Joan Thackaberry e-mailed:

As a school nurse working in a private school setting, I wonder how FERPA and HIPAA apply to a non-profit independent school that does not receive federal funds. I look forward to your reply.

Editor's reply: (1/13/03)

In response to your inquiry, the preamble to December 2000 final regulations for HIPAA says in part: "If a school does not receive federal funds, it is not an educational agency as defined by FERPA. Therefore, its records that contain individually identifiable health information are not education records. These records may be protected health information. The educational institution or agency that employs a school nurse is subject to our (HIPAA) regulation as a health care provider if the school nurse or the school engages in a HIPAA transaction.

-----------------------------------------------

Jeanne Russ, RN, School Nurse e-mailed: (1/13/03)

This topic did not address sharing of immunization information between schools and health care providers and public agencies. In the past we have been able to share this information without signed release because it is necessary for school entry, documentation, etc.

Editor's reply: (1/16/03)

Both FERPA and HIPAA regulations are silent on the subject of immunization, and this is a question that may have to be submitted to the HIPAA website or to your state attorney general. The regulators specify that HIPAA is not meant to supercede existing state or federal laws, and most states have laws concerning exchange of immunization information. The HIPAA website is www.hhs.gov/ocr/hipaa, and questions are invited. FERPA information is available at the Family Policy Compliance Office of the U.S. Department of Education at www.ed.gov/offices/OM/fpco.

-----------------------------------------------

Mary Hall, RN e-mailed: (1/14/03)

The "need to know" provision of FERPA. For example, a student has a diagnosis of diabetes, would the school nurse be protected if she shares this with a teacher, bus driver, etc. because she feels they need to know about the health condition while the student is at school or riding the bus. I thought a parent or guardian's permission to share this information was needed. I would like more information about protecting student's privacy, in the school setting.

Editor's reply: (1/14/03)

Regulations for the Family Educational Rights and Privacy Act (FERPA) say in Section 99.31 (a) that an educational agency or institution may disclose personally identifiable information from an education record of a student without prior written consent "if the disclosure. is to other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests." It's possible that state law or local practice may require prior consent, but FERPA does not.

More information about FERPA is available from the Family Compliance Office in the U.S. Department of Education at www.ed.gov/offices/OM/fpco.

-----------------------------------------------

Joe Millward e-mailed: (1/13/03)

To me, nothing in this article is surprising nor cause for huge concern. However, there is the possibility of cross-agency issues cropping up that could cause more problems than a principal entering health information. While the principal of a school has an assumed "need to know" regarding any school record of any child in the building, a problem may arise when the school nurse is not an employee of the school system, but rather an employee of the local Department of Health, and is working in the school through an interagency contract. The question would be: is the health record under the jurisdiction of the Health Department or the school system?

Editor's reply: (1/16/03)

The preamble to the December 2000 HIPAA regs simply say that health information entered by "a school nurse" become part of the education record; there is no definition of what is meant by "a school nurse," and the regulators probably didn't realize that school nurses are sometimes employees of agencies other than schools. This may be one for the lawyers, or you might try asking your question of the HIPAA website, www.hhs.gov/ocr/hipaa. Good luck!.

-----------------------------------------------

Rudolph Ramirez e-mailed: (1/13/03)

A school nurse gives a child a required immunization, and updates the childs school district immunization record. Can the immunization information also be shared with a County Health Department Immunization Database, which will be accessible to other medical professionals? (under the new privacy act (HIPPA or Ferpa)

Editor's reply: (1/16/03)

The issue of immunization records is not discussed, as far as we can tell, in either HIPAA or FERPA laws or regulations. What the HIPAA regs do say, however, is that HIPAA does not negate existing state or federal laws. Since immunization record-sharing is usually subject to state law, we urge you to consult your state attorney general for clarification of this question, and to submit the inquiry to the HHS Office for Civil Rights at www.hhs.gov/ocr/hipaa, where the home page has a button to click to ask a question.

-----------------------------------------------

Kristen Coulibaly e-mailed: (1/13/03)

School Nurses at our six SBHCs in Worcester, MA make many referrals to the SBHC Nurse Practitioner/Physician Assistant for immunizations and school or sport physicals. It is unclear to me whether the School Nurse can share the student's immunization record with the SBHC staff, or if the SBHC Medical Provider can provide the School Nurse with documentation that a vaccine has been administered (or school/sport physical conducted), without a parental consent for release of information. Any clarification would be appreciated.

Editor's reply: (1/16/03)

With some exceptions, such as law enforcement or research, HIPAA "covered entities" are barred from providing health information to non-HIPAA entities unless authorized by the individual patient. Exchange of health records between a school-based health center operated by a hospital or other HIPAA-covered entity and a nurse employed by a school district would therefore seem to require authorization. This may not be true of immunization records that are subject to disclosure under state law. We urge you to submit your question to the Office for Civil Rights responsible for enforcing HIPAA. The OCR home page, at www.hhs.gov/ocr/hipaa includes a button to click for asking a question. You may also want to consult your state attorney general for clarification of your state's immunization laws.

-----------------------------------------------

Jacque, School Nurse in NH e-mailed: (1/20/03)

I am wondering if this law also applies to immunization records. Can I send these to another school or request them from a physcians office upon registration of the student? I have had schools tell me that this is public knowledge. Please advise me. Thank you.

Editor's reply: (1/22/03)

Immunization is not mentioned in the regulations for HIPAA, but we are attempting to get clarification from the Office for Civil Rights. The more questions they get about this, the better, so perhaps you could contact the HIPAA website, www.hhs.gov/ocr/hipaa, where questions are invited.. Meanwhile, we'll keep you posted on anything we learn. You may also want to inquire whether your state has a law mandating exchange of immunization records.

-----------------------------------------------

Bill White e-mailed: (1/24/03)

We are a private predominately residential high school, that operates a Health Service on campus providing outpatient services for our students. A physician, nurse practitioner, nurses, counselors, health educators, and athletic trainers, all of whom are employed by the school, provide those services. We are also licensed for 14 beds by the State for use by students as may required. We bill parents or an optional school insurance program for selected of those services. It remains unclear to us whether any or all of the HIPAA regulations apply? Your input would be appreciated.

Editor's reply: (2/10/03)

Since your school health service provides health care and bills for it, it seems the service must be a HIPAA-covered entity. Also, the preamble to the December 2000 HIPAA final regulations reads in part: "The educational institution or agency that employs a school nurse is subject to our (HIPAA) regulation as a health care provider if the school nurse or the school engages in a HIPAA transaction."A HIPAA transaction is defined in the Code of Federal Regulations as "the transmission of information between two parties to carry out financial or administrative activities related to health care."

-----------------------------------------------

Barbara Walker, R.N. e-mailed (1/13/03)

Can you advise if FERPA would prohibit a student aide who had signed a confidentiality statement, from filing immunization records in a student's file? Thank you

Editor's reply: (2/03/03)

The U.S. Department of Education says that so long as the school has informed the student aide that nothing he or she encounters is to be talked about to other people, and so long as the school will take disciplinary measures if the student aide violates the confidentiality agreement, there is no reason under FERPA that a student assistant cannot enter information into another student's education record.

Thank you for your interesting question.

-----------------------------------------------

Diane Niezwaag e-mailed: (1/21/03)

Would you please clarily what the exact meaning of "legitimate educational interests" provision?

Thank you.

Editor's reply: (2/04/03)

This is not addressed in regulations for FERPA, but the Education Department points to a "Model Notification for LEA Officials" posted on its FERPA website at www.ed.gov/offices/OM/fpco, which explains that disclosures of personally identifiable information in a student's educational record may be made without consent to a school official who "needs to review an educational record in order to fulfill his or her professional responsibility."

The notice goes on to define "A school official" as "a person employed by the School as an administrator, supervisor, instructor, or support staff member (including health or medical staff and law enforcement unit personnel); a person serving on the School Board; a person or company with whom the School has contracted to perform a special task (such as an attorney, auditor, medical consultant, or therapist); or a parent or student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks."

Hope this helps.