1	How HIPAA and FERPA Affect the Provision of EHDI Services Webcast Thursday, September 28, 2006 1:00-3:00pm Eastern
2	Moderator: Karl R. White, PhD, Professor of Psychology Director, National Center for Hearing Assessment and Management Utah State University
3	Part C Records: Confidentiality, Disclosure and Other Issues Kala Surprenant, U.S. Dept. of Education, Office of the General Counsel
4	Agenda Information Confidentiality/Disclosure Records Maintenance and Destruction After Child Exits Part C Handouts IDEA Confidentiality Regulations (34 CFR §§303.402, 303.460 and 300.560 through 300.576 (pre-8/14/06) Feb. 2004 OSEP Letter to Elder Feb. 2004 OSEP Letter to Anonymous (Maine)
5	Information Confidentiality/Disclosure
6	Is parent consent required before… …a child is referred to Part C by a primary referral source?
7	…before referral to Part C? Primary referral source (such as an EHDI program) may be a “covered entity” subject to HIPAA and thus cannot disclose PHI without written authorization. PHI is defined as “individually identifiable health information that is: “(i) transmitted by electronic media; (ii) maintained in electronic media; or (iii) transmitted or maintained in any form or medium.” And specifically excludes “individually identifiable health information in: (i) Education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv).” See, 45 C.F.R. §160.103.
8	…before referral to Part C? (cont.) IDEA child find requires disclosure of limited information and allows the Lead Agency to adopt parent opt-out procedure. See OSEP 2004 Letter to Anonymous in Maine
9	Consent or authorization needed prior to disclosure Part C: Participating agencies must obtain Written parental consent Before disclosing PII HIPAA: Covered entities must obtain – Written authorization Before disclosing PHI
10	Can the State DOH refer a child to Part C (from EHDI program)? Lead agency must have a “child find” system that can identify children potentially eligible under IDEA Section 635(a)(5). Primary referral source (such as DOH or EHDI program) must refer child to Part C under 34 CFR §303.321. Under HIPAA, if disclosure is mandated by law such as IDEA, written authorization may not be required.
11	Other Questions: Can lead agency disclose PII back to DOH or EHDI without consent under Part C? No. Can DOH or EHDI (if covered entity) disclose PHI to private physicians without authorization under HIPAA? No.
12	…after a child is referred to Part C? Under Part C, the protections of IDEA and FERPA apply: 34 CFR §§303.402 and 303.460; 34 CFR §300.560 through 300.576 pre-8/14/06); and 34 CFR Part 99. General Rule: Lead Agency must obtain parent consent before disclosure of personally identifiable information unless specific exception. Interagency agreements must meet IDEA consent requirements.
13	What can EHDI/DOH/Part C Programs do? Obtain both authorization under HIPAA and consent under Part C at first point of contact. Consent under Part C must identify records that will be disclosed and the parties and; Consider interagency agreement that clarifies scope of disclosure and purposes (to minimize documentation).
14	Is parent consent required before disclosure… …after a child is referred to Part C?
15	What would scope of consent under Part C look like? E.g., EHDI will disclose to DOH and Part C lead agency the results of hearing screening and Part C EIS referral form. E.g., Part C lead agency will disclose evaluation results and whether child determined eligible under Part C (if the parent provides consent to conduct the evaluation and the initial IFSP if child determined eligible).
16	Is parent consent required before disclosure… …when a child is ready to transition out of Part C?
17	Consent Important to inform parent that he or she has the right to decline to consent to: The initial evaluation under Part C; and The receipt of early intervention services under Part C at any time. 34 CFR §303.401 and 303.404
18	…when a child is ready to transition out of Part C? Proections of IDEA apply: 34 CFR §§303.402 and 303.460; 34 CFR §300.560 through 300.576 (pre-8/14/06); and 34 CFR Part 99. General Rule: Lead agency must obtain parent consent before disclosure unless specific exception.
19	…when a child is ready to transition out of Part C? cont. Interagency agreements must meet parent consent requirements. Lead agency must notify LEA where child resides for child potentially eligible under Part B unless parent opt-out procedure has been adopted by State and agency documents that parent has opted out (IDEA section 637(a)(9) and 34 CFR 303.148 and 2004 OSEP Letter to Elder)
20	Records Maintenance and Destruction After Child Exits Part C
21	Records Maintenance and Destruction After Child Exits Part C A Part C record may not be destroyed until it is no longer needed to provide early intervention services to the child. “Need” is at least three years beyond the last date of service.
22	Records Maintenance and Destruction After Child Exits Part C, cont. 3 year minimum: Certain records (including those related to pmt.) are deemed needed by the lead agency and its contractors for at least 3 yrs. under: GEPA at 20 U.S.C. §1232f and EDGAR at 34 CFR §80.42 Other child records must be kept for at least 3 years given that state complaints may be filed for 3 yrs. under 34 CFR §§303.510 - 303.512. Applicable State statutes of limitations may be longer.
23	Records Maintenance and Destruction After Child Exits Part C, cont. At that point, if the parents request destruction, the lead agency must destroy the early intervention record, but may still maintain a permanent record of limited information. Permanent record may be maintained of the child’s name, address and phone number, his or her date of birth, service provision, attendance record and (reason for) exit data.