OP, school nurses in DCPS and most charters are NOT employees of the LEA and schools. DC school nurses are employed by Children's National or Department of Health.

If your school is a Title 1 school they are obligated by law to follow up on any and all concerns with your child's health, despite what you may opine or interpret about privacy or HIPAA. Many school nurses catheterize children, provide extensive medical support, and are highly specialized beyond the traditional perception of bandaids and icepacks.

DCPS does this because there’s a lot of poor people in the school system without regular care. They treat everyone in the system the same, regardless of your socioeconomic status.

Does the HIPAA Privacy Rule allow a health care provider to disclose protected health information (PHI) about a student to a school nurse or physician?

Yes. The HIPAA Privacy Rule allows covered health care providers to disclose PHI about students to school nurses[/b], physicians, or other health care providers [b]for treatment purposes, without the authorization of the student or student’s parent.

You are assuming, by citing this provision, that the school nurse is treating the kid for the same condition. You don't have any facts to support that. it may be the case that the school nurse is going to "treat" the kid on the school property -- or might be called upon to do so. Or not.

If the kid went to the ER to have a raisin removed from his nose, then you cannot make a credible claim that school nurse will continue the plan of care when school resumes on Monday and continue to "treat" the now-removed nose raisin. There's nothing to treat.

OP would have to be willing to divulge what the medical issue was that was treated in the ER to make a call on this.

Anonymous wrote:I think there is some confusion here about HIPAA. I'm pretty sure this type of use/disclosure (I'm not sure what the legal difference is) is allowed for "treatment". It's coordination of care.

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html

A covered entity may, without the individual’s authorization:

Use or disclose protected health information for its own treatment, payment, and health care operations activities.
For example: A hospital may use protected health information about an individual to provide health care to the individual and may consult with other health care providers about the individual’s treatment.

The facts as stated by OP do not fall under this provision that you cite.

I work in both the ambulatory setting (ie, your kid's pediatrician) and also in a local ICU.

Unless there's something the OP is intentionally failing to mention about the event that brought her kid to the ED, then the ED staff does not need to "coordinate care" with the CNMC-employed RN who is assigned to the kid's DCPS.

A possible hypothetical exception would be if, say, kid has severe asthma attack, is taken to ED, is given hospital-grade nebulizer in the ED, asthma flare is resolved, ED provider writes script for **never before used** asthma inhaler for home use. Communication is sent via internal health record from ED doctor to CNMC RN stationed at DCPS saying something to the effect of "please follow up with Timmy and confirm that new albuterol metered dose inhaler is therapeutic and no further flares have occurred since discharge. Confirm that student has medication available on site at DCPS during school day."

If something analogous to this ^^^ occurred , then OP has no leg to stand on. This shouldn't be "offensive" and it's not a violation of law. See also, concussion follow up, seizure follow up, and similar.

What is interesting to me is, what if CNMC DIDN'T contract to put its employees in DCPS? What if instead MedStar did, or Johns Hopkins? Then you wouldn't see the sort of hypothetical situation I used. Which is fine, just different.

Anonymous wrote:I would be ticked if this happened to me. If I don’t identify DCPS as ok to communicate with they should not contact them. This is an invasion of privacy.

They didn’t contact DCPS. Where are you getting that they did?

OP, I would be irked, too. Legal or not, it feels like a violation — and an unnecessary, big-brother-style one unless your child is past due for truly urgent care.

We give lip-service to protecting privacy but then come up with a billion and one excuses why this, that, or the other outweighs the right to privacy.

Anonymous wrote:

Anonymous wrote:Let's imagine a different story -
A 16 YO has a miscarriage and goes to the ER. The school nurse calls 2 weeks later asking if you followed up.

Would you still think it is OK for the school nurse to call home?

YES. Even more so! Whether I'm the parent or the teen in question.

Because a miscarriage can be a big deal medically and lead to dangerous complications, like hemorrhage and infection. To say nothing of psychological and social issues, but here, for medical reasons, a follow-up is very much needed.

What's wrong with you?!?

Anonymous wrote:It’s hard to see how this is not a HIPAA violation, unless you gave explicit permission for this information to be shared with the school.

No. The nurse is the health care provider to the same patient (the child), and this is a part of the ongoing medical care. Following up on an emergency room visit is standard care.

Does a physician need a patient's written authorization to send a copy of the patient's medical record to a specialist or other health care provider who will treat the patient?

Answer:

No. The HIPAA Privacy Rule permits a health care provider to disclose protected health information about an individual, without the individual’s authorization, to another health care provider for that provider’s treatment of the individual. See 45 CFR 164.506 and the definition of “treatment” at 45 CFR 164.501.

https://www.hhs.gov/hipaa/for-professionals/faq/271/does-a-physician-need-written-authorization-to-send-medical-records-to-a-specialist/index.html

More specifically,

Does the HIPAA Privacy Rule allow a health care provider to disclose protected health information (PHI) about a student to a school nurse or physician?

Yes. The HIPAA Privacy Rule allows covered health care providers to disclose PHI about students to school nurses, physicians, or other health care providers for treatment purposes, without the authorization of the student or student’s parent. For example, a student’s primary care physician may discuss the student’s medication and other health care needs with a school nurse who will administer the student’s medication and provide care to the student while the student is at school. In addition, a covered health care provider may disclose proof of a student's immunizations directly to a school nurse or other person designated by the school to receive immunization records if the school is required by State or other law to have such proof prior to admitting the student, and a parent, guardian, or other person acting in loco parentis has agreed to the disclosure. See 45 CFR 164.512(b)(1)(vi).

https://www.hhs.gov/hipaa/for-professionals/faq/517/does-hipaa-allow-a-health-care-provider-to-disclose-information-to-a-school-nurse/index.html

Anonymous wrote:

Anonymous wrote:Even if this is a violation if HIPAA, I think this is a good thing. They're making sure that some kids don't fall through the cracks.

That’s not how the law works though. You don’t get to set it aside because you think that’s a good thing to do.

I don't know about the specifics of the law in this case, but I'm just giving my opinion: that the system works well. Actually, I'd be surprised if there was a violation, since surely they must have worked around privacy concerns. Either there is a loophole in the law or OP signed something allowing the hospital to communicate with the school nurse.

I think there is some confusion here about HIPAA. I'm pretty sure this type of use/disclosure (I'm not sure what the legal difference is) is allowed for "treatment". It's coordination of care.

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html

A covered entity may, without the individual’s authorization:

Use or disclose protected health information for its own treatment, payment, and health care operations activities.
For example: A hospital may use protected health information about an individual to provide health care to the individual and may consult with other health care providers about the individual’s treatment.

Anonymous wrote:Let's imagine a different story -
A 16 YO has a miscarriage and goes to the ER. The school nurse calls 2 weeks later asking if you followed up.

Would you still think it is OK for the school nurse to call home?

YES. Even more so! Whether I'm the parent or the teen in question.

I would be ticked if this happened to me. If I don’t identify DCPS as ok to communicate with they should not contact them. This is an invasion of privacy.

Anonymous wrote:

Anonymous wrote:Don't take it personally.

DP. I take my child’s privacy very seriously. This would really bother me and unless they are considering their school nurses as part of Childrens, a likely privacy violation.

Yes the school system contracts it’s school nurse program to children’s.

Anonymous wrote:This seems to be a violation of HIPPA unless you signed a form that unknowingly allowed Children’s to share info with the school. Even if your school nurse is contracted to Children’s your child was not their patient at Children’s. Therefore they shouldn’t have had access to the info.

On the contrary, HIPAA specifically excludes exchange of information between health care providers in the course of ongoing care for the same patient. This never requires a waiver. I can find the citation, if you would like.