It’s that time of year again when millions of students head back to school and questions arise about disclosures of protected health information (PHI) to schools. The Department of Health and Human Services has published the following Q & As regarding immunization records and medication disclosures to schools that will help clarify what is permitted to be disclosed, to whom and whether authorization is required. If a question comes up that is not answered below, please feel free to contact us for assistance.
Is a health care provider permitted to disclose proof of a child’s immunizations directly to a school without a HIPAA authorization?
Yes, provided the school is required by law to have proof of immunizations in order to admit the child, and a parent, guardian, or other person acting in loco parentis has agreed to the disclosure. Where the individual who is a student or prospective student is an adult or emancipated minor, the provider may make the disclosure with the agreement of the student herself. In either case, the agreement may be obtained orally or in writing, but must be documented (e.g., by placing in the medical record a copy of a written request, or notation of an oral request). See 45 CFR 164.512(b)(1)(vi).
If a state law requires a covered health care provider to disclose proof of a student’s immunizations directly to a school without the affirmative permission of a parent or guardian, must the health care provider also obtain the agreement of a parent or guardian in accordance with 45 CFR 164.512(b)(1)(vi) of the Privacy Rule prior to making the disclosure?
No. The Privacy Rule permits a covered entity to use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of that law. See 45 CFR 164.512(a). In such cases, the covered entity is not required to also meet the conditions of 45 CFR 164.512(b)(1)(vi) in making the required by law disclosure.
Does the HIPAA Privacy Rule allow a health care provider to disclose protected health information (PHI) about a student to a school nurse or physician?
Yes. The HIPAA Privacy Rule allows covered health care providers to disclose PHI about students to school nurses, physicians, or other health care providers for treatment purposes, without the authorization of the student or student’s parent. For example, a student’s primary care physician may discuss the student’s medication and other health care needs with a school nurse who will administer the student’s medication and provide care to the student while the student is at school. In addition, a covered health care provider may disclose proof of a student’s immunizations directly to a school nurse or other person designated by the school to receive immunization records if the school is required by State or other law to have such proof prior to admitting the student, and a parent, guardian, or other person acting in loco parentis has agreed to the disclosure. See 45 CFR 164.512(b)(1)(vi).
Where a parent requests that a health care provider disclose proof of his child’s immunizations to a school so the school can legally admit the child, does the Privacy Rule limit to whom at the school the provider may send the records?
No. It is expected that in most cases a school has designated an administrative official or employee, such as a school nurse, to receive and maintain proof of student immunizations to comply with applicable law. Given the designated person may vary from school to school, the Privacy Rule permits the health care provider to make the disclosure to whoever at the school is identified in the parent’s request or school’s instructions to the parent.
