Guidance on Releasing Immunization Records to Schools

On January 25, 2013,  the Department of Health and Human Services (“HHS”) released the HITECH Omnibus Final Rule (“Final Rule”) which revised and added to the HIPAA Privacy and Security regulations.   This Final Rule added a provision regarding the Disclosure of Student Immunization to Schools, which allows a covered entity (“Provider”), to use or disclose protected health information (“PHI”) to a school about an individual who is a student or prospective student of the school, if three conditions are satisfied:  

(A) The PHI is limited to proof of immunization;

(B) The school is required by law to obtain proof of immunization prior to admitting the individual (such as a “school entry” law that prohibits a child from attending school unless the school has proof that the child has been immunized);  and

(C) The Provider obtains and documents agreement to the disclosure (“Agreement”) from either:

(1) A parent, guardian, or other person acting in loco parentis of the individual, if the individual is an unemancipated minor; or

(2) The individual, if the individual is an adult or emancipated minor.

On September 19, 2013, HHS released guidance further clarifying the scope of a covered entity’s authority to release PHI to a school (“Guidance”).   First, the  Agreement may be obtained orally or in writing, and need not be signed or contain the other elements required in a formal, written HIPAA authorization for disclosure of PHI.  Although the Agreement does not have to be in writing, the Provider must document that the Agreement was made.  The Final Rule and Guidancedo not specifically describe how the Agreement should be documented, but the Guidance recognizes that documentation may be satisfied, for example, by making a copy of a written request by a parent to disclose proof of immunization, or by a notation in a child’s medical record about a phone conversation with a parent who requests that the Provider disclose proof of immunization. HHS also clarifies that the required Agreement will remain in effect until the parent, guardian, or other person acting in loco parentis, or student, if applicable, revokes it. 

HHS stated that it hopes this new rule ensures that schools will receive immunization documentation in a timely manner and will be able to admit children without undue delay.

If you have any questions regarding the HIPAA Final Rule, or Releasing Immunization Records to Schools, please contact Susan Ziel (sziel@kdlegal.com), Meghan McNab (mmcnab@kdlegal.com), Mark Morrell (mmorrell@kdlegal.com), or Jaya White (jwhite@kdlegal.com).