Understanding the Privacy Rights of HIPAA & FERPA in Schools
Public school districts regularly receive medical information concerning its students and employees. Inevitably, questions arise about what medical information the school district can request or share with staff, parents and other affected individuals. This article is meant to answer some of these questions.
The Health Insurance Portability and Accountability Act ("HIPAA") provides protection for personal health information held by covered entities. A covered entity under HIPAA is either: (1) a health plan, (2) a healthcare clearinghouse, or a (3) healthcare provider that transmits health information electronically in connection with certain administrative and financial transactions.
Schools are obviously not a covered entity health plan or healthcare clearinghouse. However, many school districts employ nurses, physicians, psychologists, or other healthcare providers who serve students and staff. Would the employment of these healthcare providers qualify a school district as a covered entity "healthcare provider" under HIPAA? The answer to this question depends on whether the school district: (1) furnishes, bills or receives payment for healthcare in the normal course of its business, and (2) transmits these covered transactions electronically.
For example, if a public high school employs a healthcare provider that bills Medicaid electronically for services required for a student under IDEA, the school would be considered a HIPAA-covered entity. The school district would be required to comply with HIPAA transactions, code sets and identifier rules with respect to such transactions. However, because most school districts maintain a student's health information in an "education record" that is covered by FERPA, HIPAA's privacy rules would exclude such information from HIPAA's coverage.
Thus, if a healthcare provider serves students under contract with or otherwise under the direct control of a public school covered by FERPA, any student health records created or maintained by this person are considered education records under FERPA, and not personal health information under HIPAA. This is the case regardless of whether the healthcare is provided to students on school grounds or offsite. Therefore, the school district in the above example would be required to comply with FERPA's privacy requirements with respect to this student's health information, including the requirements to obtain parental or student consent (if 18) in order to disclose Medicaid billing information about a service provided to this student.
HIPAA's privacy rules allow covered healthcare providers to disclose personal health information about students to school nurses, physicians, and other healthcare providers employed by a school district for treatment purposes, without the authorization of the student or the student's parent. For example, a student's primary care physician may discuss the student's medication and other healthcare needs with the school nurse, who would administer the student's medication and provide care to the student while the student is at school.
On occasion, outside parties who are not employed by or otherwise acting on behalf of a school district provide healthcare services directly to students while on school grounds. A recent example was the swine flu vaccinations provided to students last year at various school districts through health and social service agencies. In these circumstances, any health records created or maintained by these agencies are not "education records" subject to FERPA because the healthcare provider is not acting on behalf of the school. Therefore, a school would need to comply with FERPA and obtain parental or student (if 18) consent if the school wishes to disclose any personally identifiable student information from education records to these third-party healthcare providers.
For school district employees, HIPAA's privacy rules do not protect employment records, even if the information in those records is health-related. For example, if an employee submits medical records for the purpose of FMLA certification, these records are employment records for which HIPAA's privacy rules do not apply. Likewise, HIPAA's privacy rules do not prevent a school district from asking an employee to produce a doctor's note or other information about an employee's health, if such information is needed to administer sick leave, workers' compensation, wellness programs, or health insurance.
Although HIPAA's privacy rules do not apply to an employee's medical records in the possession of a school district, Ohio's Public Records Act ("PRA") generally exempts employee medical records from mandatory disclosure. To be exempt under the PRA, the medical records must pertain to a patient's medical history, diagnosis, prognosis, or medical condition, and be generated and maintained in the process of medical treatment. Hospital admission or discharge records are not considered medical records exempt under the PRA. Likewise, reports generated for reasons other than medical diagnosis or treatment, such as for employment or litigation purposes, are not "medical records" exempt from disclosure under the PRA.
Other state and federal statutes, such as the ADA or FMLA, may have a bearing on how school districts are to maintain medical information. School officials should consult with a member of Dinsmore & Shohl's education law practice group should they have specific questions regarding medical information maintained in student records or personnel files.
* * * * * * * * * *
Does your School Really "Own" its Intellectual Property?
by April Besl
The creative use of technology in public schools will be a key factor in the education of school children in the 21st Century. Virtually all school districts rely on information technology professionals to maintain information systems. It is not uncommon for these professionals to develop new software or other creative works in the scope of their school employment. Sometimes these creative new works have the potential to be marketable to third parties. Given this possibility, school districts would be wise to define who owns these creative works, and take appropriate measures to protect the school district's intellectual property rights.
Say, for example, the Northbridge School District hires a computer technician to develop, maintain, and service the technology it uses in its schools. As part of her employment, the technician develops a new piece of software that will revolutionize the way Northbridge securely maintains and accesses its records. Implementing this software will increase efficiency and security, and will decrease costs associated with maintaining these records. Northbridge soon realizes that this new software could be valuable to outside schools and/or organizations. To capitalize on this potential new revenue source, Northbridge enters into license negotiations with a third party, School Software, Inc., who would sell the software and pay a revenue-based license fee back to Northbridge.
However, during negotiations, School Software requests that Northbridge provide proof of ownership of the software for its own protection. Northbridge then realizes that its employment agreement with the technician did not include an assignment of rights in any works or inventions created during the course of her employment. The question becomes, does Northbridge own and have the right to license the software to School Software without that assignment?
The answer depends on the intellectual property rights at issue. When it comes to works and inventions created by school district employees, there are two relevant intellectual property rights that arise: copyright and patent. A copyright protects any creative work that is "fixed" into something tangible, i.e. a book, photograph, CD, blueprints, or software. A patent protects any new, useful, and non-obvious idea that has been turned into a prototype, drawings, designs, or even the invention itself.
Turning first to copyright, Northbridge would own the copyright in the software, as it currently exists, because the technician created the software within the scope of her employment at Northbridge. Software, as you may know, is made up of code that works in certain "steps" to achieve the desired outcome. However, while Northbridge owns the copyright in the software's "steps" as they current exist, Northbridge cannot prevent the technician from modifying these "steps" so that the software performs the exact same function, but in a different way. In such instance, the technician would own the altered version of the software, even though it achieves the same results or outcome as the Northbridge software.
With regard to patent rights, even though she was an employee when she made the software, the technician would own the right to patent the invention. This means that, if the technician applies for and obtains a patent with the U.S. Patent Office; she can prevent Northbridge from selling the software through School Software, even though the district owns the copyright in the current version. Northbridge would still be allowed to use the software in its schools though, under what is known as a "shop right," because the technician used the resources available to her as a result of her employment in creating the software. However, the revenue stream Northbridge was anticipating from sales of the software would be completely cut-off by the technician's superior rights.
Simply put, without an assignment of rights by the technician in her employment agreement, the technician can prevent Northbridge from doing anything other than using the software at schools within its own district. Thus, in order to ensure the stream of revenue it had anticipated from its contract with School Software, Northbridge would have to negotiate with the technician to secure an agreement to assign away her rights in the software, post-development, and with full knowledge of the software's value to the district.
School districts wishing to avoid this scenario should ensure that all employees who may create new intellectual property expressly assign all their rights in these works or inventions as part of their job. Even current employees, either immediately or upon a renewal of their contracts, should be asked to sign a revised employment contract to address the assignment of these intellectual property rights. Otherwise, school districts may find themselves in the same expensive shoes as that of Northbridge.
The attorneys at Dinsmore & Shohl have experience analyzing intellectual property rights of creative works produced by school employees. Should you have questions or need assistance in addressing intellectual property issues involving your school's employees, please contact a member of the firm's education law practice group.
* * * * * * * * * *
UPCOMING STATUTORY DEADLINES
December 31st
Last day for Treasurer to canvass the Board to establish the date of the organizational meeting. R.C. 3313.14.
January 15th
Last day for boards of education of city, exempted village, vocational and local school districts to meet and organize. R.C. 3313.14.
Last day for boards of education of city, exempted village, vocational and local school districts to adopt tax budget for upcoming fiscal year. R.C. 5705.28.
January 20th
Last day for boards of education to submit fiscal tax-year budget to county auditor. R.C. 5705.30.
January 31st
Annual Campaign finance reports due detailing contributions and expenditures through December 31, 2010. R.C. 3517.10.
Last day for governing board of an educational service center to meet and organize. R.C. 3313.14.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
