To limit your school’s liability risks, you must protect students from all kinds of safety threats. It’s important to not only be prepared for the obvious and established threats, but also for the emerging threats that could catch you off-guard. One of those emerging threats relates to the management of student health information. To dig a little deeper into this topic, we did a brief Q&A with our CEO, Chas Scarantino.

Q: What types of student health information are schools managing today?

A: Schools have to manage any medical information required for healthcare and treatment, concussions, enrollment, or attendance purposes. Data on immunizations, sports physical data, consent to dispense prescription or over the counter medication, consent to treat, action plans, and health history are just a few of the many types of health information that schools may be managing. Nearly all of this information is private information, and as such, it presents liability for a school if it is handled incorrectly.

Q: Can you give us an example of how mismanagement of student health information exposed a school to negative consequences?

A: Two come to mind. In one case, a school took a folder of athlete health information to an away baseball game, and when the game was over, and they were on the bus back to campus, they realized all of the private information in that folder had been left on the dugout bench. It was entirely by accident, but still, that information was available to anyone who happened upon it. Similarly, one school was very conscious of “going green” and were very active in recycling. Unfortunately, the nurse recycled health records, which were then used by other students to make paper airplanes. One of the airplanes hit an administrator, and that’s when they realized the proper record processes weren’t in place. In both cases, the school could have been open to very real consequences, simply by making honest mistakes.

Q: What kinds of liability risks are associated with the handling of student medical information?

A: We talk with schools about risks in four areas: regulatory compliance, data accuracy, data security, and emergency preparedness. Mishandling or improperly storing student health information can expose schools to legal penalties. And in situations where students fall ill on school property or school transportation, mismanagement of student health data can be a barrier to providing adequate student care.

Q: Let’s talk about regulatory compliance. What regulations do schools need to know about?

A: The big two are FERPA, which regulates student education records, and HIPAA, the health care information privacy law. Most schools are aware of both, but don’t always know how or if they apply to their school. These federal regulations aim to protect student information from unauthorized viewing or dissemination. In addition to federal regulations, there are state and district regulations on management of student data as well. Failure to comply with these regulations opens schools up to significant penalties under the law.

(Download our HIPAA & FERPA research paper to learn how these laws apply to your school.)

Q: As more and more student records migrate from paper files to electronic databases, data privacy and accuracy become important concerns. What issues do school leaders need to address in these areas?

A: Various laws and regulations require parents to provide certain kinds of health information to schools, but sometimes parents submit incomplete or incorrect data. For example, the parent is required to show proof of three doses of a vaccination, and they only submit proof of two. You need to confirm that submitted information is accurate and complete. Also, federal regulations closely define who can access student data and for what purposes it can be used. School leaders need to know how to properly secure this data, provide access to only the people authorized to see it, and destroy it safely. Data privacy goes a step beyond that as well. Privacy includes logging interaction with the health information – so even those individuals who are authorized to view the information should be tracked ,and an audit log should be created so that the information is protected beyond simple access.

Q: Earlier, you touched on medical emergencies. What emergency preparedness steps do schools need to take to mitigate their liability risks?

A: Health information absolutely must be accessible to people who need to provide emergency care to a student. A healthcare provider should not have to start from square one in order to treat a student – they should have the information on hand so they know what medications the child is on, or what allergies they have. Schools should define access policies, in accordance with regulations, and ensure that the proper people have access to information, and that the information can be shared with authorized personnel. And test out the policies, know what works, what needs to be tweaked, and how the overall response can be improved. In addition, you need to be ready to deal with natural disasters that could wipe out a health center entirely, and other events that could cause technology disruptions. If data is properly backed up, these situations do not pose a threat to the integrity of the data, and parents can update information as needed.

Q: In your experience, how difficult is it for schools to defend against these risks, and what can schools do to protect themselves?

A: The biggest thing here is taking the step to ask the hard questions. Once schools are investigating where their vulnerabilities lie, they can get processes in place. While creating processes and testing them out can be time consuming, once the hard work is done there, the rest can become relatively simple. A comprehensive system will address all four risks in one, so it’s not a matter of finding four answers to four problems – it’s a matter of finding one solution that can do everything.

Handling student health information is just one of many liability concerns for schools to consider. The more obvious, and potentially more dangerous concerns are physical, like disasters. Download our Disaster Preparation and Recovery research paper for more insight on how to prepare and react in disaster situations.

{{cta(‘505c2545-76bb-4456-861e-9142db32f55f’,’justifycenter’)}}