HIPAA
& FERPA considerations
Disclosures
for Public Health under the Health Insurance Portability and
Accountability Act (HIPAA): The HIPAA
Privacy Rule recognizes the legitimate need for public health
authorities and others responsible for ensuring public health
and safety to have access to protected health information to
carry out their public health mission. The Privacy Rule permits
a covered entity (i.e., health care provider) to disclose protected
health information for public health activities and purposes
without individual authorization (Section 164.512(b)(1)(i)).
These activities include: "…for the purpose of preventing
or controlling disease, injury, or disability, including, but
not limited to, the reporting of disease, injury, vital events
such as birth or death, and the conduct of public health surveillance,
public health investigations, and public health interventions;
or…" The U.S. Department of Health and Human Services,
Office for Civil Rights guidance issued on 12/4/02 further clarifies
that the public health purpose does not need to be mandated
by law (pp. 4-5).
Historically,
only Health Care providers have been able to access the Washington
State Immunization Registry (CHILD Profile). In response to
significant interest in broadening access to the registry the
matter was reviewed by the Attorney General's Office. It was
determined that school nurses and staff assigned by the school
nurse would be able to use the registry under the Washington
State Health Care Information Act. (RCW 70.02)
In accordance
with RCW 28A.210.100 & 28A .210.110 it is the parent's responsibility
to submit immunization information to the school. In utilizing
the CHILD Profile Registry, the school nurse or assignee is
facilitating parent report. The parent will be directed to review,
amend if needed, sign and submit the CIS form to the school.
An Information
Sharing Agreement must first be signed by the district
and filed with the Washington Department of Health.
In using
the CHILD Profile Immunization Registry, school staff responsible
for immunization documentation and verification must:
- Be a
school nurse or be assigned by the licensed school nurse to
access the Immunization Registry.
- Sign
the CHILD Profile Confidentiality
Agreement before accessing the Immunization Registry.
- Maintain
the confidentiality of information derived from the CHILD
Profile Immunization Registry, as described in the Confidentiality,
Privacy and School Access document.
- Give
the immunization record, history form, or Certificate of Immunization
Status form to the parent, guardian, or eligible student,
for review, signature and submission to the school, and NOT
submit the form directly to the school without review.
The Family
Educational Rights and Privacy Act (FERPA) guides the school's
authority to disclose information. According to FERPA,
a school nurse or assignee should have written parent consent
to add immunization information to a child's record in the CHILD
Profile Immunization Registry. The current access level for
school nurses and their assignees is "view only".
No parent signature is required prior to accessing data in the
registry. The ability to enter data may be a function that becomes
available to schools in the future.
Note:
The above information is not intended to provide legal advice,
and you are encouraged to seek your own counsel regarding HIPAA,
FERPA and Washington State laws.
