Is it against HIPAA law for a high school to keep records of a mental health survey administered to all students?

Question

At my son's high school, the administration administered a "Strengths and Difficulties Questionnaire" (SDQ) during class, which posed statements such as "I am often unhappy, depressed or tearful" and asked students to mark "Not True," "Somewhat True," or "Certainly True" (see image).

The SDQ was administered to all students except those whose parents opted them out. Students were not informed of the nature of the survey prior to taking it, but they did know that it was non-anonymous and that school administration would be accessing the results of the survey.

The parent of the friend of my son received a letter telling her that there was some concern over the responses of her son and that she should follow up with her son to make sure there aren't mental health issues. I did not receive a letter, so I assume my son's SDQ did not raise any flags. I also do not know who within my school's administration has access to the SDQ results.

My concern is that administration is gathering mental health information about students without telling students (aged 14-18) that the purpose of the SDQ is to gather information about their mental health, and releasing this information to their parents without the students' consent. This would seem to me to violate HIPAA, which forbids the disclosure of a patient's protected health information without the patient's authorization. I have attached an image of the SDQ, as well as a link to the official website.

Link to survey download page The correct file is "One-sided self-rated SDQ for 11-17 year olds"

Answer 1

Everything appears fine in terms of the school's actions. Who cares if they give the information to the parents? As long as there is not some other violation at the school or unless the information goes deeper than what you've provided the student has no ability to consent or not. This is true for two reasons.

1) Protected Health Information

Protected health information under the HIPAA Privacy Rule protects most "individually identifiable health information" held or transmitted by a covered entity or its business associate...

HIPAA defines a covered entity as:

• a health care provider that conducts certain standard administrative and financial transactions in electronic form
• a health care clearinghouse; or
• a health plan

As I'm sure you agree, the school is neither one of those things.

2) Talking to the parents of a minor

The Privacy Rule defers to state law regarding who is and is not considered a minor and when. That said, in general situations, "a parent, guardian or other person acting in loco parentis usually is the personal representative of the minor child, and a health care provider is permitted to share patient information with a patient's personal representative."

A parent is not treated as a minor child's personal representative when:

(1) State or other law does not require the consent of a parent or other person before a minor can obtain a particular health care service, the minor consents to the health care service, and the minor child has not requested the parent be treated as a personal representative; (2) someone other than the parent is authorized by law to consent to the provision of a particular health service to a minor and provides such consent; or (3) a parent agrees to a confidential relationship between the minor and a health care provider with respect to the health care service.

Finally, special treatment is given to cases of psychotherapy notes. A parent does not have a right to receive a copy of these notes about a child's mental health treatment.

The Privacy Rule distinguishes between mental health information in a mental health professional’s private notes and that contained in the medical record. It does not provide a right of access to psychotherapy notes, which the Privacy Rule defines as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session and that are separate from the rest of the patient’s medical record.

Addendum

Recognizing that a school is not a health care provider or clearinghouse or health plan, I looked further for an answer related specifically to schools. Schools in these situations are not in general governed by HIPAA, but rather are governed by the Family Educational Rights and Privacy Act (FERPA). This Joint Guidance on the Application of the FERPA and the HIPAA to Student Health Records issued jointly by the Dep't of Health and Human Services and the Dep't of Education is worth you taking a look at due to the numerous situations that can arise and the detailed Q&A included.

Generally, though, parents and eligible students (those 18+) have the right to inspect and review the student's education records. Education records are those that are directly related to the student and kept by an educational institution or agency or by a party acting for that agency or institution.

Importantly, for you:

At the elementary or sec ondary level, a student’s health records, including immunization records, maintained by an educational agency or institution subject to FERPA , as well as records maintained by a school nurse, are “education records” subject to FERPA . In addition, records that schools maintain on special education stude nts, including records on services provided to students under the Individuals with Disabilities Education Act (IDEA), are “education records” under FERPA . This is because these record s are (1) directly related to a student, (2) maintained by the schoo l or a party acting for the school, and (3) not excluded from the definition of “education records.”
At postsecondary institutions, medical and psychological treatment records of eligible students are excluded from the definition of “e ducation records” if they are ma de, maintained, and used only in connection with treatment of the student and disclosed only to indi viduals providing the treatment.
See 34 CFR § 99.3 “Education records.” These records ar e commonly called “treatment records.”
An eligible student’s treatment records may be disclosed for purposes other than the student’s treatment, provided the records ar e disclosed under one of the exce ptions to written consent under 34 CFR § 99.31(a) or with the student ’s written consent under 34 CFR § 99.30. If a school discloses an eligible student’s treatment records for purposes other than treatment, the records are no longer excluded from the defi nition of “education records” and are subject to all other FERPA requirements.

Answer 2

Is it against HIPAA law for a high school to keep records of a mental health survey administered to all students?

They can give tests and keep records as long as they abide by HIPAA when it comes to giving the tests, storing the records and allowing access to those who who have legal access.

My concern is that administration is gathering mental health information about students without telling students (aged 14-18)... and releasing this information to their parents without the students' consent. This would seem to me to violate HIPAA, which forbids the disclosure of a patient's protected health information without the patient's authorization.

See 227-Does the HIPAA Privacy Rule allow parents the right to see their children’s medical records | HHS.gov

Yes, the Privacy Rule generally allows a parent to have access to the medical records about his or her child, as his or her minor child’s personal representative when such access is not inconsistent with State or other law.

See the link above for these three exceptions (and more details about privacy and HIPAA):

There are three situations when the parent would not be the minor’s personal representative under the Privacy Rule. These exceptions are:

1. When the minor is the one who consents to care and the consent of the parent is not required under State or other applicable law;

2. When the minor obtains care at the direction of a court or a person appointed by the court; and

3. When, and to the extent that, the parent agrees that the minor and the health care provider may have a confidential relationship.