By Linda Carroll
(Reuters Health) - The privacy protections Americans have come to expect when it comes to their medical information may not always apply in school settings, a new report suggests.
When a school nurse is involved in a student's medical care, information on that care may end up in the child's educational record - which is accessible without consent to school officials and parents, according to the report in Pediatrics.
The problem is that student healthcare provided by a school nurse can fall outside the privacy guarantees of the federal Health Insurance Portability and Accountability Act (HIPAA) and instead be covered by another federal law, the Family Educational Rights and Privacy Act (FERPA).
FERPA states, for example, that information in the student's file may be disclosed without consent to "school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests."
Confusion is most likely to arise when school nurses collaborate with outside clinicians to provide care to students, said study leader Patricia Elliott of the Boston University School of Public Health.
"Not only might the youth be surprised at how information is handled and who can see it, but the clinician might have no idea either," Elliott said.
Elliott gives the hypothetical example of a program designed to screen and treat sexually transmitted infections (STIs) that is run in a school with collaboration between the school nurse and a local health clinic. While the healthcare providers may assume that information on student STIs is covered by HIPAA and thus private, the school nurse may be required, depending on school rules, to enter information on the screening results and treatment into the student's educational file.
And because of FERPA, a lot of people with "legitimate educational interests" might see the notation in the student's file. Exactly what falls under "legitimate" isn't defined.
If the information on STI screening and treatment ends up in students' files, there is also the risk it will be seen by parents - even though all states plus the District of Columbia grant minors the right to consent to their own STI-related services, with a presumption of privacy if care is given in a medical setting.
"The biggest take-home message is that protocols need to be developed in the beginning," Elliott said. "Collaborating parties need to discuss how and when information may be shared. They need to make sure protocols are in place to ensure youth privacy."
Advance planning is the way to avoid harming anyone, said Dr. Maria Trent, an adolescent medicine specialist and professor at the Johns Hopkins Schools of Medicine, Public Health and Nursing in Baltimore and president of the Society for Adolescent Health and Medicine.
Unless clear boundaries protect student privacy, parents and teens aren't going to want to participate in school health services, said Trent, who has worked in school-based health settings for nearly two decades.
These days, more and more schools are collaborating with medical groups and health departments to offer preventive services to teens, Trent said. "So it's critical to be very clear about what everyone's roles are and what people can do," she added. "If you wait until something has happened and then try to spell out the rules someone's going to be hurt."
The STI example was a great one, Trent said. Without the right rules in place, confidential information about STIs could end up in a teen's file that school personnel have easy access to, she said. "And it's unclear why the math teacher needs to know you have chlamydia," she added.
SOURCE: https://bit.ly/2UNpwwo Pediatrics, online February 12, 2020.
