HIPAA
& FERPA considerations
Disclosures
for Public Health under the Health Insurance Portability and
Accountability Act (HIPAA): The HIPAA
Privacy Rule recognizes the legitimate need for public health
authorities and others responsible for ensuring public health
and safety to have access to protected health information to
carry out their public health mission. The Privacy Rule permits
a covered entity (i.e., health care provider) to disclose protected
health information for public health activities and purposes
without individual authorization (Section 164.512(b)(1)(i)).
These activities include: "…for the purpose of preventing
or controlling disease, injury, or disability, including, but
not limited to, the reporting of disease, injury, vital events
such as birth or death, and the conduct of public health surveillance,
public health investigations, and public health interventions;
or…" The U.S. Department of Health and Human Services,
Office for Civil Rights guidance issued on 12/4/02 further clarifies
that the public health purpose does not need to be mandated
by law (pp. 4-5).
Historically,
only Health Care providers have been able to access the Washington
State Immunization Registry (CHILD Profile). In response to
significant interest in broadening access to the registry the
matter was reviewed by the Attorney General's Office. It was
determined that Head Start/ECEAP Nurse Consultants, as well
as staff conducting immunization compliance activities under
the direction of that program nurse, would be able to use the
registry under the Washington State Health Care Information
Act. (RCW 70.02)
In accordance
with RCW 28A.210.100 & 28A .210.110 it is the parent's responsibility
to submit immunization information to the Head Start and/or
ECEAP Program. In utilizing the CHILD Profile Registry, the
program nurse or assignee is facilitating parent report. The
parent will be directed to review, amend if needed, sign and
submit the CIS form to the program.
An Information
Sharing Agreement must first be signed by the grantee
and filed with the Washington Department of Health.
In using
the CHILD Profile Immunization Registry, program staff responsible
for immunization documentation and verification must:
- Be a
staff nurse/nurse consultant or be assigned by the licensed
program nurse to access the Immunization Registry.
- Sign
the CHILD Profile Confidentiality
Agreement before accessing the Immunization Registry.
- Maintain
the confidentiality of information derived from the CHILD
Profile Immunization Registry, as described in the Confidentiality,
Privacy and School Access document.
- Give
the immunization record, history form, or Certificate of Immunization
Status form to the parent or guardian,
for review, signature and submission to the program, and NOT
submit the form directly to the program without review.
The Family
Educational Rights and Privacy Act (FERPA) guides the program's
authority to disclose information. According to FERPA,
a program nurse or assignee should have written parent consent
to add immunization information to a child's record in the CHILD
Profile Immunization Registry. The current access level for
program nurses and their assignees is "view only".
No parent signature is required prior to accessing data in the
registry. The ability to enter data is a function that is available
to Head Start and/or ECEAP Programs upon request with an amendment
to the Sharing Agreement.
Note:
The above information is not intended to provide legal advice,
and you are encouraged to seek your own counsel regarding HIPAA,
FERPA and Washington State laws.
