MONTGOMERY COUNTY, Md. — Families in Montgomery County have been sharing their frustration over what they’re calling a lack of transparency from the school district surrounding an increase in suspected overdoses.
We learned last week of two suspected overdoses, and that Narcan has been used there 11 times so far this school year.
District leaders told parents and students at a “fentanyl forum” over the weekend: their hands are tied because of HIPAA, and they can’t share much more information about these overdoses.
THE QUESTION:
So does HIPAA actually apply to schools?
THE SOURCES:
THE ANSWER:
HIPAA generally doesn't apply to schools, but there are other rules around how they treat student medical information--and sometimes, it comes down to district policy.
WHAT WE FOUND:
As a reminder, the HIPAA Privacy Rule is from the The “Health Insurance Portability and Accountability Act.”
It’s a federal law to protect people’s sensitive health information from being shared without their knowledge, according to the Department of Health and Human Services and the CDC.
The HHS specifies, HIPAA is meant to prevent “individually identifiable health information” from being shared without that person’s permission.
But one thing people often forget: HIPAA applies specifically to the following entities–and their employees and associates:
- Health care providers
- Health plans, like insurance companies
- Medical clearinghouses, like billing companies
However, schools do have access to private information, like vaccination records—which are generally considered “education records” and protected under a different law–the “Family Educational Rights and Privacy Act,” or FERPA.
So under FERPA, a school can’t say, "Jane Doe was treated for a suspected overdose today." However, Montgomery County Schools tell us they will still be hesitant to say even vaguely, "a student was treated for a suspected overdose today," because there’s another, non-official factor at play: the rumor mill.
Students talk, they can figure things out, deduce private information a student might not want public–and ultimately schools do have a responsibility to protect student privacy and well-being.
That's why Montgomery County School District personnel tell us they tend to be more general and report on trends and aggregate information, rather than specific incidents, because it’s easier to maintain student privacy that way.