Researchers identify privacy law gaps in high school STI health services

Without addressing these gaps, collaboration between schools (operating under FERPA) and health departments (operating under HIPAA) can compromise student privacy.

A new commentary by Boston University School of Public Health (BUSPH) researchers published in the journal Pediatrics uses the example of high school sexually transmitted infection (STI) programs to highlight how collaborations between schools and health departments can create gaps in student privacy.

"Students who use health programs in school may not realize that there could be vulnerabilities for their private health information. School nurses and health departments who collaborate on programs in schools must also collaborate on explicit protections for students' private health information," says Dr. Patricia Elliott, clinical assistant professor of community health sciences at BUSPH and the paper's lead author.

Complications arise in these collaborations, the researchers write, because school nurses operate under the Family Educational Rights and Privacy Act (FERPA), while health departments may operate under the Health Insurance Portability and Accountability Act (HIPAA). Both laws are meant to protect patient privacy, but in different ways, leaving unintentional gaps. For example, FERPA allows parents to see medical information in the school record, and allows school nurses to disclose medical information to other school administrators in some cases. When private medical information from, for example, a local health department's in-school STI testing and treatment program operating under HIPAA is passed on to a school nurse operating under FERPA, that information becomes less private than a student—and perhaps even the health department program—may realize.

To help close the gap, Elliott and colleagues write that collaborations between schools and local health departments should include mapping out processes and workflow to find and anticipate these gaps, and that collaborators should create clear privacy protocols for all partners and tell students in plain language what privacy protections they can expect.

"Schools have become important sites for many health interventions, but, if we are not careful, what is good for a student's health may not be good for their privacy," Elliott says.