VIA FACSIMILE 202-260-3053

The Honorable Donna Shalala
Secretary
Department of Health and Human Services
615 F Hubert Humphrey Building
200 Independence Avenue, S.W.
Washington, DC 20201

Dear Secretary Shalala:

We are writing to provide our comments on the Department of Health and Human Services' proposed rule for the privacy of individually identifiable health information that was recently included in the Federal Register. As you know, the proposed rule could potentially impact public elementary and secondary schools and the rights of parents. It is in that context that we write to you.

As we understand it, the rule proposes to put in place the first-ever set of national standards to protect the privacy of Americans' personal health records. The standards would apply to medical records created by health care providers, hospitals, health plans and health care clearinghouses that are either transmitted or maintained electronically, and the paper printouts created from such records. The rule protects from disclosure to third parties electronically maintained individually identifiable health information, without the specific authorization of the subject of the information.

Our concern is the proposed rule appears to supersede, or at a minimum create ambiguity as to the applicability of the Family Educational Rights and Privacy Act (FERPA). As we read the rule, it could be potentially construed to supersede the rights of parents under FERPA, something we believe you should avoid. As you may know, FERPA gives parents the right to access "education records" of their unemancipated minor children.

Under FERPA, the term "education records" means ". . . those records, fields, documents, and other materials, which --- (i)contain information directly related to a student; and (ii) are maintained by an educational agency or institution, or by a person acting for such agency or institution." 20 USC 1232g(a)(4) Under FERPA, we believe it is clear that parents have the right to access not only education records but also health records maintained by an educational agency or institution on their unemancipated minor child. Under the proposed rule, such electronic health records would appear to be protected, even from disclosure to parents, unless the the child consented. For the sake of clarity, only one law (i.e. FERPA) should govern K-12 student records, whether health records or traditional education records.

Under the proposed rule, a "health care provider" is defined as:

"5. Health care provider. Section 1171(3) of the Act defines "health care provider" as a "provider of medical services as defined in section 1861(u) of the Act, a provider of medical or other health services as defined in section 1861(s) of the Act, and any other person who furnishes health care services or supplies." We [HHS] are proposing to define "health care provider" as the Act does, and clarify that a health care provider is limited to any person or organization that furnishes, bills, or is paid for, health care services or supplies in the normal course of business. This definition would include a researcher who provides health care to the subjects of research, free clinics, and a health clinic or licensed health care professional located at a school or business." 64 Federal Register 59930

Under the proposed rule, "health information" is defined as:

"6. Health information. We [HHS] would define "health information" as it is defined in section 1171(4) of the Act. "Health information" would mean any information, whether oral or recorded in any form or medium, that is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and that relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual." 64 Federal Register 59930-31

The proposed rule also talks specifically about the scope of the rule. It says:

"For example [example of scope of the rule], schools frequently employ school nurses or operate on-site clinics. In doing so, the nurse or clinic component of the school would be acting as a provider, and must conform to this proposed rule." 64 Federal Register 59951.

These are the definitions that appear to bring electronic health information maintained at school based health clinics under the protection of the proposed rule, meaning that the information is protected even from disclosure to parents.

The proposed rule does state that individually identifiable health information that is part of an "education record" under FERPA would not be considered protected health information. That particular language reads:

"Individually identifiable health information that is part of an "education record" governed by the Family Educational Rights and Privacy Act (FERPA), 20 USC 1232g, would not be considered protected health information." 64 Federal Register 59938.

On the one hand, the proposed rule brings elementary and secondary school health records (whether a part of "education records" or other records maintained by the school or a school-based clinic or school-based nurses' office) within the purview of the rule. On the other hand, the rule says that health information that is a part of an "education record" under FERPA is not covered. Clarity is needed.

Accordingly, we recommend:

(1) deletion of all references to schools in the definitions of "health care provider" and "health information," or alternatively clarify that you do not intend to capture within the scope of the rule elementary and secondary schools; and

(2) clarifying in your discussion of FERPA, that not only does the proposed HHS rule not apply to individually identifiable health information that is part of an "education record," but it also does not apply to any other health information in an educational agency or institution, regardless of whether it is considered an "education record" as defined in FERPA.