FERPA and HIPAA for School Nurses and School Based Health Center Staff June 15, 2012 School Nurse and School-Based Health Center Orientation

What Is FERPA? Family Educational Rights and Privacy Act enacted in 1974 Federal law that protects the privacy of students Applies to educational agencies and institutions that receive funds from any program administered by the U.S Department of Education

What Is HIPAA? Health Insurance Portability and Accountability Act of 1996 Created to protect the privacy and security of individually identifiable health information Subject only to “covered entities”: Health care entities/providers that transmit health information in electronic format Health plans, health care clearinghouses, and health care providers

WHERE HIPAA & FERPA MEET: Student Health Records School Nurses Fall under FERPA if under contract or direct supervision of a school. Must receive parental consent prior to sharing any information to a third party. May only share information within a school for “education purposes.” SBHC Staff Fall under HIPAA Privacy Rule. Is allowed to share information to other health care providers, without consent, in certain instances. May treat minors without parental consent in some situations.

Resource Joint Guidance on the Application of Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) To Student Health Records November 2008

School Nurses and FERPA Most schools do not fall under HIPAA because the only health records maintained by the school are considered “education records” of eligible students under FERPA. HIPAA excludes the education records of students, for that reason. Most schools are not “covered entities” under HIPAA, because they do not transmit health information electronically. See 45 CFR §160.102.

SBHC and HIPAA SBHCs, although housed in a school, are not under contract or direct control of a school. Almost all SBHCs engage in covered transactions under HIPAA- such as billing a health plan electronically for their services.

Sharing Information School nurses SBHC Staff Must receive parental consent before sharing any part of the student’s record. Must allow parents to see the student’s record. Can share some information with school staff, but only if needed for educational purposes. May share information with school health providers for “treatment purposes”, without consent. Is required to keep some information confidential, if requested to do so by the minor. Many have consents to allow bi-directional information sharing between SBHC, school nurse and primary care provider

Gray Areas West Virginia law on minor consent: Minors do not need parental consent for: Alcohol/substance abuse treatment; STDs/Family Planning Other treatments, if determined to be a “mature minor” by the medical provider. If Primary Care provider shares information with School Nurse, and the School Nurse documents this information in the student’s record, the parents have the right to view the record, under FERPA. FERPA regulates written information, not oral information. Also allows for school health provider to keep private “notes”, that are not viewable.

Additional Resources FERPA U.S. Department of Education http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html September 2008 U.S. Department of Education –FERPA memo February 2004 Montgomery Alabama memo – FERPA/HIPAA HIPAA U.S. Department of Health and Human Services – Health Information Privacy http://www.hhs.gov/ocr/privacy/

Example 1 Tim is 8 years old and has been diagnosed with Diabetes. Tim’s parents share this information with the school nurse. The nurse believes Tim’s teacher should know, in case Tim begins to exhibit problems in class. May the nurse inform Tim’s teacher? What procedures must he/she follow?

Solution 1 Yes. Under FERPA, the School Nurse may share information with another person within the school, for “educational purposes.” Because the teacher is not considered a “third party”, the school nurse does not need parental consent prior to sharing the information.

Example 2 A SBHC doctor would like to let the school nurse know that Mary is taking antibiotics that could cause her to become very ill, if she doesn’t eat properly throughout the day. Mary has mentioned to the doctor that she is dieting because of prom. May the doctor inform the school nurse?

Solution 2 Yes. Under HIPAA, the doctor may inform the school nurse for treatment purposes, without the consent of the patient or the patient’s guardians. CAVEAT: The antibiotic is for treatment of a STD, and Mary doesn’t want her parents to know.

Solution 2 cont. If the school nurse makes documentation in Mary’s school record, her parents will have the right to view such record, and therefore, Mary’s health rights have been compromised. The school nurse may make a “personal note”, about the situation, which is allowed and may not be viewed by parents, under FERPA. The school and SBHC may jointly draft a release, allowing for the sharing of such information, with the understanding that such information will remain private as allowed by West Virginia law.

HIPAA & FERPA To balance the rights of students have their health information kept private, and the need for health providers to work within the law, school nurses and school based health centers must communicate with one another and keep one another informed of the applicable policy. If you encounter a “gray” subject area, please request the assistance of your legal counsel.

Special recognition to Jessica Wherle, past legal counsel for the WV Primary Care Association and Paula Fields, rural health coordinator for Marshall University School Health Technical Assistance Center.