Confidentiality of Student Health Records

In 1997 ASHA convened a National Task Force on Confidential Student Health Information supported by funding from the Centers for Disease Control and Prevention's Division of Adolescent and School Health. In 2000 the Task Force released Guidelines for Protecting Confidential Student Health Information, a tool that provided a basic framework for safeguarding student health records.
 
Guidelines for Protecting Confidential Student Health Information, 2000
Guideline I - Distinguish student health information from other types of school records.

Guideline II - Extend to school health records the same protections granted medical records by federal and state law.

Guideline III - Establish uniform standards for collecting and recording student health information.

Guideline IV - Establish district policies and standard procedures for protecting confidentiality during the creation, storage, transfer, and destruction of student health records.

Guideline V - Require written, informed consent from the parent and, when appropriate, the student, to release medical and psychiatric diagnoses to other school personnel.

Guideline VI - Limit the disclosure of confidential health information within the school to information necessary to benefit students' health or education.

Guideline VII - Establish policies and standard procedures for requesting needed health information from outside sources and for releasing confidential health information, with parental consent, to outside agencies and individuals.

Guideline VIII - Provide regular, periodic training for all new school staff, contracted service providers, substitute teachers and school volunteers concerning the district's policies and procedures for protecting confidentiality.

More complete information is available at the ASHA Bookstore.

A second Task Force, convened in 2004, developed an additional tool to guide school districts in developing and implementing policies for appropriately handling student health information. The resulting book, Protecting and Disclosing Student Health Information: How to Develop School District Policies and Procedures, provides a legal and ethical framework for such policies and includes sample policy language. It also provides specific standards to assist school health and education professionals in addressing issues that have arisen with the adoption of the Health Insurance Portability and Accountability Act (HIPAA) in 2004.

Standard 1: Transparency
School districts make publicly available on an annual basis clear explanations of their policies, procedures, and practices regarding the collection, use, storage, release, and destruction of personally identifiable student health information.

Standard 2: Consent
2a. Consent for Internal Sharing. School district officials obtain valid informed consent from parents, eligible students, or qualified minor students for the collection and use of student health information internally within the school district except when such collection or use is expressly permitted without consent by state or federal law and when such permissible practices are based on ethical standards and made transparent to parents and students, as described in Standard I. If consent is required but not obtained, then a formal, authoritative and publicly accountable process must be used to authorize or justify a waiver of consent.

2b. Consent for External Sharing. School district officials obtain valid informed consent from parents, eligible students, or qualified minor students for the disclosure of student health information to and from health care providers and other agencies outside the school district with limited exceptions that are permitted by law, specified in policy and procedures, and made transparent to parents and students, as described in Standard 1.

Standard 3: Collection Limitation
School districts limit the collection of student health information to that information required for current needs, or reasonably projected future needs, which are made explicit at the time consent is obtained.

Standard 4: Parent and Student Access
Parents, eligible students, and qualified minor students are allowed access to student health information in educational records.

Standard 5: Information Use Limitation
School districts limit the sharing and use of student health information to those legitimate educational purposes for which the information was obtained and to those purposes made explicit at the time consent was given.

Standard 6: Data Quality
School officials ensure that student health information in educational records is accurate, complete, and up to date as required for the purposes for which it is collected and used.

Standard 7: Security
Districts protect student health information in education records from unauthorized access by using reasonable security measures.

Standard 8: Accountability
All members of the school community, including volunteers, consultants, and business associates, are accountable for adhering to strict standards for protecting student health information during collection, use, transfer, storage and destruction.

ASHA offers technical assistance to answer questions in connection with these issues and these publications. In addition, ASHA has developed a training workshop which can be tailored to specific school districts and personnel, for a fee. For further information, please contact Marcia Rubin, Director of Research and Sponsored Programs at mrubin@ashaweb.org

Collaborating organizations on the National Task Forces on Confidential Student Health Information