Everything appears fine in terms of the school's actions. Who cares if they give the information to the parents? As long as there is not some other violation at the school or unless the information goes deeper than what you've provided the student has no ability to consent or not. This is true for two reasons.
1) Protected Health Information
Protected health information under the HIPAA Privacy Rule protects most "individually identifiable health information" held or transmitted by a covered entity or its business associate...
HIPAA defines a covered entity as:
- a health care provider that conducts certain standard administrative and financial transactions in electronic form
- a health care clearinghouse; or
- a health plan
As I'm sure you agree, the school is neither one of those things.
2) Talking to the parents of a minor
The Privacy Rule defers to state law regarding who is and is not considered a minor and when. That said, in general situations, "a parent, guardian or other person acting in loco parentis usually is the personal representative of the minor child, and a health care provider is permitted to share patient information with a patient's personal representative."
A parent is not treated as a minor child's personal representative when:
(1) State or other law does not require the consent of a parent or other person before a minor can obtain a particular health care service, the minor consents to the health care service, and the minor child has not requested the parent be treated as a personal representative; (2) someone other than the parent is authorized by law to consent to the provision of a particular health service to a minor and provides such consent; or (3) a parent agrees to a confidential relationship between the minor and a health care provider with respect to the health care service.
Finally, special treatment is given to cases of psychotherapy notes. A parent does not have a right to receive a copy of these notes about a child's mental health treatment.
The Privacy Rule distinguishes between mental health information in a mental health professional’s private notes and that contained in the medical record. It does not provide a right of access to psychotherapy notes, which the Privacy Rule defines as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session and that are separate from the rest of the patient’s medical record.
Addendum
Recognizing that a school is not a health care provider or clearinghouse or health plan, I looked further for an answer related specifically to schools. Schools in these situations are not in general governed by HIPAA, but rather are governed by the Family Educational Rights and Privacy Act (FERPA). This Joint Guidance on the Application of the FERPA and the HIPAA to Student Health Records issued jointly by the Dep't of Health and Human Services and the Dep't of Education is worth you taking a look at due to the numerous situations that can arise and the detailed Q&A included.
Generally, though, parents and eligible students (those 18+) have the right to inspect and review the student's education records. Education records are those that are directly related to the student and kept by an educational institution or agency or by a party acting for that agency or institution.
Importantly, for you:
At the elementary or sec
ondary level, a student’s health
records, including immunization records, maintained
by an educational agency or institution subject
to
FERPA
, as well as records maintained by a school
nurse, are “education records” subject to
FERPA
. In addition, records that schools maintain
on special education stude
nts, including records
on services provided to students under the
Individuals with Disabilities Education Act (IDEA),
are
“education records” under
FERPA
. This is because these record
s are (1) directly related to a
student, (2) maintained by the schoo
l or a party acting for the school,
and (3) not excluded from the
definition of “education records.”
At postsecondary institutions, medical and psychological treatment records of eligible students are
excluded from the definition of “e
ducation records” if they are ma
de, maintained, and used only in
connection with treatment of the student and disclosed only to indi
viduals providing the treatment.
See 34
CFR
§ 99.3 “Education records.” These records ar
e commonly called “treatment records.”
An eligible student’s treatment records may be
disclosed for purposes other than the student’s
treatment, provided the records ar
e disclosed under one of the exce
ptions to written consent under
34
CFR
§ 99.31(a) or with the student
’s written consent under 34
CFR
§ 99.30. If a school
discloses an eligible student’s treatment records
for purposes other than treatment, the records are
no longer excluded from the defi
nition of “education
records” and are subject to all other
FERPA
requirements.
I fight a lot. I can make other people do what I want
being a single item is hilarious. – Parthian Shot Dec 7 '17 at 6:50