health mental-health
Is it against HIPAA law for a high school to keep records of a mental health survey administered to all students?
<p>At my son's high school, the administration administered a "Strengths and Difficulties Questionnaire" (SDQ) during class, which posed statements such as "I am often unhappy, depressed or tearful" and asked students to mark "Not True," "Somewhat True," or "Certainly True" (see image).</p>

<p>The SDQ was administered to all students except those whose parents opted them out. Students were not informed of the nature of the survey prior to taking it, but they did know that it was non-anonymous and that school administration would be accessing the results of the survey.</p>

<p>The parent of the friend of my son received a letter telling her that there was some concern over the responses of her son and that she should follow up with her son to make sure there aren't mental health issues. I did not receive a letter, so I assume my son's SDQ did not raise any flags. I also do not know who within my school's administration has access to the SDQ results.</p>

<p>My concern is that administration is gathering mental health information about students without telling students (aged 14-18) that the purpose of the SDQ is to gather information about their mental health, and releasing this information to their parents without the students' consent. This would seem to me to violate HIPAA, which forbids the disclosure of a patient's protected health information without the patient's authorization. I have attached an image of the SDQ, as well as a link to the official website.</p>

<p><a href="http://www.sdqinfo.com/py/sdqinfo/b3.py?language=Englishqz(USA)" rel="nofollow noreferrer">Link to survey download page</a> The correct file is "One-sided self-rated SDQ for 11-17 year olds"</p>

<p><a href="https://i.stack.imgur.com/qLkc0.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qLkc0.png" alt="enter image description here"></a></p>

<p>Everything appears fine in terms of the school's actions. Who cares if they give the information to the parents? As long as there is not some other violation at the school or unless the information goes deeper than what you've provided the student has no ability to consent or not. This is true for two reasons. </p>

<p>1) Protected Health Information</p>

<p>Protected health information under the HIPAA Privacy Rule protects most "individually identifiable health information" <em>held or transmitted by a covered entity or its business associate...</em> </p>

<p>HIPAA defines a <em>covered entity</em> as:</p>

<ul>
<li>a health care provider that conducts certain standard administrative and financial transactions in electronic form </li>
<li>a health care clearinghouse; or</li>
<li>a health plan</li>
</ul>

<p>As I'm sure you agree, the school is neither one of those things.</p>

<p>2) Talking to the parents of a minor</p>

<p>The <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html" rel="nofollow noreferrer">Privacy Rule</a> defers to state law regarding who is and is not considered a minor and when. That said, in general situations, "a parent, guardian or other person acting <em>in loco parentis</em> usually is the personal representative of the minor child, and a health care provider is permitted to share patient information with a patient's personal representative." </p>

<p>A parent is not treated as a minor child's personal representative <a href="https://www.hhs.gov/hipaa/for-professionals/special-topics/mental-health/index.html" rel="nofollow noreferrer">when</a>: </p>

<blockquote>
  <p>(1) State or other law does not require the consent of a parent or other person before a minor can obtain a particular health care service, the minor consents to the health care service, and the minor child has not requested the parent be treated as a personal representative; (2) someone other than the parent is authorized by law to consent to the provision of a particular health service to a minor and provides such consent; or (3) a parent agrees to a confidential relationship between the minor and a health care provider with respect to the health care service.</p>
</blockquote>

<p>Finally, special treatment is given to cases of psychotherapy notes. A parent does not have a right to receive a copy of these notes about a child's mental health treatment. </p>

<blockquote>
  <p>The Privacy Rule distinguishes between mental health information in a mental health professional’s private notes and that contained in the medical record.  It does not provide a right of access to psychotherapy notes, which the Privacy Rule defines as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session and that are separate from the rest of the patient’s medical record.</p>
</blockquote>

<p><strong>Addendum</strong></p>

<p>Recognizing that a school is not a health care provider or clearinghouse or health plan, I looked further for an answer related specifically to schools. Schools in these situations are not in general governed by HIPAA, but rather are governed by the Family Educational Rights and Privacy Act (FERPA). This <a href="https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/coveredentities/hipaaferpajointguide.pdf" rel="nofollow noreferrer">Joint Guidance on the Application of the FERPA and the HIPAA to Student Health Records</a> issued jointly by the Dep't of Health and Human Services and the Dep't of Education is worth you taking a look at due to the numerous situations that  can arise and the detailed Q&amp;A included. </p>

<p>Generally, though, parents and eligible students (those 18+) have the right to inspect and review the student's education records. Education records are those that are directly related to the student and kept by an educational institution or agency or by a party acting for that agency or institution. </p>

<p>Importantly, for you:</p>

<blockquote>
  <p>At the elementary or sec
  ondary level, a student’s health 
  records, including immunization records, maintained
   by an educational agency or institution subject 
  to 
  FERPA
  , as well as records maintained by a school
   nurse, are “education records” subject to 
  FERPA
  .  In addition, records that schools maintain 
  on special education stude
  nts, including records 
  on services provided to students under the 
  Individuals with Disabilities Education Act (IDEA),
   are 
  “education records” under 
  FERPA
  .  This is because these record
  s are (1) directly related to a 
  student, (2) maintained by the schoo
  l or a party acting for the school, 
  and (3) not excluded from the 
  definition of “education records.”<br>
  At postsecondary institutions, medical and psychological treatment records of eligible students are 
  excluded from the definition of “e
  ducation records” if they are ma
  de, maintained, and used only in 
  connection with treatment of the student and disclosed only to indi
  viduals providing the treatment.<br>
  See 34 
  CFR 
  § 99.3 “Education records.”  These records ar
  e commonly called “treatment records.”<br>
  An eligible student’s treatment records may be 
  disclosed for purposes other than the student’s 
  treatment, provided the records ar
  e disclosed under one of the exce
  ptions to written consent under 
  34 
  CFR 
  § 99.31(a) or with the student
  ’s written consent under 34 
  CFR 
  § 99.30.  If a school 
  discloses an eligible student’s treatment records 
  for purposes other than treatment, the records are 
  no longer excluded from the defi
  nition of “education 
  records” and are subject to all other 
  FERPA
  requirements.   </p>
</blockquote>

<blockquote>
  <p><em>Is it against HIPAA law for a high school to keep records of a mental health survey administered to all students?</em></p>
</blockquote>

<p>They can give tests and keep records as long as they abide by HIPAA when it comes to giving the tests, storing the records and allowing access to those who who have legal access.</p>

<blockquote>
  <p><em>My concern is that administration is gathering mental health information about students without telling students (aged 14-18)...
  and releasing this information to their parents without the students'
  consent. This would seem to me to violate HIPAA, which forbids the
  disclosure of a patient's protected health information without the
  patient's authorization.</em></p>
</blockquote>

<p>See <a href="https://www.hhs.gov/hipaa/for-professionals/faq/227/can-i-access-medical-record-if-i-have-power-of-attorney/index.html" rel="nofollow noreferrer">227-Does the HIPAA Privacy Rule allow parents the right to see their children’s medical records | HHS.gov</a></p>

<blockquote>
  <p>Yes, the Privacy Rule generally allows a parent to have access to the
  medical records about his or her child, as his or her minor child’s
  personal representative when such access is not inconsistent with
  State or other law.</p>
</blockquote>

<p>See the link above for these three exceptions (and more details about privacy and HIPAA):</p>

<blockquote>
  <p>There are three situations when the parent would not be the minor’s
  personal representative under the Privacy Rule. These exceptions are:</p>
  
  <ol>
  <li><p>When the minor is the one who consents to care and the consent of
  the parent is not required under State or other applicable law;</p></li>
  <li><p>When the minor obtains care at the direction of a court or a person
  appointed by the court; and</p></li>
  <li><p>When, and to the extent that, the parent agrees that the minor and
  the health care provider may have a confidential relationship.</p></li>
  </ol>
</blockquote>
