Keep health records of students and staff confidential and in a secured environment.

The use and release of health information belonging to staff members, students, and their families are often necessary to the development of health, safety, and inclusion plans for those with special needs. By having policies in place and making sure they are understood, schools will safeguard their students' and staff members' confidentiality as well as protect the district from liability.

School district personnel offices often collect confidential health and safety information from many staff members. Students' health information often resides in many offices (e.g., nurses', counselors'). Schools must have written policies that define when and how often signed consent to exchange information is required, the limits of information to be exchanged, and terms of notification when this information is exchanged. Locked cabinets and exchange of information (verbal exchanges, written exchanges such as fax, e-mail, and other electronic forms) must all be considered when defining limitations to access. Aside from sensitivity to issues of confidentiality and protection of privacy, policies must also be congruent with local, state, and federal laws (e.g., FERPA or Family Educational Rights and Privacy Act). FERPA regulates sharing information at school and sending school information to others. The Health Insurance Portability and Accountability Act (HIPAA) regulates health providers sharing information with each other and with schools. Special considerations for school compliance with HIPAA often apply to schools, for example, when confidential information is housed in school-based health centers (Guideline 4-31).

Students should know that records of health services at school and elsewhere are confidential and should understand the extent of that confidentiality. The purpose of collecting and storing this information is to protect the health and safety of students and staff members, necessitating that some information is shared with certain members of the school staff. There are many circumstances whereby parents and students wish to disclose components of the health record to classmates. When this occurs, staff must also consider that these same students and families may still want to keep many other aspects of the health record private.

Someone knowledgeable about state and federal laws in each school should be designated to make decisions about the extent and the manner to which confidential information is shared. The school principal or the person creating the health record is usually the person responsible for this. For health information, this responsibility is often delegated to the school nurse. For mental health information, responsibility to protect student confidentiality is often assigned to the school nurse, school counselor, or school psychologist. All who have access to health-related information about a student or staff member must be counseled about policies and practices for maintaining confidentiality.

Bergren MD. HIPAA hoopla: privacy and security of identifiable health information. J Sch Nurs. 2001; 17(6):336-340.

Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99); Family Policy Compliance Office; US Department of Education; Washington, DC.

Mukherjee S, Lightfoot J, Sloper P. Communicating about pupils in mainstream school with special health needs: the NHS perspective. Child Care Health Dev. 2002; 28(1):21-7.

National Association of School Nurses. School Health Nurse's Role in Education: Privacy Standards for Student Health Records (issue brief). Scarborough, ME: National Association of School Nurses, 2002. Available at: http://208.5.177.157/briefs/hippa.htm.

National Task Force on Confidential Student Health Information. Guidelines for Protecting Confidential Student Health Information. Kent, OH: American School Health Association, 2000.