Privacy of personal information is a persistent issue in our society; this is particularly true with respect to health information. Yet information about individuals’ health leads to discovery of public health problems. Recent changes to a federal law setting privacy protections for student information held by schools highlight these competing concerns. The Network has created two blog posts on this important subject. Read below for a blog post from the Network’s Eastern Region about a change that will enhance the sharing of student health information between schools and public health departments. Read another blog post from the Network’s Mid-States Region here about how the federal privacy law has been tightened to protect student information.
Information is power, and in the ongoing efforts to improve the quality of public health, information plays a key role in proactive change. Information about illnesses and chronic conditions that impact children can instigate state and local health departments to investigate potential causes of illness and disease. Access to student health information increases awareness of health issues and allows schools and communities to accommodate those in need. Often, information about children’s health is a snapshot of the community’s health and can provide public health officials with critical information about needed services and policy change.
Consider the value of a program through which a local health department uses a school-based asthma monitoring program to secure information necessary to improve educational facilities and programs so as to accommodate affected students. Information about the children with asthma and where they live may also lead to discoveries about possible environmental causes of the condition which, of course, could lead to changes that improve the community’s health.
Thanks to a recent amendment to federal regulations, the exchange of student health information between schools and local health departments will be more comprehensive and easily managed. The Department of Education recently promulgated a rule permitting public health agencies access to student information to evaluate and improve health education programs and health accommodations in schools. The new provision clarified—actually re-clarified—a rule defining who may receive student information shared under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g; 34 CFR §99.1 (updated official version to be published July 1). The regulations permit educational agencies to share student information with designated “authorized representatives” for the purpose of evaluating and auditing educational programs. This recent amendment defined “authorized representative,” a term previously subject to multiple interpretations due to a lack of explicit definition.
How this rule affects public health agencies is exemplified by the asthma scenario described above— an example taken directly from a program implemented in Connecticut. Prior to 2003, educational agencies could designate local and state health departments as authorized representatives, and these health agencies put student health information to various uses. In addition, states could use joint ventures to comply with federal reporting requirements. For example, the Children’s Health Act of 2000 requires annual reports to Congress on autism. To facilitate the research necessary to comply with the Act, the Centers for Disease Control created various population surveillance projects often involving collaboration between state education agencies and state health departments.
In 2003, however, the Department of Education choked the effectiveness out of these and similar programs by re-interpreting “authorized representative” so narrowly that critical information could only be freely shared with representatives under direct control of educational agencies; this excluded state and local public health agencies. Those not under direct control could obtain student information so long as either there had been parental consent—which is difficult to obtain and can lead to biased and misrepresented statistics—or the information had been aggregated and de-identified, a process that undercut any effective health analysis. De-identification procedures have resulted in the removal of health information: The Department required information to be stripped if anyone in the school community could reasonably identify the student through the information. For example, if a sixth grader in a school missed two weeks because of the flu, then a member of the school community might reasonably identify the student from the extended flu-related absence; thus the information could not be shared with public health officials regardless of whether sharing the information would lead to educational and public health improvements. Without comprehensive student health information, public health agencies were denied a critical element needed to evaluate programs, assess the need for policy change and comply with federal requirements such as the autism reporting requirements mentioned above.
The Department of Education’s decision to eliminate the “under direct control” requirement permits sharing with non-educational agencies, just as the Department permitted prior to 2003. This is a welcome change to those concerned about education or public health. The Department’s explanation for the change emphasized the need for flexibility and legitimate use of information, including specific recognition of joint efforts between the Department and the Centers for Disease Control.* With this change, health agencies may once again play a key role in evaluating trends and needs of our schools.
Public health officials, and their education counterparts, should be aware of the revival of health departments’ increased access to student health information. Some pre-2003 programs may be revived and innovative new uses for shared information may be developed as a result. This presents great opportunities for health advocates and officials to take action and show the Department that it made the right decision.
* The explanation specifically noted the CDC’s disabilities surveillance programs as exemplary of the past use of “authorized representative” and the need for future flexibility in information sharing under FERPA. See Family Educational Rights and Privacy, 76 Fed. Reg. 75, 617 (Dec. 2, 1011) (to be codified at 34 C.F.R. pt. 99.3).
This blog was prepared by Charles Austin, student attorney in the Public Health Law Clinic at the University of Maryland Carey School of Law, supervised by Kathleen Hoke Dachille, J.D., director of the Network for Public Health Law – Eastern Region.
The Network for Public Health Law provides information and technical assistance on issues related to public health. The legal information and assistance provided in this document does not constitute legal advice or legal representation. For legal advice, readers should consult a lawyer in their state.