The HIPAA privacy rule and adolescents: legal questions and clinical challenges

Perspectives on Sexual and Reproductive Health, March-April, 2004 by Abigail English, Carol A. Ford

School-Based Health Centers

All school-based health centers require some form of consent from parents before a student who is a minor receives care. Often the parent need only sign a general consent form at the beginning of the school year. Many of these forms specify the services offered at the center, and many specify that services are confidential. However, in general, school-based health centers work hard to involve parents whenever that is possible and appropriate.

Many school-based health centers offer family planning services and STD screening, and often students want and expect that care to he confidential. In every state, minors can legally consent for STD screening; the same is usually true for family planning. As a result, information about STD screening and family planning is in a different category from information about general health care--which the minor may not have the legal right to consent for under state law. Thus, if information about the minor's health and services received at the center is requested either by a parent or by other school personnel, the school-based health center must pay special attention to ensuring that information about family planning and STD screening is not unintentionally disclosed along with other medical records. This is also true if the student's parent has authorized disclosure of health information or medical records to others, such as a new school or a camp. To the extent that confidentiality concerns arise with respect to billing and third-party reimbursement linked to school-based clinics, the same general considerations apply as in a private physician's office.

Finally, school-based health centers may have to address suggestions from school personnel that their records are covered not by HIPAA, but by FERPA. This will rarely be true, as long as school-based health centers or their sponsoring agencies meet the privacy rule's definition of a "covered entity" and center staff are careful to enter protected information only into the health center's record and not into a student's general education records, where it would be accessible to parents under FERPA. Nevertheless, schools and school-based health centers need procedures for determining which records are governed by the requirements of which law and what those requirements mean for how the information can be used with the school. Information about family planning or STD screening in a school-based health center will almost never be accessible to the school, and will be accessible to parents only under specific provisions of state law.

Specialized Clinic Settings

Every day, adolescents seek family planning or STD services in clinics specifically designed to provide such care. The application of the HIPAA privacy rule in these settings may differ markedly from its application in private physician offices or school-based health centers. At Title X-funded family planning clinics, the confidentiality protections of Title X apply; thus, if a minor receives contraceptive or STD care, the services are confidential and the minor's permission is required for information to be disclosed to her parent. The issues may be slightly more complex in family planning or STD clinics not receiving Tide X funds. If the minor is a Medicaid recipient, he or she is also entitled to receive confidential family planning services if the services are billed to Medicaid. (The same is true in other Medicaid provider sites, including private physician offices and school-based health centers.) However, once again, the variation in practice among Medicaid managed care plans and state Medicaid agencies with respect to the handling of confidential services on claim forms and benefit statements poses challenges.