June 17, 2004

The Honorable Tommy G. Thompson
Secretary
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C.  20201

Dear Secretary Thompson:

As part of its responsibilities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the National Committee on Vital and Health Statistics (NCVHS) monitors implementation of the Administrative Simplification provisions of HIPAA, including the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule).

The NCVHS Subcommittee on Privacy and Confidentiality held hearings in Washington, DC on February 18-19, 2004.  The hearings, the second set of several to be held on HIPAA implementation, were intended to gather information about the effect of the Privacy Rule in three areas:  banking, law enforcement, and schools.  Additional hearings will address other aspects of Privacy Rule implementation.  This letter conveys the Committee’s findings and recommendations for action by the Department regarding schools.  Separate letters contain findings and recommendations regarding banking, and law enforcement.

Representatives from seven organizations testified about the effect of the Privacy Rule on schools:  the Centers for Disease Control and Prevention (CDC), American Academy of Pediatrics, U.S. Department of Education, American College Health Association, National School Boards Association, American School Health Association, and the National Association of School Nurses.

The CDC Epidemiology Program Office’s HIPAA Privacy Rule Coordinator testified about the effect on public health of the interaction between the Privacy Rule and the Family Educational Rights and Privacy Act of 1974 (FERPA).  Under the Privacy Rule, records protected by FERPA are not covered by the Privacy Rule. Therefore, even if the information contained in an education record is health-related, the Privacy Rule does not apply.

However, the Privacy Rule does have an effect on schools in that it controls the disclosure of health information by covered entities (such as family physicians) to schools in situations where such information is needed in the school setting.

While covered entities under the Privacy Rule may disclose PHI to public health authorities for public health activities, there is no provision permitting covered entities to disclose PHI to schools for such purposes as tracking immunizations, as well as other public health-related activities that a school may need to perform.

The American Academy of Pediatrics testified about a number of unintended consequences of the Privacy Rule.  For example, the implementation of the Privacy Rule has resulted in students not receiving timely health care they need while at school.  Many school nurses provide daily care for students with complex medical conditions, such as ventilator support, ostomy care, or dialysis.  As schools are not generally considered health care providers under the Privacy Rule, the student’s provider needs parental authorization before providing information to the school for treatment.

It is vital that school health personnel be able to obtain information about a student quickly and easily if the school needs information to provide immediate care.  It is important that measures be in place to prevent HIPAA from being an obstacle to timely health care.

The American College Health Association testified regarding concerns that college and university health services have in complying with the Privacy Rule, FERPA and, in some cases, State law for student medical records. There is much confusion among colleges and universities about how to comply with these medical privacy laws.  Some university health services have considered complying exclusively with HIPAA regulations and ignoring FERPA. Other university health services have opted to discontinue providing care to non-students, such as spouses, participants at summer camps, visiting scholars, athletic interns, J-1 visa scholars, etc. Although this option allows these university health services to follow only FERPA or State law, it limits the availability of valuable health services.

The National School Boards Association has received many inquiries regarding HIPAA.  From its testimony it appears that there is substantial confusion. One State department of education reportedly counseled school districts to await further Federal guidance before expending time and resources on HIPAA compliance. Apparently, some school districts have engaged expensive consultants to help them revamp their entire health information system based on HIPAA instead of FERPA.

The American School Health Association (ASHA) explained that misunderstandings about the Privacy Rule have had a significant negative impact on student learning, health, and families.  Initially, many schools welcomed the Privacy Rule and hoped that it would apply to school health records to ensure consistent minimum standards and practices.  ASHA explained that FERPA was enacted at a time before students with significant physical, developmental, behavioral, and mental health conditions regularly attended school, and before schools became providers of a wide variety of health and mental health services.

According to ASHA testimony, many physician offices and clinics refuse to fax the state-mandated immunization or physical exam forms to schools, a past practice which allowed students same-day entry into school. Others will not accept authorization forms designed by schools for the release of that information, even if the forms meet the authorization requirements of HIPAA.  Additionally, many parents have been told that an oral, telephonic, or faxed authorization to the student’s health care provider to release their child’s immunization data to school personnel is insufficient.  As a result, the parent must travel to the provider’s office (often requiring the parent to take time off from work), sign the provider’s authorization form, and then travel to the school to hand deliver the immunization record.

The National Association of School Nurses testified that prior to the implementation of the Privacy Rule, schools, primary providers, and health departments regularly collaborated on many health matters involving students.  School nurses could verify immunization dates with physician offices and local health departments, obtain providers’ orders for treatments, medications, and health maintenance instructions over the phone or via fax, and consult providers regarding learning assessments.  After the effective date of the Privacy Rule, school nurses throughout the country reported that HIPAA covered entities refused to communicate with them directly.   They estimated that thousands of students have been excluded from school due to missing immunization documentation required for school entry or attendance.  Some students even have been re-immunized when the barriers to obtaining immunization documentation were too burdensome for working parents, rural residents, or families who have relocated significant distances from providers who administered the immunizations.  This is consistent with testimony we have heard in the past. If HHS regarded disclosure of immunization information to school officials as a public health disclosure, the necessary information could be released without need for an authorization, thereby benefiting the students.

Based on the oral and written testimony presented at the hearing, NCVHS recommends the following:

  • HHS should continue to work with the U.S. Department of Education to clarify how the Privacy Rule and FERPA interact with respect to confidentiality of school health records, and where possible to harmonize these regulations and issue guidance.
  • HHS should make special efforts to focus its outreach and education activities, in a timely manner, on schools, physicians, and State health departments to clear up any confusion regarding the permissible disclosures of health information in the context of dealing with the health needs of students in the school setting.
  • HHS should regard disclosure of immunization information to schools as a public health disclosure, thereby permitting providers to disclose this information to appropriate school officials without an authorization.
  • HHS should clarify that disclosure of health information to school health personnel in the context of dealing with the health needs of students is a disclosure for treatment, and thus possible without an authorization.

We appreciate the opportunity to offer these comments and recommendations.

Sincerely,

/s/

John R. Lumpkin, M.D., M.P.H.
Chairman, National Committee on Vital and Health Statistics

Cc: HHS Data Council Co-Chairs