School-Based Health Centers & Confidentiality: Understanding FERPA & HIPAA Laurie Mesibov & Jill Moore UNC School of Government December 2012

FERPA Family Educational Rights and Privacy Act Federal statute that protects the confidentiality of “education records” and guarantees parents and eligible students access to records

Education Record All records, files, documents, and other materials that (1) contain information directly related to a student and (2) are maintained by an educational institution or agency or by a person acting for the institution or agency. FERPA protects the records and the information in them.

Records of School Nurses A school nurse’s records are education records covered by FERPA when a record directly relates to a student and the nurse is acting for the school. FERPA’s rules on access and disclosure apply. Nursing records should not be readily accessible to all school staff.

Records Outside the Scope of FERPA Sole possession notes Records related to the student as employee Certain records of students who are at least 18

Rights under FERPA Right to inspect and review records Right to request amendment of records believed to be inaccurate or misleading Right to control disclosure of information in most situations Right to complain to federal Department of Education

Important Exceptions to Consent Requirement Health or safety emergency Other school officials with a legitimate educational interest Disclosure of directory information Subpoena or court order

HIPAA Health Insurance Portability & Accountability Act of 1996 Federal statute that authorizes the HIPAA Privacy & Security Rules HIPAA Privacy Rule governs the use and disclosure of “protected health information” by “covered entities”

Covered entities Health plans Health care clearinghouses Health care providers that transmit health information electronically in connection with particular transactions, mostly related to billing insurers

Protected health information (PHI) Individually identifiable health information in any form (paper, electronic, oral communication) that relates to: –The health status or condition of an individual, –Provision of health care to an individual, or –Payment for the provision of health care to an individual Does not include information covered by FERPA.

Records of SBHCs If: Covered by HIPAA, and Co-located with school but separate records Then: Information in records is PHI governed by HIPAA (not FERPA)

Disclosing PHI: General Rule Written authorization required Authorization given by individual or personal representative –Minor children: Parent/guardian is personal representative unless minor consented to treatment herself or parent agreed to a confidential care relationship between minor and health care provider

Disclosing PHI: Exceptions Treatment Required by law Disclosures to parents Many more

Other HIPAA Requirements Workforce training Respond to improper disclosures Individual rights: –Right to inspect & obtain copy of records –Right to request amendment of records –Right to request additional restrictions on disclosure –Notice of privacy practices –Accounting of disclosures of PHI

Taking all of this to school …

Discussion #1 A SBHC does not provide pregnancy testing, family planning or STD services. Students who ask for assistance obtaining this care are referred to the school nurse.

Discussion #2 A SBHC does provide reproductive health services. A student needs follow-up care and is not keeping appointments. The SBHC would like for the school nurse to speak to the student about the need for the appointment.

Discussion #3 The health department is investigating an outbreak of chlamydia among teenagers in the community. The department has authority under state law to obtain information and records pertaining to the outbreak of a communicable disease. a.May the SBHC disclose records and information to the health department? b.May the school nurse disclose records and information to the health department?

Discussion #4 a.School requests immunization information from the SBHC. b.SBHC requests immunization information from the school.

Discussion #5 SBHC policy states that information will be shared with the school “as appropriate.”

Other references US Dept. of Health & Human Services & US Dept. of Education, Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act (HIPAA) to Student Health Records (Nov. 2008), available at hipaaferpajointguide.pdf. hipaaferpajointguide.pdf NC School Health Program Manual, 2010 (5 th ) Edition, available at _manual_2010.pdf. _manual_2010.pdf

Contact information Laurie Mesibov Jill Moore