Loading...
HomeMy WebLinkAbout148-hipaa-or-ferpa-a-primer-on-school-health-information-sharing-in-californiaHIPAA or FERPA? A Primer on School Health Information Sharing in California CONFIDENTIAL The California School-Based Health Alliance (formerly CSHC) is pleased to offer this essential resource guide on navigating the complex interactions of HIPAA and FERPA in school health programs, including school health centers, school-based mental health programs, school nursing services, and other types of health services delivered on school campuses. We developed this guide to help schools and community providers clarify what student health information can be shared with whom, under a variety of circumstances. This information and the attached sample forms provide tools for further discussion with your own legal counsel in order to improve communication and coordination of student health services among school district and community health services providers. We recognize the great value of both district and community health agency programs to California students and their families. This guide is designed to help streamline our partnerships and systems so all students can be healthy and ready to learn! This guide and the attached sample forms were developed by Rebecca Gudeman, J.D., M.P.A., Senior Attorney at the National Center for Youth Law (NCYL). We thank Rebecca for her tireless work on this guide, for being such a well-informed advocate, and for helping us make sense of these complex laws and information-sharing guidelines. We join NCYL in thanking The California Wellness Foundation and The California Endowment for their generous support in the development of this guide. This is the second edition of this guide. It has been updated to further clarify and provide additional examples. The first edition was issued in January 2010. Thank you, Samantha Blackburn, RN, MSN Project Director California School-Based Health Alliance HIPAA or FERPA? A Primer on School Health Information Sharing in California Preface The California School-Based Health Alliance (formerly CSHC) is the statewide organization leading the movement to put health care where kids are -- in schools. Our mission is to promote the health and academic success of children and youth by increasing access to the high quality health care and support services provided by school health centers. We pursue this mission by advocating for public policies that support school-based health centers; building support among policymakers, community leaders, parents and students; and providing technical support to new and existing school-based health centers and other school-based health services programs. 1203 Preservation Park Way, Suite 302, Oakland CA 94612 phone (510) 268-1260 fax (510) 268-1318 info@schoolhealthcenters.org www.schoolhealthcenters.org The National Center for Youth Law (NCYL) uses the law to improve the lives of poor children. NCYL works to ensure that low-income children have the resources, support, and opportunities they need for a healthy and productive future. Much of NCYL’s work is focused on poor children who are additionally challenged by abuse and neglect, disability, or other disadvantage. 405 - 14th St., 15th Floor, Oakland, CA 94612-2777 phone (510) 835-8098 fax (510) 835-8099 info@youthlaw.org www.youthlaw.org © National Center for Youth Law February 2012 Overview HIPAA FERPA California Confidentiality Law The Details How do I know whether our school-based health program is subject to HIPAA or FERPA? Is it “better” for a school health program to operate under HIPAA or FERPA? Is it possible to operate under HIPAA and FERPA at the same time? What does it mean to have a provider’s records subject to FERPA? What does it mean to have a provider’s records subject to HIPAA? School Nurse Records and Communications Does HIPAA or FERPA apply to a school nurse’s records? Does FERPA apply if a school nurse is hired by the district with funds from an agency not subject to FERPA, such as a foundation or the Department of Public Health? May a school health provider operating under HIPAA disclose protected health information to the school nurse? School Mental Health Provider Records and Communications Does HIPAA or FERPA apply to a school district-employed mental health provider’s records? Does FERPA apply if a school mental health provider is hired by the district with funds from an agency not subject to FERPA, such as a community-based mental health agency or the Department of Behavioral or Mental Health? May a therapist disclose confidential mental health information subject to HIPAA to another medical or mental health provider absent written authorization from the minor patient or parent? May a therapist disclose information obtained in the course of counseling a student on the school campus, regarding the student’s threat to commit suicide? HIPAA or FERPA? A Primer on School Health Information Sharing in California Table of Contents 1 5 10 11 HIPAA or FERPA? A Primer on School Health Information Sharing in California Table of Contents Disclosing and Exchanging Information under HIPAA and FERPA May a school or district share information from the education record, such as schedule, attendance, discipline records or grades, with a school health provider operating under FERPA, for purposes of service provision? May a school or district share information from the education record with a school health program that is operating under HIPAA, for purposes of service provision? May a school or district share information from the education record with a school health provider not operating under FERPA if it is a health emergency? May a school health program disclose health information to the school absent authorization? For example, may a provider let a teacher know how a student is progressing in treatment? May a school or district disclose information to an outside contractor, such as a school health provider contracting with the district? May a school or district share information about students maintained in education records with an outside agency for purposes of research and evaluation? May school health programs operating under FERPA promise students that their parents will not have access to their health records? May a school or district share information about chronic disease, such as asthma and diabetes, with a school health provider operating under HIPAA absent parent consent? Sample Forms A: Consent to Health Care Treatment B: Student Consent to Health Care Treatment C: Authorization to Release Medical Information D: Minor’s Authorization to Release Medical Information E: Consent for Release of Educational Records F: Consent for Release of Student Medical Information from Education Record Guidance and Instructions for Sample Forms Disclaimer: This document is provided solely for reference purposes. It is not legal advice. 13 16 19 School-based health services and providers bring a range of needed health programs to a school campus. Physical and mental health programs are a critical component of the student support services needed for every child to succeed in school. These programs also provide an exciting opportunity to increase health care access for youth and improve care coordination and collaboration among community, public and private health care providers and schools. School-based health servic- es, including school health centers (SBHCs), can be operated and funded in a variety of ways. Some are operated by a large hospital, a community organiza- tion, or a local government agency; others are oper- ated by the school district or local education agency, and still others, by some combination of the above. When developing school-based health programs, there are several legal considerations that the health provider(s) and education agency should address early on. One of the most important is determin- ing which confidentiality laws control access to and disclosure of the school-based health program’s health care information. One of the first questions to address is whether the program’s information is subject to HIPAA or FERPA. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Family Educational Rights and Privacy Act (FERPA) are both federal laws that protect privacy and limit how certain personal information can be shared. FERPA limits disclosure of information in education records maintained by most schools, and HIPAA limits disclosure of health information main- tained by most health care providers. When health care providers work on school campuses, HIPAA or FERPA may apply to the provider’s records, depend- ing on a number of variables. In addition, California has state laws that protect the confidentiality of information held by schools and health providers that also may affect how and when information can be shared. Whether HIPAA 1 HIPAA or FERPA? A Primer on School Health Information Sharing in California or FERPA applies and how those interact with state confidentiality law will impact school-based health service operations in large and small ways – from framing how school staff and health providers collaborate; to shaping policies about how to deal with suicide threats and other emergencies; to determining the content of consent forms and other paperwork used by health services providers. For this reason, educational agencies and health care providers should carefully consider the HIPAA/ FERPA question when entering into an agreement to develop a school-based health program, be it for mental health or medical services. Overview HIPAA 1) 45 C.F.R. § 160.103 (defining “covered entity”). The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule protects the privacy of patient health information. The individuals and agencies that must follow the HIPAA Privacy Rule include health plans, health care clearinghouses, and “health care providers” who transmit health information in electronic form. The definition of “health care providers” covered by HIPAA is quite broad, and includes both individual providers such as physicians, clinical social workers, and other medical and mental health practitioners, as well as hospitals, clinics and other organizations 1 providers for treatment and referral purposes with- out need of a signed release. Other exceptions in HIPAA allow health care providers to share protect- ed health information in emergencies, for research, and for billing and payment purposes without need of an authorization. Additional exceptions also exist. Under HIPAA and California medical confidentiality law, the person who has the right to sign an authoriza- tion to release information will vary, depending in part on who consented for the underlying health care. 2 2) 45 C.F.R. § 160.103 (“Health care provider means a provider of services … a provider of medical or health services … and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.”). 3) 45 C.F.R. § 160.103 (“Health information means any information, whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual. Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium.….”). 4) 45 C.F.R. § 160.103 (“Protected Health Information…excludes individually identifiable health information in: (i) Education records covered by the Family Educa- tional Rights and Privacy Act, as amended, 20 U.S.C. §1232g; ….”). 5) See e.g. 45 C.F.R. § 164.502; Cal. Civ. Code § 56.10(c)(1); Cal. Welf. & Inst. Code § 5328(a). 6) For more information on who may authorize the release of protected health information in California, see page 7 of this guide. 7) See 45 C.F.R. Part 164; see Privacy Rights Clearinghouse, HIPAA Basics, available at www.privacyrights.org/fs/fs8a-hipaa.htm#3; see also Dept. of Health & Human Services, Covered Entity Chart, available at www.cms.hhs.gov/HIPAAGenInfo/Downloads/CoveredEntitycharts.pdf. 8) See footnote 3 above. that provide, bill for, or are paid for health care. Individual providers are only subject to HIPAA, if they “transmit health information in electron- ic form. (See inset.) The fact that an individual health provider does not use electronic records onsite in the clinic does not necessarily mean the provider is exempt from HIPAA. Providers may be transmitting electronic health informa- tion in another way, for example, by using a bill- ing service that does. In such cases, the provid- ers still must abide by HIPAA. (See resources in footnote 7 for more information.) The HIPAA Privacy Rule limits covered health care providers from disclosing what HIPAA calls “protected health information” (PHI). (See inset for definition of “protected health information”). Protected health information does not include information subject to FERPA. HIPAA explicitly states that health information held in an education record subject to FERPA is not “protected health information.” In other words, if FERPA applies, HIPAA does not, and FERPA and HIPAA can never apply to the same information at the same time. (See California law section for discussion of application of state law.) Generally, health care providers cannot disclose information protected by HIPAA without a signed authorization, though there are many exceptions to this general rule. For example, under an exception in HIPAA and California medical confidentiality law, health care pro- viders may share protected health and men- tal health information with other health care HIPAA or FERPA? A Primer on School Health Information Sharing in California 3 4 6 5 Transmission of health information in electronic form includes electronic billing or using a billing service that transmits information electronically, among other things.7 “Protected health information” is individually identifiable health information in any form, including oral communications as well as written or electronically transmitted information.8 Health and mental health care providers who transmit health information in electronic form are subject to HIPAA.[] 2 The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of students’ personal information held by “educational agencies or institutions” that receive federal funds under programs administered by the U.S. Secretary of Education. “Educational agencies or institutions” are defined as public or private institutions that receive federal education funding directly or indi- rectly, and either (1) provide direct instruction to students, such as schools, or (2) direct or control schools, such as school districts and state educa- tion departments. Most public schools and public school districts receive some form of federal education funding and therefore are considered “educational agencies or institutions” under FERPA. Organizations and individuals that contract with or consult for an educational agency also may be subject to or required to comply with the confidentiality restrictions in FERPA if certain conditions are met. These conditions are discussed in greater detail later in this document. FERPA controls disclosure of “personally identifi- able information” contained in “education records.” “Education records” are defined as records, files, documents, or materials recorded in any other format that contain information directly related to a student and are maintained by an educational agen- cy or institution, or a person acting for such agency or institution. “Personally identifiable informa- FERPA 3 8) 34 C.F.R. § 99.1(a). 9) See e.g. 34 C.F.R. § 99.31(a)(1)(i)(B)(“A contractor, consultant, volunteer, or other party to whom an agency or institution has outsourced institutional services or functions may be considered a school official under this paragraph provided that the outside party-- (1) Performs an institutional service or function for which the agency or institution would otherwise use employees; (2) Is under the direct control of the agency or institution with respect to the use and maintenance of education records; and (3) Is subject to the requirements of § 99.33(a) governing the use and redisclosure of personally identifiable information from education records.”). 10) 20 U.S.C. § 1232g (a)(4)(A); 34 C.F.R. § 99.3. 11) 34 C.F.R. § 99.3. 12) U.S. Dept. of Health and Human Services & U.S. Dept. of Educ., Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) To Student Health Records, November 2008, [hereinafter Joint Guidance], at page 2. 13) 34 C.F.R. § 99.3 (“ ‘Education Records’... (b) The term does not include: (1) Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the record.”). 14) See id. tion” means any information “that, alone or in com- bination, is linked or linkable to a specific student that would allow a reasonable person in the school community…to identify the student with reason- able certainty.” Most records created by a school employee are “educational records.” For example, the health records of students under age 18 maintained by a school nurse are part of the “education record,” as are immunization records housed in student edu- cation files. On the other hand, some information created by educational agencies or their employees is not part of the education record. For example, the personal “notes” of a school employee are not subject to FERPA. Personal “notes” are notes kept in the maker’s possession, used only as a memory aid, and not accessible to or shared with anyone except a temporary substitute. In addition, the health records of students 18 and older are not always “education records” subject to FERPA. HIPAA or FERPA? A Primer on School Health Information Sharing in California 8 9 10 11 12 13 14 Generally, FERPA prohibits educational agencies from releasing any personally identifiable informa- tion in the education record unless the agencies have written permission for the release. In most cases, a parent must sign that release. When students are eighteen years old or older, they usually sign their own release forms. There are exceptions in FERPA that allow agencies and schools to disclose information in some circumstances without need of a written release. For example, schools may share “directory” information about students with the public if the school and district have first followed certain proce- dures defined in FERPA. Another exception allows school staff to share information from the education record with “school officials” in the same school who have a “legitimate educational interest” in the information. Certain policies must be in place at the district level in order to implement this excep- tion. Additional exceptions also exist, including exceptions that allow sharing information in emer- gency situations, for research, and for school trans- fers, among others. 4 California also has state laws that protect the confidentiality of information held by schools and health providers, hospitals and clinics. Specifically, California’s Education Code protects the confidentiality of student records. For the most part, the rules and exceptions in California law parallel those found in FERPA. The confidentiality of health and mental health information is protected by many different state statutes in California. Two of the most comprehen- sive statutes are found in the Civil Code and the Welfare and Institutions Code. These laws parallel HIPAA in many ways; however, in some situations, they actually provide greater confidential- ity protection than HIPAA. When state law provides greater confidentiality protection than HIPAA, providers usually must follow the state law. For example, California medical confidentiality law explicitly limits parent access to “minor consent” health information where HIPAA does not. California providers must abide by this state law limiting parent access. Another important differ- ence between HIPAA and California law is that California confidentiality law can apply to health information in an education record subject to FERPA. Therefore, FERPA and California medical confidentiality law may apply to the same information at the same time. HIPAA or FERPA? A Primer on School Health Information Sharing in California 20 21 23 California Confidentiality Law 15) 34 C.F.R. §§ 99.3, 99.31. 16) The scope of the term “directory information” will depend on district policy, but can include the following: the student’s name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution attended by the student. 20 U.S.C. §1232g(a)(5)(A); Cal. Educ. Code §§ 49073; 49061(c). 17) The term “school official” includes school staff, such as teachers, counselors, and school nurses. A school or district may define this term more broadly in its School Board Policies so that it also includes outside consultants, contractors or volunteers to whom a school has outsourced a school function if certain condi- tions are met. See 34 C.F.R. § 99.31(a)(1)(i). 18) 20 U.S.C. §1232g (b)(1); 34 C.F.R. § 99.31(a)(1)(i)(A). 19) See 34 C.F.R. § 99.31. 20) Cal. Ed. Code § 49060-49085. 21) Cal. Civ. Code §§ 56-56.37; Cal. Welf. & Inst. Code §§ 5328-5329. 22) “Minor consent” health information refers to protected health information created when a minor consented for the under lying health care or could have consented to that care under state and federal law. 23) Cal. Health & Saf. Code § 123115(a); 45 C.F.R. § 164.502(a) and (g). 16 15 19 18 17 22 5 How do I know whether our school-based health program is subject to HIPAA or FERPA? Whether the records of a school health program or provider are subject to HIPAA or FERPA will depend in part on whether the program or provider can be considered an “educational agency” or the agent of one, and this will depend on a number of factors. While there is no clear-cut checklist to apply, Joint Guidance issued by the U.S. Department of Education (DOE) and the U.S. Department of Health and Human Services (DHHS) provides some case examples that suggest factors these agencies would use to determine which law applies. In addition, several compliance letters issued by DOE provide case examples that shed light on how DOE interprets FERPA. Here are some examples from the Joint Guidance and DOE letters: HIPAA applies: • The University of New Mexico asked the U.S. Department of Education for some guidance regarding the intersection of FERPA and state law in relation to the University’s student health center medical records. In its response, the DOE addressed, as a preliminary matter, whether a student health center’s records are “education records” subject to FERPA. The DOE said that the health records of a campus based health center are not subject to FERPA “if the center is funded, administered and operated by or on be- half of a public or private health, social services, or other non-educational agency or individual.” • In Joint Guidance issued by DOE and DHHS, DOE and DHHS posed the question: “Does FERPA or HIPAA apply to records maintained by a health care provider not employed by a school?” 24) U.S. Dept. of Educ., Family Policy Compliance Office, Letter to Ms. Melanie P. Baise, University of New Mexico, November 29, 2004, available at www.ed.gov/policy/gen/guid/fpco/ferpa/library/baiseunmslc.html 25) Joint Guidance at page 5. 26) Joint Guidance at page 4. Their response was as follows: “Some outside parties provide services directly to students and are not employed by, under contract to, or otherwise acting on behalf of the school. In these circumstances, these records are not ‘education records’ subject to FERPA, even if the services are provided on school grounds, because the party creating and maintaining the records is not acting on behalf of the school. For example, the records created by a public health nurse who pro- vides immunization or other health services to students on school grounds or otherwise in connection with school activities but who is not acting on behalf of the school would not be ‘education records’ under FERPA.” FERPA applies: • In the Joint Guidance, DOE and DHHS posed the question: “Does FERPA or HIPAA apply to records maintained by a health care provider not employed by a school?” Their response was as follows: “If a person or entity acting on behalf of a school subject to FERPA, such as a school nurse that provides services to students under contract with or otherwise under the direct control of the school, maintains student health records, these records are education records under FERPA, just as they would be if the school maintained the records directly. This is the case regardless of whether the health care is provided to students on school grounds or off-site.” • DOE and DHHS also suggest that a health provider or program’s records will be subject to FERPA if the program is administered by HIPAA or FERPA? A Primer on School Health Information Sharing in California Th e Details 24 25 26 27) Joint Guidance HIPAA or FERPA? A Primer on School Health Information Sharing in California POINTS TO REMEMBER A school health program’sinformation is subject to HIPAA if the program is funded, administered and operated by or on behalf of a public or private health, social services, or other non-educational agency or individual. A school health program’s records are subject to FERPA if the program is funded, administered and operated by or on behalf of a school or educational institution. and under the direct control of an educational agency and is providing what can be considered “institutional services” – even if those services are funded entirely by an outside agency. The Joint Guidance provides this example: “Some schools may receive a grant from a foundation or government agency to hire a nurse. Notwith- standing the source of the funding, if the nurse is hired as a school official (or a contractor), the records maintained by the nurse or clinic are ‘education records’ subject to FERPA.” If the relationship between the school health provider and the educational institution falls somewhere in between the scenarios presented above, the provider agency and educational institution should seek advice from their respective legal counsel on whether the records of the health program and its staff are subject to FERPA or HIPAA. 6 FERPA and HIPAA never apply to the same information at the same time.[] FERPA and California confidentiality law may apply to the same information at the same time. [] 27 Is it “better” for a school health program to operate under HIPAA or FERPA? It depends. In many ways, the two federal laws are similar. Both protect the privacy of personal infor- mation. Both require a signed authorization before records can be released, and both allow sharing of information with certain individuals and agencies even without a signed release in certain situations. Where HIPAA and FERPA differ is in the details, and some of these differences are very important to school health program operations. For example, the person who signs the release of records form differs under FERPA and HIPAA in some circumstances. Under FERPA, a “parent” must sign the release on behalf of his or her minor child. Under HIPAA and California medical confidentiality law, a “parent” must sign for a minor in most cases, - however the minor student must sign if the records have to do with health care services for which the minor consented or could have consented under state law. Similarly, a parent’s right to ac- cess records is different under each law. Parents have a right to access all records subject to FERPA regarding their minor child. By contrast, parents do not have a right to access all medical records subject to HIPAA and California medical confidentiality law regarding their minor child. Under California state law, parents cannot access those records if 28) 20 U.S.C. § 1232g(b)(1). FERPA defines “parent” as a “natural parent, a guardian or an individual acting as a parent in the absence of a parent or guardian.” 34 C.F.R. § 99.3. 29) Cal. Civ. Code § 56.11(c). 30) 20 U.S.C. §1232g(a)(1)(A). 31) See Gudeman, “Minor Consent, Confidentiality and Child Abuse Reporting in California” for detailed legal information on HIPAA and state medical confi- dentiality law, available at www.TeenHealthLaw.org. 32) Cal. Health & Saf. Code § 123115(a). 33) See Gudeman, “Minor Consent, Confidentiality and Child Abuse Reporting in California” for detailed legal information on HIPAA and state medical confi- dentiality law, available at www.TeenHealthLaw.org. (1) a provider determines that parent access would “have a detrimental effect on the provider’s profes- sional relationship with the minor patient or the mi- nor’s physical safety or psychological well-being,” or (2) if the records relate to health care for which the minor consented or could have consented on his or her own. In the latter situation, parents must have the minor’s permission in order to inspect medical records. This distinction is particularly important to consider if a school health program is going to provide any “minor consent” services. In California, “minor consent” services include pregnancy related care, STD testing, treatment and preventive care, drug and alcohol abuse counseling, and mental health counseling, among others. The individuals and agencies with whom a school health provider can exchange information without a signed release also vary under each law. For example, FERPA allows school employees to disclose records subject to FERPA to teachers and other “school officials” without need of a release, as long as that school official has a “legitimate educational interest” in the information. No similar excep- tion exists in HIPAA; a health provider whose records are subject to HIPAA cannot dis- close information to a teacher without a signed authoriza- tion to release. By contrast, HIPAA and California medi- cal confidentiality law allow health providers to disclose protected health information for treatment purposes to a provider in another agency or HIPAA or FERPA? A Primer on School Health Information Sharing in California 28 29 30 31 32 33 7 A parent’s right to access records is different under HIPAA and FERPA. The individuals and agencies with whom a school health provider can exchange information (absent a signed release) also vary under HIPAA and FERPA. POINTS TO REMEMBER 34) See 45 C.F.R. § 164.512(j); 34 C.F.R. §§ 99.31, 99.36. HIPAA or FERPA? A Primer on School Health Information Sharing in California clinic who is working with the same client. FERPA does not contain a similar exception. Even where similar exceptions exist under both laws, they can apply in different ways. For example, under both HIPAA and FERPA, providers may disclose protected information when a youth is in danger, but how danger is defined under each law and to whom the provider may disclose that information is differ- ent under HIPAA and FERPA. This is not a complete list of the differences between HIPAA and FERPA, but it gives a taste for the distinctions. Whether it is “better” to operate under HIPAA or FERPA really depends on the school health program’s particular situation – its goals, the collaborative priorities it has, the client population, and the types of services it will provide, among other things. In some cases, a school and an outside provider will have the opportunity to set up their relationship in a way that allows them to “choose” whether HIPAA or FERPA will apply to the school provider’s records. They should think carefully about their collaborative priorities and goals in making that choice. Ultimately, no matter which law protects a school health provider’s records, the most important thing is to be clear and consistent in its application. Legal counsel can help agencies determine which law applies and how to implement it consistently. 8 34 35) 45 C.F.R. § 160.103(“Protected health information excludes individually identifiable health information in: (i) Education records covered by the Family Educa- tional Rights and Privacy Act, as amended, 20 U.S.C. §1232g; ….”). 36) Nat’l Forum on Education Statistics, “Forum Guide to Protecting the Privacy of Student Information: State and Local Education Agencies,” NCES 2004–330, Washington, DC: 2004. Available at http://nces.ed.gov/pubs2004/2004330.pdf. 37) Pritts, “Implementing the Federal Health Privacy Rule in California: A Guide for Health Care Providers,” California HealthCare Foundation Health Privacy Project 2002, available at www.chcf.org/topics/view.cfm?itemID=19670. Is it possible to operate under HIPAA andFERPA at the same time? No. HIPAA explicitly states that its rules do not apply to health information held in an education record subject to FERPA. Therefore, if FERPA applies, HIPAA does not. FERPA and HIPAA can never apply at the same time. However, state medical confidentiality law does not have this same exception. Therefore, state confidentiality law can apply to health information held in an education record subject to FERPA. What does it mean to have a provider’s records subject to FERPA? If a school health program’s records are subject to FERPA, the program must meet all the requirements of FERPA. This includes making sure the program has a FERPA-compliant release of information form but includes other considerations as well. The National Forum on Education Statistics has a guide to implementing FERPA. Below we provide some FERPA-compliant sample consent and confidentiality forms that can be adapted, with guidance from legal counsel, to create your own forms. What does it mean to have a provider’s records subject to HIPAA? If a school health program’s records are subject to HIPAA, the program must meet all the requirements of HIPAA. This includes making sure the clinic has a “Notice of Privacy Practices” and HIPAA-compliant release forms, among many other things. The California HealthCare Foundation has a guide to implementing HIPAA for California health care providers. Below we provide some HIPAA- and California state law-compliant sample consent and confidentiality forms that can be adapted, with guidance from legal counsel, to create your own forms. HIPAA or FERPA? A Primer on School Health Information Sharing in California 35 36 37 9 Does FERPA apply if a school nurse is hired by the district with funds from an agency not subject to FERPA, such as a foundation or the Department of Public Health? Yes, FERPA still applies. The Joint Guidance from the U.S. Departments of Education and Health and Human Services addresses this question: “Some schools may receive a grant from a foundation or government agency to hire a nurse. Notwithstand- ing the source of the funding, if the nurse is hired as a school official (or a contractor [of the educational agency]), the records maintained by the nurse or clinic are ‘education records’ subject to FERPA.” (Emphasis added.) May a school health provider operating under HIPAA disclose protected health information to the school nurse? In most cases, yes. HIPAA and California law permit health care providers to disclose protected health information to other health care providers for “treatment” purposes. HIPAA defines “treatment” broadly in this context to include coordination or management of health care, consultation and referral as well as direct treatment. It is important to note that once disclosed to the school nurse, if the school nurse places the information in the pupil file, FERPA likely will apply when determining access to the information in the file, not HIPAA. 38) 20 U.S.C. § 1232g(a)(4)(A). 39) 34 C.F.R. § 99.3. 40) See id. 41) Joint Guidance at page 4. 42) 45 C.F.R. § 164.501. 43) Joint Guidance at page 2. Does HIPAA or FERPA apply to a school nurse’s records? Student health records maintained by a school nurse are usually part of the education record subject to FERPA. However, California medical confidentiality law also may apply to health information held by a school nurse, and in some cases, HIPAA will apply instead of FERPA. In general, a school nurse’s records are considered “education records” subject to FERPA, as they con- tain information related to a student and were cre- ated and are being maintained by a school employee or agent. There are a few situations in which student health information maintained by a school employee would not be part of the “education record” subject to FERPA. Here are just two examples: (1) If any student’s personal health information is in a school nurse’s “personal notes” and it meets the definition of “personal notes” under FERPA, it is not subject to FERPA. (2) If the student health record is about a student eighteen years old or older, and the record meets the definition of “treatment record,” then the record is not subject to FERPA. If not subject to FERPA, the records may be subject to the HIPAA Privacy Rule, but only if the school nurse is a “covered entity” as defined in HIPAA. California medical confidentiality law likely would apply to the nurse’s records as well, even those held in the education file. If FERPA and California law conflict regarding disclosure or protection, school nurses should seek guidance from their legal counsel about how to proceed. HIPAA or FERPA? A Primer on School Health Information Sharing in California 41 38 39 40 43 42 Sch ool Nurse Records & Communications 10 44) 20 U.S.C. § 1232g(a)(4)(A). 45) 34 C.F.R. § 99.3. 46) See id. 47) Joint Guidance at page 4. Does FERPA or HIPAA apply to a school district-employed mental health provider’s records? Student health records maintained by a district-employed school psychologist or other licensed counselor usually are part of the education record subject to FERPA. However, California medical confidentiality law also may apply to health information held by a school counselor, and in some cases, HIPAA will apply instead of FERPA. In general, a school therapist’s records are consid- ered “education records” subject to FERPA, as they contain information related to a student and were created and are being maintained by a school employee or agent. There are a few situations in which student health informa- tion maintained by a school em- ployee would not be part of the “education record” subject to FERPA. Here are just two examples: (1) If any student’s personal health information is in a school therapist’s “personal notes” and it meets the definition of “personal notes” under FERPA, it is not subject to FERPA. (2) If the student health record is about a student eighteen years old or older, and the record meets the definition of “treatment record,” then the record is not subject to FERPA. If not subject to FERPA, the records may be subject to the HIPAA Privacy Rule, but only if the school clinician is a “covered entity” as defined in HIPAA. California medical confidentiality law likely would apply to the school therapist’s records as well, even those held in the education file. If FERPA and Cali- fornia law conflict regarding disclosure or protec- tion, school nurses should seek guidance from their legal counsel about how to proceed. Does FERPA apply if a school mental health provider is hired by the district with funds from an agency not subject to FERPA, such as a community-based mental health agency or the Department of Behavioral or Mental Health? Yes, FERPA most likely still applies, though it may depend on whether the mental health provider is acting as a school employee. The Joint Guidance from the U.S. Departments of Education and Health and Human Services addressed this question in relation to school nurses: “Some schools may receive a grant from a foundation or government agency to hire a nurse. Notwithstand- ing the source of the funding, if the nurse is hired as a school official (or a contractor [of the educa- tional agency]), the records maintained by the nurse or clinic are ‘education records’ subject to FERPA.” (Emphasis added.) The same rule the Department of Education laid out above for hiring school nurses likely applies to other health providers employed by a school district. If the providers are employed by the district and hired to fill an institutional position, then their records would be considered “education records” subject to FERPA. Counselors may want to seek further guidance from their legal counsel on this question. HIPAA or FERPA? A Primer on School Health Information Sharing in California 44 45 46 47 School Mental Health Provider Records and Communications 11 48) See 45 C.F.R. § 164.506; Cal. Civ. Code § 56.10(c)(1); Cal. Welf. & Instit. Code § 5328(a). 49) 34 C.F.R. §§ 99.31(a)(10)& 99.36(a); U.S. Dept. of Educ. Family Compliance Policy Office, Letter to University of New Mexico re: Applicability of FERPA to Health and Other State Reporting Requirements, Nov. 29, 2004, available at www.ed.gov/policy/gen/guid/fpco/ferpa/library/baiseunmslc.html. 50) 45 C.F.R. §164.512(j). 51) 45 C.F.R. § 164.50 8 (a)(2)(ii); 45 C.F.R. § 164.501. 52) Cal. Civ. Code § 56.10 (c)(19)(“The information may be disclosed, consistent with applicable law and standards of ethical conduct, by a psychotherapist, as defined in Section 1010 of the Evidence Code, if the psychotherapist, in good faith, believes the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a reasonably foreseeable victim or victims, and the disclosure is made to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.”). May a therapist disclose confidential mental health information subject to HIPAA (such as medications or test results) to another medical or mental health provider absent written au- thorization from the minor patient or parent? In some cases, yes. For example, HIPAA and California medical confidentiality law permit men- tal health providers to share information related to outpatient care with other health and mental health care professionals for purposes of diagnosis, treat- ment or referral, without requiring written authori- zation for the release. The therapist has discretion to determine what disclosures are appropriate in these cases. Providers also are allowed to disclose infor- mation to other providers absent authorization in a few other circumstances, such as in certain medical emergencies. (See the following question for more.) Exactly when and to whom such information can be disclosed will depend on which California law the therapist is providing services under. Therapists should consult their own legal counsel for more information and guidance on which California confidentiality law applies to their records. May a therapist disclose information obtained in the course of counseling a student on the school campus, regarding the student’s threat to commit suicide? Yes, FERPA, HIPAA, and California medical con- fidentiality law all permit such disclosure without consent under certain “dangerous” conditions. If the therapist operates under FERPA, the therapist may disclose personal information in education records to “appropriate parties” if the therapist reasonably determines that the student’s statements indicate a serious and imminent threat to the student’s health or safety. If the therapist operates under HIPAA, the therapist may disclose the relevant information to any person who is reasonably able to prevent a serious or imminent threat to the health or safety of a person. Therapists are even permitted to disclose psychotherapy notes without authorization under emergency circumstances. Under California law, a therapist may disclose protected health information as necessary to prevent or lessen a threat to the health or safety of a reason- ably foreseeable victim or victims. Exactly when and to whom such information can be disclosed will depend on which California law the therapist is providing services under. For example, if the therapist is subject to the Civil Code, disclosure of information may be to any person reasonably able to prevent or lessen the threat, including the target of the threat. Therapists should consult their own legal counsel for more information and guidance on which California confidentiality law applies to their records. HIPAA or FERPA? A Primer on School Health Information Sharing in California 49 50 51 52 48 12 May a school share information from the education record with a school health provider not operating under FERPA if it is a health emergency? Yes. A school employee may disclose information contained in the education record with appropri- ate parties in an emergency, without needing parent consent. However, the definition of emergency is strictly limited under FERPA. The U.S. Department of Education interprets emergency to be “a specific situation that presents imminent danger” or requires an immediate need for information to avert a serious threat. The emergency situation must be evaluated on an individual basis. May a school health program disclose health information to the school absent authori-zation? For example, may a provider let a teacher know how a student is progressing in treatment? It depends on whether the school health program operates under HIPAA or FERPA. If the program operates under HIPAA, no. There is no exception under HIPAA that would allow a school health program to share protected health information with a teacher absent written authorization. Under California medical confidentiality law, the student must provide the authorization if the information to be disclosed is about a minor consent service. The parent or guardian must provide the authorization in most other cases. If the school health program operates under FERPA, however, program providers may share health infor-mation in the education record with the teacher to the extent that the teacher has a legitimate educa-tional interest in the information disclosed. May a school or district share information from the education record, such as schedule, attendance, discipline records or grades, with a school health provider operating under FERPA, for purposes of service provision? Yes. The information can be released if the par- ent provides written consent. If there is no written consent, the school can release information in some circumstances. For example, FERPA permits disclosure of information in the education record to “school officials” with a legitimate educational inter- est in the information. Before exercising this dis- closure option, schools must assure that the required annual notice to parents defines school official and legitimate educational interest in a way that would cover this type of disclosure to a school health pro- gram. The school health program will be required to protect the information subject to FERPA. May a school or district share information from the education record with a school health program that is operating under HIPAA, for purposes of service provision? Yes. The information can be released if the parent provides written consent. If there is no written consent, the school can release limited information in some circumstances. For example, the school may give the provider access to “directory information” about a specific student absent parent consent. What that would include will depend on how directory information has been defined by that school district in its annual notice to parents and whether parents have opted out. In addition, the school also may disclose to the provider information that is not contained in the education record, such as information from oral communications or personal observation. 53) 20 U.S.C. § 1232g(b)(1); see footnotes 18 and 19 infra for description. 54) 34 C.F.R. § 99.33(a)(1). 55) See FERPA section, infra., on page 3. 56) U.S. Dept. of Educ. Family Compliance Policy Office, Letter to University of New Mexico re: Applicability of FERPA to Health and Other State Reporting Requirements, Nov. 29, 2004, available at www.ed.gov/policy/gen/guid/fpco/ferpa/library/baiseunmslc.html. 57) 20 U.S.C. § 1232g(b)(1). HIPAA or FERPA? A Primer on School Health Information Sharing in California 53 54 55 56 Disclosing and Exchanging Information under FERPA & HIPAA 57 13 May a school or district disclose information to an outside contractor, such as a school health provider contracting with the district? The U.S. DOE says yes, as long as the relationship between the contractor and the educational agency meets certain requirements and the educational agency makes sure that the contractor will not fur-ther disclose the information. According to guidance from the U.S. Department of Education, “agencies and institutions subject to FERPA are not precluded from disclosing education records to parties to whom they have outsourced services so long as they do so under the same condi-tions applicable to school officials who are actually employed.” The guidance reminds districts that “an educational agency or institution may not disclose education records without prior written consent merely because it has entered into a contract or agreement with an outside party. Rather, the agency or institution must be able to show that: 1) The outside party provides a service for the agency or institution that it would otherwise provide for itself using employees; 2) The outside party would have ‘legitimate educa-tional interests’ in the information disclosed if the service were performed by employees; and 3) The outside party is under the direct control of the educational agency or institution with respect to the use and maintenance of information from educa-tional records.” The guidance reminds districts that they remain completely responsible for their contractor’s compli- ance with FERPA requirements in these situations and states “For that reason, we recommend that these specific protections be incorporated into any contract or agreement between an educational agency or in-stitution and any non-employees it retains to provide institutional services.” The U.S. Department of Edu-cation adds that if the school has not “listed contrac-tors and other outside service providers as ‘school officials’ in its annual § 99.7 FERPA notification, then it is required to record each disclosure to a qualifying contractor in accordance with § 99.32(a).” May a school or district share information about students maintained in education records with an outside agency for purposes of research and evaluation? Yes. Schools may release de-identified information to organizations doing research as long as sharing that data would be in the best educational inter-ests of students. In addition, schools may release individual information from education records to organizations conducting studies for, or on behalf of, educational agencies or institutions, if the purpose of the study is to develop, validate, or administer predictive tests; administer student aid programs; or improve instruction. Before releasing information to a research organiza-tion, the school must enter a written agreement with the research institution that includes specific com-mitments on the part of the organization in relation to the research, as detailed in FERPA. The studies must be conducted so that students and parents cannot be identified by persons outside of such organizations, and the information must be destroyed when no longer needed. The California 58) U.S. Dept. of Educ., Family Policy Compliance Office, “Letter to Clark County School District (NV) re: Disclosure of Education Records to Outside Service Providers,” June 28, 2006, available at www.ed.gov/policy/gen/guid/fpco/ferpa/library/clarkcty062806.html 59) See id. 60) 34 C.F.R. § 99.31(b)(“(1)De-identified records and information. An educational agency or institution, or a party that has received education records or infor- mation from education records under this part, may release the records or information without the consent required by § 99.30 after the removal of all personally identifiable information provided that the educational agency or institution or other party has made a reasonable determination that a student’s identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information.(2) An educational agency or institution, or a party that has received education records or information from education records under this part, may release de-identified student level data from education records for the purpose of education research by attaching a code to each record that may allow the recipient to match information received from the same source, provided that-- (i) An educational agency or institution or other party that releases de-identified data under paragraph (b)(2) of this section does not disclose any information about how it generates and assigns a record code, or that would allow a recipient to identify a student based on a record code; (ii) The record code is used for no purpose other than identifying a de-identified record for purposes of education research and cannot be used to ascertain personally identifiable information about a student; and (iii) The record code is not based on a student’s social security number or other personal information.”). 61) 34 C.F.R. § 99.31(b); Cal. Ed. Code § 49074(“Nothing in this chapter shall preclude a school district from providing, in its discretion, statistical data from which no pupil may be identified to any public agency or entity or private nonprofit college, university, or educational research and development organization when such actions would be in the best educational interests of pupils.”). 62) 34 C.F.R § 99.31(a)(6)(ii)(C). See also Cal. Ed. Code § 49076(b)(5). 63) 34 C.F.R. § 99.31(a)(6). HIPAA or FERPA? A Primer on School Health Information Sharing in California 59 58 62 60 61 14 63 Education Code contains a research exception with slightly different requirements. If the research organization is operating under contract with and is controlled by the school district, the school district also can share personally identifi-able information with the organization. In addition, a school or school district may share information in personally identifiable form with an outside party who is an authorized representative of certain federal, state and local agencies for purposes of audit or evaluation of education programs. The outside party must protect the information in a way that does not allow personal identification of individuals, except by officials within the agency. The informa-tion must be destroyed when no longer needed. The outside party must be subject to the same FERPA requirements regarding use and disclosure of infor-mation as apply to the school district. A longer de-scription of this exception can be found on the U.S. Department of Education website, at www.ed.gov/policy/gen/guid/fpco/hottopics/ht12-17-08.html. May a school health program operating under FERPA promise students that their parents will not have access to their health records? For the most part, no. The records of school health programs operating under FERPA are part of the education record, and under FERPA, parents have a right to inspect the education record of their minor child if they choose to do so. There is no exception under FERPA that limits parent inspection rights simply because the information in the record per-tains to health care services, or to “minor consent” services, with one caveat. Parents often do not have the right to inspect health information of students eighteen and older, though there are exceptions to this rule as well. It is important to note that while parents cannot be prevented from viewing “minor consent” health information in the education record, FERPA contains no affirmative obligation that requires schools to inform parents about “minor consent” health care services that a student may have received. Further, FERPA only allows parents a right to inspect “education records.” To the extent school health services providers hold information that is not in the education record (such as informa-tion in oral form or in personal notes) the informa-tion would not be subject to FERPA. It should be noted that this answer does not take into account state medical confidentiality law, which may apply to the same records at the same time as does FERPA. Obligations under FERPA and state medical confidentiality law regarding parent access may conflict at times. Providers should seek guid-ance from their own legal counsel. May a school or district share information from the education record about chronic disease, such as asthma and diabetes, with a school health provider operating under HIPAA absent parent consent? No. Disclosure of information in the education file about a student’s chronic conditions to a school-based provider operating under HIPAA is not per-mitted without parent consent. One limited excep-tion would be in case of an emergency. Information from the education record may be disclosed without parent consent to protect the health or safety of a student or other individual in an emergency. However, this exception has been strictly interpreted by the U.S. Department of Education. The emergen-cy must be a specific situation that requires immediate need for disclosure of the information. For example, the emergency exception could not be used to send a list of all students with asthma or diabetes to the school-based health center. 64) Cal. Ed. Code § 49076(b)(“School districts may release information from pupil records to the following: …(5) Organizations conducting studies for, or on behalf of, educational agencies or institutions for the purpose of developing, validating, or administering pre- dictive tests, administering student aid programs, and improving instruction, if the studies are conducted in a manner that will not permit the personal identifica- tion of pupils or their parents by persons other than representatives of the organizations and the information will be destroyed when no longer needed for the purpose for which it is obtained.”). 65) 34 C.F.R. §§ 99.31 (a)(3); 99.35. See also U.S. Dept. of Educ. Dear Colleague Letter, dated December 12, 2008, available at www.ed.gov/policy/gen/guid/fpco/ hottopics/ht12-17-08.html. 66) 34 C.F.R. § 99.10. 67) 34 C.F.R. § 99.5. 68) U.S. Dept. of Educ. Family Compliance Policy Office, Letter to University of New Mexico re: Applicability of FERPA to Health and Other State Reporting Requirements, Nov. 29, 2004, available at www.ed.gov/policy/gen/guid/fpco/ferpa/library/baiseunmslc.html. HIPAA or FERPA? A Primer on School Health Information Sharing in California 65 66 68 15 64 67 Form A - Caregiver Authorization Affidavit: Some youth live with a caregiver who does not have legal custody of them, such as a grandparent. State law allows caregivers to consent to health care for minors living with them in some circumstances. To do so, the caregiver must complete a “caregiver authoriza- tion affidavit” (attached to Form A). For further guid- ance on obtaining consent from a caregiver, school health services providers should review the caregiver affidavit and consult their legal counsel. Form A – Bullet Point (1): If this sample form is adopted as a guide, the list of services under bullet point (1) should be adapted to include the services that your school health program provides. Should parents include exceptions under bullet point (1), those exceptions should be documented in the student’s chart. However, it is important to remem- ber that parents cannot prevent their children from obtaining “minor consent” services. Should a parent request that his or her child be prohibited from receiving any “minor consent” services available through your school health program, health providers should discuss the parent’s concerns with him or her. Providers also may consider the note on page two of the consent form. Form A – “Additional Information” Section: School health services providers, in consultation with legal counsel, should decide whether they want to include a note explaining “minor consent” health care on their consent form. For some, it may not be rele- vant. Their program may be in an elementary school, for example, or they may not provide any “minor consent” services. Others prefer not to advertise the full range of services their clinic provides. If your program, such as a school health center, does offer “minor consent” services, you may consider includ- ing this section as part of your parent education, to encourage communication, and to avoid any confu- sion. Just as with written consent to treatment, this note is not mandated by law. Attached you will find some sample consent and release forms for use in school health programs, and general information and instructions relating to each form. All sample forms are provided for reference purposes only. They must be adapted for individual use to take into account, among other things, the services your school-based health program provides; its partnerships; community-specific concerns; local policies and strategies; and your community’s literacy level and language needs. They also should be reviewed with local counsel to address strategic issues and confirm they are in compliance with applicable law and policy. Consider the following sample forms as a reference: If your school health program is subject to: FERPAHIPAA/CA law Form A – Consent to Treatment Form A – Consent to Treatment Form B – Student Consent to Treatment Form B – Student Consent to Treatment Form D – Student Authorization to Release Medical Information Form C – Authorization to Release Medical Information Form F – Consent for Release of Student Medical and Educational Records Form E - Consent for Release of Educational Records Forms A and B - Consent to Treatment Nothing in state or federal law requires that health care providers obtain written consent before provid- ing ordinary health care services, with only a few exceptions not applicable to the school health setting. Consent may be obtained in person or over the telephone and noted in the patient’s medical chart. For many reasons, though, health care provid- ers may choose to request written consent. This form is intended to help providers keep a record of consent to health care services. For further guidance on consent and when written consent is advisable, and for assistance adapting these forms, school health providers should consult their own legal counsel. HIPAA or FERPA? A Primer on School Health Information Sharing in California Guidance & Instructions for Sample Forms 16 Form B – When to Use: Minors may consent to cer- tain types of medical services on their own behalf, without need for parent consent. This form is only applicable if your school health program offers any “minor consent” services. Form B - Bullet Point (1): School health services providers should be familiar with “minor consent” law and which students may be eligible to consent for their own health care. Again, providers should consult legal counsel for information. Forms C and D - Authorization to Release Medical Information Under federal and California state law, health and mental health care providers subject to HIPAA may share confidential medical information with other health care providers for referral and treatment purposes without need of a signed release. However, the provider must have a signed release in order to share information with many others, including teachers and other school staff who are not health professionals. These forms are intended for that purpose. It is important to remember that once health information is disclosed pursuant to this form, the information may not be protected by health confidentiality law in the same way. This is noted on page two of the form. These forms must be in 14-point type to comply with California law (Civil Code§ 56.11). They also cannot be combined with any other consent forms or they will be considered invalid under HIPAA. Providers should consult their legal counsel to adapt these forms and for further guidance on require- ments for obtaining authorization for release of medical information. Form D – When to Use: In California, minors control the release of medical information related to services for which they have consented or could have consented. This form is intended to meet the legal requirements for obtaining written authorization to release medical information from minors. To adapt this form, and for guidance on specific requirements for obtaining authorization for release of information related to minor consent services, providers should consult their legal counsel. Forms C and D – Bullet Point (1): School health providers should modify the list of information that may be disclosed so that it is relevant to the program’s needs. Providers should make an effort not to draft this section overly broadly. It is not appropriate to ask parents and students to waive all their confidentiality protections when it is not necessary. Forms C and D – Bullet Point (2): School health providers should modify this list so that it references the collaborative partners of the program. Descrip- tive names of agencies or teams should be used whenever possible. (e.g., Franklin High Special Ed Multidisciplinary team, consisting of school principal, school nurse, … etc). Forms C and D – page two, point two under Notices: School health providers should decide to whom revocations should be sent and state that informa- tion clearly as per the directions in this subsection. Form C – When to Use: Parents generally control the release of medical information about their children. This form is intended to meet the legal requirements for obtaining written authorization to release medical information from parents. To adapt this form, and for guidance on when parents may consent to the release of medical information for their child, and exceptions to that rule, providers should consult their legal counsel. HIPAA or FERPA? A Primer on School Health Information Sharing in California17 Form E - Consent for Release of Education Records Under federal and state laws, schools and school staff whose records are subject to FERPA may share information from the education record with other school staff for “legitimate educational purposes” without need of a signed release. However, the school must have a signed consent to release infor- mation in order to share information with most others, including health care providers not subject to FERPA (even those working on campus). This permission form will allow school staff to share information such as attendance records with outside agency health providers. School health providers should modify the list of information to be disclosed in the second paragraph so that it is relevant to the program’s needs. School health providers should make an effort not to draft this section overly broadly. It is not appropriate to ask parents and students to waive all their confiden- tiality protection when it is not necessary. To adapt this form, and for guidance on specific requirements for obtaining consent for release of educational information, providers should consult their legal counsel. Form F - Consent for Release of Student Medical Information from Education Record Schools and health providers whose records are subject to FERPA may share information from their records with each other for “legitimate educational purposes” as that is defined by district policy; how- ever, they may share only limited information with outside agencies without parent permission. This permission form will allow schools and health pro- viders subject to FERPA to share medical informa- tion held in an “education record.” This form must be in 14-point type to comply with California law (Civil Code§ 56.11). School health providers should modify the list of information to be disclosed in the second paragraph so that it is rel- evant to the program’s needs. School health provid- ers should make an effort not to draft this section overly broadly. It is not appropriate to ask parents and students to waive all confidentiality protection when it is not necessary. HIPAA or FERPA? A Primer on School Health Information Sharing in California 18 Parents generally control the release of medical information about their children. This form is intended to meet the legal requirements for obtaining written authorization from parents to release medical and education information maintained in their minor child’s education record, with one exception. This form is not intended to cover release of medical information concerning minor consent services. Providers should consult their legal counsel for guidance on obtaining consent for release of minor consent information in the education record. Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.   SAMPLE FORM A Consent to Health Care Treatment at [insert name of school based health clinic or provider] [Insert name of health services clinic or provider] provides health care services to students at [insert name of school]. Please read this form carefully and provide all the requested information to allow your child to receive health services at school. Student/Patient Information Name:__________________________________ Date of birth:____________ Grade:______ Address:_____________________________________________________________________________ Cell Phone:_______________________Home:___________________Email:______________________ Parent/ Legal Guardian/ Caregiver* Information Name:______________________________________________________________________________ Address:_____________________________________________________________________________ Home Phone:___________________Cell:_____________________Work:________________________ Email:________________________________ 1. I give permission for [insert name of health care services provider or clinic] to provide any of the health and mental health care services listed below, except as noted, to my child. This includes consent for any of the following, when advised or recommended by [insert name of health care services provider or clinic] staff: • Diagnosis/treatment of minor and acute illnesses, including first aid for minor injuries • Assistance with chronic (on-going) illnesses • Routine physical examinations, including exams for sports or pre-employment clearance • Immunizations • Laboratory services • Vision and hearing screenings • Over-the-counter and basic prescription medications • Health and wellness education • Mental health services, including screening, assessment, and counseling • Referrals for health services which cannot be provided at this clinic Except I DO NOT want my child to receive the following services from the above list: ____________________________________________________________________________  If you do not want your child to receive one or more of the above services, please list here. 2. I understand my consent covers only those services provided at [insert name of school]. I understand that I can change my mind later on and decide I do not want my child to get services at [insert name of health services provider or clinic]. If I change my mind, I will let [insert name of health services provider or clinic] know in writing by sending a letter to the following address:[insert name and address of health care services provider or clinic]. I understand that this consent form remains valid until its expiration date or until the clinic receives a written revocation from me. Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.   3. I understand that I will not be billed directly for health services provided by [insert name of health care services provider or clinic] on [insert name of school] premises. However, I understand that [health care services provider or clinic] needs to cover its expenses and may bill third parties for these services, including any applicable health insurer, or ask students to enroll in Medi-Cal or another public insurance program. I will provide my insurance information below. Signature of Parent/Guardian/Caregiver*:______________________________ Date:___________ Print Name of Parent/Guardian/Caregiver*:____________________________________________ * If Caregiver does not have legal custody, complete attached Caregiver Authorization Affidavit Insurance information: Medi-Cal/Medicaid # (if applicable):_____________________________________________________ Other Health Insurance Name & Address/phone: __________________________________________________________________________________ Insurance Policy #:_____________________________ Insurance Effective Date: ________________ Name of Insured:_____________________________________________________________________ Insurance Effective Date(s):____________________________________________________________ Additional information about this clinic and services: This school health center is operated by [insert name of health services provider or clinic] in cooperation with [name of school district]. (Insert either sentence A or B if applicable) (A) It is not part of, or directly operated by, [name of school district]. (B) It is operated by [name of school district]. Questions about health services should be addressed to [insert contact information for health services provider or clinic]. Under California law, youth do not need parental consent to receive certain health care services. Some examples of services that youth may obtain on their own, if they meet the legal requirements, include mental health counseling; alcohol and drug abuse counseling; diagnosis and treatment of sexually transmitted diseases; and pregnancy related care. If you would like more information about these laws and the services we provide, please talk to us. [Insert contact information for health care services provider or clinic] Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.     CALIFORNIA CAREGIVER’S AUTHORIZATION AFFIDAVIT  Use of this affidavit is authorized by Part 1.5 (commencing with section 6550) of Division 11 of the California Family  Code.  Instructions:  Completion of items 1‐4 and the signing of the affidavit is sufficient to authorize enrollment of a minor in  school and authorize school‐related care.  Completion of items 5‐8 is additionally required to authorize any other medical  care.  Print clearly.  The minor named below lives in my home and I am 18 years of age or older.  1. Name of minor: _________________________________________________________  2. Minor’s birth date:  ______________________________________________________  3. My name (adult giving authorization): _______________________________________  4. My home address: _______________________________________________________                     ______________________________________________________________________  5. [ ]  I am a grandparent, aunt, uncle, or other qualified relative of the minor (see back of this form for a  definition of “qualified relative”).    6. Check one or both (for example, if one parent was advised and the other cannot be located):    [ ]  I have advised the parent(s) or other person(s) having legal custody of the minor of my intent to authorize  medical care, and have received no objection.  [ ]  I am unable to contact the parent(s) or other person(s) having legal custody of the minor at this time, to  notify them of my intended authorization.  7. My date of birth: _________________________________________________________  8. My California driver’s license or identification card number: ______________________    Warning:  Do not sign this form if any of the statements above are incorrect, or you will be committing a crime  punishable by a fine, imprisonment, or both.  I declare under penalty of perjury under the laws of the State of California that the foregoing is true and correct.  Dated: __________________________ Signed: _________________________________________   (See back of this form for Notices and Additional Information)        Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.   Notices:  1. This declaration does not affect the rights of the minor’s parents or legal guardian regarding the care, custody,  and control of the minor, and does not mean that the Caregiver has legal custody of the minor.    2. A person who relies on this affidavit has no obligation to make any further inquiry or investigation.    3. This affidavit is not valid for more than one year after the date on which it is executed.    Additional Information:  To Caregivers:  1. “Qualified relative,” for purposes of item 5, means a spouse, parent, stepparent, brother, sister, stepbrother,  stepsister, half‐brother, half‐sister, uncle, aunt, niece nephew, first cousin, or any person denoted by the prefix  “grand” or “great,” or the spouse of any of the persons specified in this definition, even after the marriage has  been terminated by death or dissolution.    2. The law may require you, if you are not a relative or a currently licensed foster parent, to obtain a foster home  license in order to care for a minor.  If you have any questions please contact your local Department of Social  Services.    3. If the minor stops living with you, you are required to notify any school, health care provider, or health care  service plan to which you have given this affidavit.     4. If you do not have the information required in item 8 (California driver’s license or I.D.), provide another form of  identification such as your social security number or Medi‐Cal number.    To School Officials:  1. Section 48204 of the Education Code provides that this affidavit constitutes a sufficient basis for a determination  of residency of the minor, without the requirement of a guardianship or other custody order, unless the school  district determines from actual facts that the minor is not living with the Caregiver.    2. The school district may require additional reasonable evidence that the Caregiver lives at the address provided  in item 4.    To Health Care Providers and Health Service Plans:  1. A person who acts in good faith reliance upon a caregiver’s authorization affidavit to provide medical or dental  care, without actual knowledge of facts contrary to those stated on the affidavit, is not subject to criminal  liability or to civil liability to any person, and is not subject to professional disciplinary action, for that reliance if  the applicable portions of the form are completed.    2. This affidavit does not confer dependency for health care coverage purposes.    California Family Code §§ 6550, 6552 Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.     SAMPLE FORM B Student Consent to Health Care Treatment at [insert name of school based health center] [Insert name of health services provider] provides health care services to students at [insert name of school]. Under California law, youth do not need parental consent to receive certain health care services, often called “minor consent” services. Some examples of “minor consent” services that youth may obtain on their own, if they meet the legal requirements, include mental health counseling; alcohol and drug abuse counseling; diagnosis, treatment and preventative care for sexually transmitted diseases; and care related to pregnancy and pregnancy prevention. Youth also may be able to consent to their own health care because of their status or living situation. If you would like more information about whether you qualify for this care and the services we provide, please talk to us. If you are interested in consenting to your own care, please read this form carefully and complete. Student/Patient Information Name:__________________________________ Date of birth:____________ Grade:______ Address:_____________________________________________________________________________ Cell Phone:_______________________Home:___________________Email:______________________ 4. I am able to consent to my own care because: [ ] I am 18 years old or older [ ] I am or have been married, in the armed forces, or have been emancipated by a court. [ ] I am 15 years old or older, living separate and apart from my parents, and managing my own financial affairs [ ] I am seeking “minor consent” services. 5. I understand my consent covers only those services provided at [insert name of school]. I understand that I can change my mind later on and decide I do not want health or mental health services at [insert name of health services provider]. If I change my mind, I will let [insert name of health services provider] know in writing at the following address:[insert name and address of health services provider]. 6. I understand that [insert name of health services provider ] is required to keep my health information protected but that in some cases, they may need or be required to share it by law. I understand that I can ask for more information about confidentiality. 7. I understand that I will not be billed directly for health services provided by [insert name of health care services provider] on [insert name of school] premises. However, I understand that [health care services provider] needs to cover its expenses and may bill third parties for these services, including any applicable health insurer, and that [insert name of health care services provider] may ask me to enroll in Medi-Cal Minor Consent, FamilyPACT, or another public insurance program. Signature of Student:______________________________ Date:___________ Print Name:_____________________________________ Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.   SAMPLE FORM C Authorization to Release Health Information [This form is in 14-point type to comply with California Civil Code § 56.11] Student Information Name:______________________________ Date of birth:_______ Grade:______ [Insert name of school based health provider or clinic] keeps medical records confidential. However, at times we may want to collaborate with other agencies, providers and school staff to provide better health care to your child – for example, to assess your child’s health needs, coordinate your child’s care with school staff, provide treatment or referral, or evaluate the services provided. This may require disclosing some of your child’s confidential medical information to others. In most cases, we need your permission to share this information. We will share the minimum amount of information necessary to accomplish these purposes. 1. Please initial one of the following: [ ___ ] I give [Insert name of school based health provider or clinic] permission to share or disclose medical records and medical information about my child with the persons and agencies specified under (2) below for the purposes described above. This may include contact and appointment information, immunizations, history, diagnosis, treatment and mental health records (diagnosis, progress, and medication information). This release does NOT authorize [Insert name of school based health provider or clinic] to disclose information regarding HIV testing, treatment or status; drug or alcohol abuse, diagnosis or treatment; inpatient mental health services; psychotherapy notes; or minor consent servicesi. [ ___ ] I give [Insert name of school based health provider or clinic] permission to share or disclose all medical records and information as described in the paragraph above with the persons and agencies specified under (2) below, except the following information: _______________________________________________________________ [Insert name of school based provider or clinic] and its staff must have a separate authorization from me to disclose the information I describe on this line. 2. [Insert name of school based health provider or clinic] may share or disclose this information with the following persons and agencies: [ ___ ] [Insert Name of school] professional health staff Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.   [ ___ ] [Insert Name of school] Multidisciplinary team members [ ___ ] Others: ___________________________________________ (name or position of person or category of persons authorized to use or receive information) 3. This authorization is valid until the following date: __________________ (specify expiration date) Notices and Explanation of Rights: 1. I understand that [Insert name of school based health provider or clinic] may share or be required to share my child’s health care information with certain persons or agencies for purposes of treatment, health care operations, and billing and payment, or as otherwise required by law, without needing an authorization. 2. I understand that I may revoke this authorization by writing to [insert name and address of person to whom revocation should be directed]. Once [insert name of person to whom revocation should be directed] receives my written request, this authorization will be revoked, but only to the extent that the authorization has not already been relied upon to release health information. 3. I understand that I have the right to refuse to sign this authorization. I understand that [insert name of school based health provider or clinic] may not deny my child treatment, payment, enrollment in a health plan, or eligibility for benefits just because I choose not to sign this authorization. 4. I understand that if [insert name of school based health provider or clinic] discloses information to a person or organization that is not a health care provider, hospital or health plan subject to federal confidentiality law, the information may no longer be protected by federal confidentiality law. However, I understand that California confidentiality law still may apply, and the person or agency that receives my child’s medical information will not be able to disclose the information unless they have a new authorization or as required or permitted by law. 5. I understand that I have a right to receive a copy of this signed authorization. Signature of Parent/Guardian:______________________________________ Print Name:______________________________________ Date: _______ Describe Relationship to Patient:___________________________________ This form satisfies the requirements of HIPAA 45 CFR § 164.508 and California Civil Code § 56.11                                                              i “Minor consent services” refers to health care services that youth can consent on their own behalf. Minors must authorize the release of this information on their own. Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.                                                                                                                                                                                                    SAMPLE FORM D Minor’s Authorization to Release Medical Information  [This form is in 14-point type to comply with California Civil Code § 56.11] This form complies with HIPAA and California medical confidentiality law.  Student Information Name:______________________________ Date of birth:_______ Grade:______ [Insert name of school based health provider or clinic] keeps medical records confidential. However, at times we may want to collaborate with other agencies, providers and school staff to provide better health care to you – for example, to assess your health needs, coordinate your care with school staff, provide treatment or referral, or evaluate the services provided. This may require disclosing some of your confidential medical information to others. In most cases, we need your permission to share this information. We will share the minimum amount of information necessary to accomplish these purposes. 1. Please initial one of the following: [___ ] I give [Insert name of school based health provider or clinic] permission to share or disclose medical records and medical information related to care that I consented to for myself with the persons and agencies specified under (2) below for the purposes described above.. This may include information about pregnancy; birth control; STD testing and treatment; contact and appointment information; immunizations; and mental health counseling (diagnosis, progress, information). This release does NOT authorize [Insert name of school based health provider or clinic] to disclose information regarding HIV testing, treatment or status; drug or alcohol abuse, diagnosis or treatment; inpatient mental health services; or psychotherapy notes. [ ___ ] I give [Insert name of school based health provider or clinic] permission to share or disclose all medical records and information as described in the paragraph above with the persons and agencies specified under (2) below, except the following information: _______________________________________________________________ [Insert name of school based health provider or clinic] and its staff must have a separate authorization from me to disclose the information I describe on this line. 2. [Insert name of school based health provider or clinic] may share or disclose this information with the following persons and agencies: Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.                                                                                                                                                                                                    [ ___ ] [Insert Name of school] professional health staff [ ___ ] [Insert Name of school] Multidisciplinary team members [___ ] Parents or Guardians (In most cases, [Insert name of school based health provider or clinic] cannot share information with your parents about health care you consented to without your permission.) [ ___ ] Others: ___________________________________________ (Insert name or position of person or category of persons authorized to use or receive information) 3. This authorization is valid until the following date: __________________ (specify expiration date) Notices and Explanation of Rights: 1. I understand that [insert name of school based health provider or clinic] may share or be required to share my health care information with certain persons or agencies for purposes of treatment, health care operations, and billing and payment, or as otherwise required by law, without needing an authorization. 2. I understand that I may revoke this authorization by writing to [insert name and address of person to whom revocation should be directed]. Once [insert name] receives my written request, this authorization will be revoked, but only to the extent that the authorization has not already been relied upon to release health information. 3. I understand that I have the right to refuse to sign this authorization. I understand that [insert name of school based health provider or clinic] may not deny me treatment or eligibility for benefits just because I choose not to sign this authorization. 4. I understand that if [insert name of school based health provider or clinic] discloses information to a person or organization that is not a health care provider, hospital or health plan subject to federal confidentiality law, the information may no longer be protected by federal confidentiality law. However, I understand that California confidentiality law still may apply, and the person or agency that receives my medical information will not be able to disclose the information unless they have a new authorization or as required or permitted by law. 5. I understand that I have a right to receive a copy of this signed authorization. Signature of Student Patient:______________________________________ Print Name:______________________________________ Date: _______ Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.                                                                                                                                                                                                      SAMPLE FORM E Consent for Release of Educational Records to [Insert name of school based health provider or clinic] [This form complies with FERPA.] [Insert name of school based health provider or clinic] at times may need information contained in your child’s school record in order to better assess your child’s health needs, coordinate your child’s care, provide treatment or referral, or evaluate the services provided. For example, the clinic staff may need to access your child’s class schedule in order to arrange appointments or your contact information in order to consult with you. In addition, school staff may want to share information with the clinic staff so that they can make a referral or participate on a multidisciplinary health team. The clinic staff needs your permission to get and receive this information. Please check one of the following: [ ] I give [name of school] and its staff permission to share information from my child’s education record, including contact information, attendance records, class schedule, transcript, special education records, and testing results, with [insert name of school based provider or clinic] and its staff for the purposes described above. [Insert name of school based provider or clinic] will request the minimum information necessary to accomplish its purpose. [ ] I give permission to share all information from my child’s education record as described in the paragraph above, except the following: __________________________________________________________________________ If [insert name of school based provider or clinic] and its staff need the information I describe on this line, they must contact me for a separate consent. This consent is valid until the following date or event: ____________________________ (Specify expiration date or event) Student Information Name:__________________________________ Date of birth:____________ Grade:______ Parent* Information Name:_______________________________________________________________________ Address:______________________________________________________________________ Home Phone:__________________ Cell:___________________ Work:____________________ Signature:______________________________________________ Date:_______________ (Parent* must sign if student is under 18 years old. Student must sign if age 18 or older.) * Parent “includes a natural parent, a guardian, or an individual acting as a parent in the absence of a parent or a guardian.” 34 CFR § 99.3 This form meets the requirements of 34 CFR § 99.30 of the Family Educational Rights and Privacy Act. Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.                                                                                                                                                                                                    SAMPLE FORM F Consent for Release of Student Medical Information from Education Record [Insert name of school based health provider or clinic] [This form complies with FERPA and California medical confidentiality law.] [Insert name of school based health provider or clinic] at times may want to exchange information contained in your child’s school based health center (SBHC) medical record or education file with others in order to better assess your child’s health needs, coordinate your child’s care, provide treatment or referral, arrange for payment, or evaluate the services provided. For example, the clinic staff may wish to disclose relevant information to an outside health care provider when making a referral, or school staff may want to confirm that a student they referred to the clinic has been connected with services. School staff and clinic staff are permitted to share relevant information with each other for these purposes, but disclosures to agencies or individuals outside of school usually require your consent. Please initial all that apply: 1. I give [name of school based health provider or clinic] and [name of school] and their staff permission to share the information described below with these individuals or organizations: [ ]Health care provider _____________________________________________________________ [ ]Agency _____________________________________________________________ [ ] Other: _____________________________________________________________ [ ] Other: ____________________________________________________________ 2. Type of information to be disclosed: [ ] I give permission to share all information from my child’s SBHC medical record or education record, including contact information, attendance records, class schedule, transcript, health and special education records, and testing results. [ ] I give permission to share all the information in my child’s SBHC medical record or education record as described above, EXCEPT the following: Disclaimer:  This document is provided solely for reference purposes. Consult legal counsel about adopting   for use in your clinic. National Center for Youth Law. 2012.                                                                                                                                                                                                    __________________________________________________________________ 3. Purpose of disclosure:_______________________________________________  4. This consent is valid until the following date or event:_____________________ (Specify expiration date) 5. I understand that I have a right to receive a copy of this signed authorization. Parent* and Student Information Student Name:______________________________ Date of birth:____________ Grade:______ Parent Name:_______________________________________________________ Address:___________________________________________________________ Home Phone:__________________ Cell:___________________ Work:____________________ Signature:______________________________________________ Date:______________ HIPAA or FERPA? A Primer on School Health Information Sharing in California © National Center for Youth Law February 2012