As a new school year begins, your District may receive a request from your County Health Department for specific information on students with missing immunizations. Although the requested information, including the student’s grade, birthdate, name, address and telephone number, may otherwise be considered directory information which may be disclosed, when specifically requested for those students with missing immunizations, it raises HIPAA and FERPA privacy concerns. HIPAA’s privacy rules permit disclosure of protected health information (PHI) for public health activities and purposes including “a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability.” Under HIPAA, a public health authority is defined as “an agency or authority of …, a state, …, a political subdivision of a state …, that is responsible for public health matters as part of its official mandate.” Arguably, a County Health Department falls into this category. Therefore, to the extent the County Health Department is authorized by law to collect or receive information for public health purposes as specified in the public health exception, HIPAA permits the District to disclose PHI to the County Health Department without parental authorization or consent.
However, this is not the end of the analysis. HIPAA cannot be viewed in isolation, but rather must be read in conjunction with the applicable provisions of the Family Educational Rights and Privacy Act (FERPA). The HIPAA privacy rules specifically provide that PHI does not include individually identifiable health information contained in education records covered by FERPA. A student’s health records, including immunization records, maintained by the School District would generally be “education records” subject to FERPA because they are (1) directly related to a student; (2) maintained by an educational institution or a party acting for the agency or institution; and (3) not excluded from the definition as treatment or sole possession records, or on some other basis. 20 U.S.C. § 1232g(a)(4)(a). Therefore, individual student immunization records are considered education records under FERPA and are not subject to the HIPAA privacy rule. Accordingly, HIPAA neither authorizes nor permits the disclosure of these records.
To determine whether disclosure, without consent, is permitted under FERPA, the immunization records must fall within one of FERPA’s statutory exceptions. However, there is no exception in FERPA which permits a school district to disclose general health or other immunization records to a state or county health department. The closest exception under FERPA permits a school district to disclose personally identifiable, non-directory information to appropriate officials in connection with a health or safety emergency. The United States Department of Education, Family Policy Compliance Office, has strictly interpreted this provision by limiting its application to a specific situation which presents imminent danger to students or other members of the community, or that requires an immediate need for information in order to avert or diffuse serious threats to the safety or health of a student or other individuals.
By its February 25, 2004 opinion letter, the Compliance Officer clarified the “health or safety emergency” exception under FERPA in relation to immunization records. It determined that the general release of personally identifiable information is not permissible. However, on a case by case basis where there may be an outbreak of contagious diseases, the release of the requested information would be permissible. Therefore, in the absence of consent from the student’s parent, any information which would identify a specific student’s immunization status, although otherwise considered directory information, cannot be provided to County Health Departments under FERPA. The release of this information, without the parent’s consent, could only occur under the “health or safety emergency” exception in situations involving an outbreak of disease where the individual student without immunization would be at risk.
If you have other questions regarding FERPA compliance, you may contact any of our school law attorneys for further guidance.
