Margaret Hamburg, M.D.
Assistant Secretary for Planning and Evaluation
U.S. Department of Health and Human Services
Attention: Privacy-P, Room G-322A
Hubert H. Humphrey Building
200 Independence Avenue, S.W.
Washington, D.C. 20201

Dear Dr. Hamburg:

I am submitting comments for the Department of Education on the Department of Health and Human Services' proposed rule on "Standards for Privacy of Individually Identifiable Health Information" that was published in the Federal Register, volume 64, No. 212, on November 3, 1999. We are concerned about the potential impact of this proposed regulation on our Nation's over 87,600 public elementary and secondary schools, 6,800 public postsecondary education institutions, and those private schools and postsecondary institutions covered by FERPA.

The proposed rule contains an important exclusion in section 164.504, which excepts individually identifiable health information that is part of an "education record" governed by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. 1232g, from the definition of "protected health information." We support this exclusion.

We request, however, that you consider adding another exclusion to the definition of protected health information in order to avoid confusion concerning the interplay of FERPA and the proposed rule. We would like the proposed rule to except from the definition of protected health information the treatment records of students who attend institutions of postsecondary education or who are 18 years old or over. FERPA excepts the treatment records of these students from the definition of education records so long as only treatment providers access the records. However, if the treatment records are disclosed to a non-treatment provider, they become education records under FERPA. Because the treatment records of students who attend institutions of postsecondary education or who are 18 years old or over that are accessed only by treatment providers are not education records under FERPA, they are covered by the proposed rule. However, if a school or institution of postsecondary education discloses such treatment records (even if the disclosure is authorized by the proposed rule) to anyone other than treatment providers, then FERPA also will apply to the legality of the disclosure. This is confusing. Moreover, it creates a trap for the unwary because FERPA and the proposed rule contain different legal standards governing when nonconsensual (or unauthorized) disclosures are permissible. Thus, a disclosure of treatment records that is permitted under the proposed rule may violate FERPA.

To avoid this type of "Catch-22" result, we suggest adding to section 164.504 tile following exception to the definition of protected health information: "individually identifiable health information in records maintained by an educational agency or institution (as defined under FERPA) on a student who is 18 years of age or older, or is attending an institution of postsecondary education, that are: (i) made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assisting in a paraprofessional capacity; (ii) made, maintained or used only in connection with the treatment of the student; and (iii) disclosed only to individuals providing the treatment." This addition will ensure that FERPA, and not the Proposed Rule, applies to the disclosure of individually identifiable health information in student health records maintained by educational agencies and institutions.

We also are concerned about some statements in the preamble. We recommend that they be modified or deleted, as follows:

(1) Protected Health Information - The preamble included the following statement in the discussion of protected health information" (page 59938):

Individually identifiable health information that is part of an 'education record' governed by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. 1232g, would not be considered protected health information. Congress specifically addressed such information when it enacted FERPA to protect the privacy rights of students and parents in educational settings. FERPA applies to educational records that are maintained by educational agencies and institutions that are recipients of federal funds from the Department of Education. FERPA requires written consent of the parent or student prior to disclosure of education records except in statutorily specified circumstances. We do not believe that Congress intended to amend or preempt FERPA in enacting HIPAA.

While the section on Protected Health Information includes the above paragraph, the preamble section on Application to Covered Entities that are Components of Organizations that are not Covered Entities (Component Entities - page 59951) includes the following example:

For example, schools frequently employ school nurses or operate on-site clinics. In doing so, the nurse or clinic component of the school would be acting as a provider, and must conform to this proposed rule. School clinics would be able to use protected health information obtained in an on-site clinic for treatment and payment purposes, but could not disclose it to the school for disciplinary purposes except as permitted by this rule.

We believe that the statement that a nurse employed by the school or on-site clinic operated by the school can use protected health information for treatment and payment purposes will be confusing for school personnel. Section 164.504 of the HHS proposed rule "...excludes individually identifiable health information in education records covered by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. 1232g."

FERPA defines an education record as a record that is directly related to a student and is maintained by an educational agency or institution or by a party acting for the agency or institution (20 U.S.C. 1232g(a)(4)). As such, student records maintained by a school nurse or an on-site clinic typically will be education records covered by FERPA and will be excepted from the definition of "protected health information." We believe that including this example is confusing and will lead to uncertainty concerning which rules apply to student health records maintained by educational agencies and institutions. We recommend that this example be deleted from the preamble.

(2) Health Care Provider - We are concerned that the proposed regulations may place an unnecessary burden on school clinics and school health care providers that only maintain records that are excluded from the definition of protected health information. At page 59930, the preamble states that the definition of "health care provider" includes, among other things, "a health clinic or licensed health care professional located at a school or business." However, the definition of "health care provider" at section 160.103 of the proposed regulation does not include a reference to schools. We recommend that the reference also be deleted from the preamble. Inclusion of school-based health clinics or personnel in the description of the "health care provider" definition may create an inference that a school clinic or health care professional is a "covered entity" under the proposed regulations, irrespective of whom the school clinic treats.

Further, it appears that the proposed regulations will require school clinics/health care providers to maintain a designated privacy official and a contact person, to document compliance with the regulation's policies and procedures, and to permit access by the Secretary of HHS. We question whether school-based clinics/health care providers should have to comply with the ancillary requirements when the substantive provisions do not apply.

As such, we suggest that HHS clarify the relationship of this regulation to schools that maintain only records that are excepted from the definition of protected health information and to schools that maintain protected health information, such as records of faculty or staff. We believe that HHS should delete the reference in the preamble to a health clinic or licensed health care professional located at a school or business as being a "health care provider." We also suggest that HHS consider the following: (a) adding language to the preamble to clarify that the regulations do not apply to school clinics or school health care providers that only maintain records that have been excepted from the definition of protected health information; (b) adding an exception to the definition of covered entities for these schools; or, (c) limiting the paperwork requirements for these schools to an attestation that they do not maintain protected health information.

(3) Relationship to Other Federal Laws - We recommend that a reference to the FERPA exception be added to this section (page 59999).

(4) Protected Health Information (section 164.504) - The reference to the Family Educational Right and Privacy Act should be to the Family Educational Rights and Privacy Act.

We appreciate your consideration of these comments.

Sincerely,