Privacy Law Gaps in High School STI Health Services.

Most school nurses now collaborate with local health departments in initiatives to improve student health, including for health issues where students may be particularly concerned about privacy, such as sexually transmitted infections (STIs), substance use, and mental health.

But a new commentary by School of Public Health researchers highlights how collaborations between schools and health departments can create gaps in student privacy.

Published in the journal Pediatrics, the paper uses the example of high school sexually transmitted infection (STI) programs.

“Students who use health programs in school may not realize that there could be vulnerabilities for their private health information,” says Patricia Elliott, clinical assistant professor of community health sciences and the paper’s lead author. “School nurses and health departments who collaborate on programs in schools must also collaborate on explicit protections for students’ private health information.”

Complications arise in these collaborations, the authors write, because school nurses operate under the Family Educational Rights and Privacy Act (FERPA), while health departments may operate under the Health Insurance Portability and Accountability Act (HIPAA). Both laws are meant to protect patient privacy, but in different ways, leaving unintentional gaps. For example, FERPA allows parents to see medical information in the school record, and allows school nurses to disclose medical information to other school administrators in some cases.

When private medical information from, for example, a local health department’s in-school STI testing and treatment program operating under HIPAA is passed on to a school nurse operating under FERPA, that information becomes less private than a student—and perhaps even the health department program—may realize.

To help close the gap, Elliott and colleagues write that collaborations between schools and local health departments should include mapping out processes and workflow to find and anticipate these gaps, and that collaborators should create clear privacy protocols for all partners and tell students in plain language what privacy protections they can expect.

“Schools have become important sites for many health interventions, but, if we are not careful, what is good for a student’s health may not be good for their privacy,” Elliott says.

The commentary was co-authored by Emily Feinberg, associate professor of community health sciences, and by William DeJong of Tufts University.

—Michelle Samuels