paid through the app carry a transaction fee. Athlo is by Athlo LLC in Columbus, Ohio, at athloapp.com, and, as with any tool, you should still read the privacy policy before you sign your team up.
FAQ
Is a youth sports medical form protected by HIPAA?
Usually not. HIPAA applies to health plans, clearinghouses and health care providers that transmit health data electronically, and a typical club or league isn't one. A form a parent hands a coach is generally not a HIPAA record, though your child's doctor's files are. Treat the form as sensitive anyway.
Can a coach share my child's medical information with other parents?
A coach shouldn't, unless you've agreed to it. Even where no law specifically bars it, sharing a child's health details with people who don't need them breaks basic trust and may violate your league's own policy. If it happens, take it to the league director in writing and ask how the information is stored.
Does COPPA apply to my team's app or website?
It applies to online services directed to children under 13, or those that knowingly collect personal information from them. If a tool collects kids' data, it should give parents notice and get verifiable parental consent. The updated rule has been enforceable since April 22, 2026.
How long should a league keep medical forms?
There's no single national answer. Check with your state association and insurer, then set a clear deletion date after the season and tell families about it. The less you hold, the less can go wrong.
What should I do if a child's information is exposed?
Tell the organizer right away, ask what was exposed and who saw it, and ask them to remove it from chats, emails or shared files. For serious exposure involving a health care provider or a school, contact that provider or the school's records officer. Your state attorney general's consumer protection office is another place to report it.
Download Athlo
Ready to get forms, schedules and games into one place? Download Athlo on the App Store or Google Play and set up your team in minutes.
Sources
- How companies use your data and how to protect it, Ohio Attorney General (August 2026)
- Privacy Policy, American Youth Soccer Organization
- Joint Guidance on the Application of HIPAA and FERPA, HHS
- OHSAA Consent Form FAQs
- Health Privacy, Ethical Issues, and Legal Concerns, American Academy of Pediatrics
- Children's Online Privacy Protection Rule, FTC
- FTC Strengthens Kids' Privacy, Gives Parents Greater Control (2012)
- COPPA Rule Amendment Compliance Deadline Approaches, Hunton
- AG Yost's Meta lawsuit, Ohio Attorney General (December 2023)