Table 1: The Health Insurance Portability and Accountability Act (HIPAA)

Title I of HIPAA establishes conditions for protected health information use and disclosure, impacting how the various stakeholders involved in providing health care services - including therapists - are able to exchange information. In 2002, modifications to the privacy rule of HIPAA were made to ensure privacy without hindering access to health care. For current information, go to the U.S. Department of Health & Human Services website.

• HIPAA allows for covered entities, such as hospitals and audiologists, to share personal information to public health authorities such as EHDI without written prior authorization of the patient for the sake of surveillance, investigations, and interventions.
• "Signed consent" must be obtained to use personal information for (a) marketing purposes, such as selling lists of patients to third parties, and (b) research.
• Signed consent is NOT required for health providers to exchange information with other health care providers for routine health care delivery purposes, which is defined as treatment, payment, and health care operations. (One exception is the required signed consent to disclose psychotherapy notes, which may be part of a family’s treatment record.) HIPAA requires that patients be informed of their rights and the intention of the health care provider to share personal information with other health care providers, though this can be via verbal exchange.
• Signed consent is NOT required for covered entities to share personal information if it is for public health purposes (such as surveillance of newborn hearing screening and follow up).
• Providers must keep a record of any personal information that is shared with others.
• Signed consent is NOT required if there are state laws that mandate the exchange of information, such as required reporting of newborn hearing screening to the child’s primary care provider.

Table 2: The Family Educational Rights and Privacy Act (FERPA)

The Family Educational Rights and Privacy Act (FERPA) of 1974, also known as the Buckley Amendment, is a federal law that protects the privacy of student education records. An education agency, institution, or program that receives funds under a program from the U.S. Department of Education (which includes Part C Early Intervention Programs) must abide by the provisions of this law. FERPA specifies that students and guardians have a right to know about the information kept as a part of their educational records; in other words, content of records cannot be kept a secret. In general, "education records" cannot be shared with others unless parents give permission for such information to be shared. School nurse or other health information records on children served under IDEA are also considered "educational records" and require signed consent before it can be shared. Therefore, under FERPA, schools must obtain signed consent to provide any screening, diagnostic, or treatment information they possess to EHDI or other health providers.

In general, FERPA says that:

• Signed consent is needed for school officials to share with EHDI or other providers personal information from a child’s educational records (e.g., transcripts, grades, services provided, etc.) as well as personally identifying information such as the child’s social security number or student identification number; race, ethnicity, and/or nationality; or gender.
• Signed consent is NOT needed to share a child’s general contact information (name, address), enrollment status, dates of attendance at school, honors and awards. This information can be shared with (a) other education programs (b) media, (c) financial aid parties, (d) appropriate officials in cases of health and safety emergencies, and (e) juvenile justice systems to comply with judicial orders.
• Schools or early intervention programs must inform parents at least annually of their intent to share such information and give parents the opportunity to object to such information being shared.
• Signed consent is NOT required when personal information is shared directly with the student or other school officials within the same institution where there is a legitimate educational interest. A legitimate educational interest may include enrollment or transfer matters, financial aid issues, or information requested by regional accrediting organizations.
• Signed consent is NOT needed when it is necessary to protect the health or safety of the student or other person, such as circumstances of abuse or neglect.

Table 3: IDEA Part C Privacy Regulations

Under Part C of the IDEA, the U.S. Department of Education provides funds to the lead agency in each State to establish a state-wide system of early intervention services for children ages birth to three years with disabilities (including developmental delays as defined by the individual state) and, at the State’s option, children under three who are at risk of developmental delays. The Part C privacy regulations incorporate the privacy protections of the IDEA Part B regulations and the protections and exceptions under FERPA.

Part C’s confidentiality provisions do not apply until a child is referred to Part C and thus, signed consent provisions do NOT apply to EHDI or any other entity that refers a child to the Part C program. Under Part C regulations, these individuals or entities are "primary referral sources" and generally not subject to Part C’s confidentiality requirements.

In general, under Part C, once a child is referred to the Part C early intervention service program, a "participating agency" (which includes the lead agency, early intervention service (EIS) providers, and any other individual agency or institution that "collects, maintains, or uses personally identifiable information" as part of the Part C service system) must obtain signed consent before disclosing personal information about the child or his or her family. Part C privacy regulations have the following stipulations related to sharing of personal information:

• Signed consent is needed for Part C participating agencies to share personal information with any individuals or entities that are not a part of the Part C system.
• When obtaining signed consent, the lead agency or early intervention service provider is required to ensure that the consent is "informed." In other words, the consent must: (1) describe the activity for which consent is sought (e.g. initial evaluation or disclosure of specific records from the child’s early intervention record) (2) specifically identify the information that will be released (e.g. evaluation to determine eligibility); and (3) identify to whom the record(s) shall be disclosed (e.g. the EHDI program).
• If the consent is being obtained to share the results of an evaluation before such an evaluation has been conducted, the consent must confirm that the parent has not yet received or reviewed the evaluation report.
• Signed consent is NOT needed for Part C to share individual child information with an individual or entity that is considered a "participating agency".
• Signed consent is NOT needed when disclosure of personally identifiable information is necessary to protect the health or safety of a child or other individual, such as circumstances of child abuse.