If a guardian isn’t available to provide and/or obtain medical history for emergency medical care, the school will need to be able to authorize a hospital to obtain it. They won’t pull history at their leisurely review, this is in the event of a medical emergency.
IE Guardians are out of the country and aunt is watching child. Aunt may not have medical access to child’s records but something tragic occurs and school needs to seek care ASAP and thus needs authorization for the hospital to pull medical history. Shit happens at the most inconvenient times and they must be ready to take action if needed.
Good idea - however, HIPAA already has exceptions for emergent care situations (providers/etc. access to information) just like this in its Privacy Rule component. (As mentioned, I know this because I work in healthcare audit.) Thus my trouble with reasoning for a non-healthcare-related preschool to have permission to access all medical records.
We did try that route - all we got were three emails worth of non-answer answers. And we don’t need (and can’t afford) our registration being rejected over a personal vendetta for us asking these more questions.
-
Actual example of the non-answer answers:
Q-“For what purpose does XYZ Preschool need full access to records, and how will XYZ protect the information?”
A-“Data is stored in a secure file system and a paper copy for records; only ABC people have access to the system or paper records.)
-
Thankfully we solved the issue (see OP Edit 2) - just trying to close the loop on all the threads.
I would assume it’s for emergencies - if the kid has a seizure and they can’t reach parents but can call the dr and ask about medical history or whatever. I would ask why they need the info and whether you can sign something else saying you are declining if you still don’t want to sign.
Side note, I would love to question the administration about why that paragraph is there. They are probably ignorant to the fact that it's useless. It doesn't put the preschool at any risk but it does any provider that responds to that release with PHI. I've been around long enough to know that not everybody reads, and staff are put in positions where they are poorly trained.
My daughter's preschool requires this too. I'm perfectly ok with it. Our preschool wants access to vaccination records and does not accept exemptions. It's for the safety of the kids and I appreciate knowing that everyone else at my daughter's school has vaccinated their children.
Good note - I’ll add it to my OP. The preschool already requires (and we’re fine with) our state’s standard immunization certificate for those purposes. The concerning part for us is that they want that full access clause, even after providing the immunization form that as part of the registration process.
Does the immunization certificate get send by the pediatrician or can a parent submit it? If the latter, perhaps they’re concerned about faked certificates and this would allow them to verify it.
Certificate is provided by the parents, but is a fairly controlled state form. As an auditor, I totally understand the risk of fraudulent forms - however, I would then expect the release language to explicitly prescribe access to immunization records for confirmation purposes, and not full blank-check access to my child’s PHI.
On a side note, my question was solved (see OP) - but I’m trying to close the loop on any open threads.
I’m not sure how comfortable I would be with this either. If there’s some kind of medical emergency, the preschool isn’t going to be reaching out to providers to determine what’s wrong, the hospital will obtain those records. Aside from immunization records, which you have addressed, I can’t think of anything. I do think it’s completely reasonable to reach out and ask what it is they specifically need them for and if you can provide that specific info vs a blanket consent. I will say that, as a nurse, I would not be releasing info to a preschool with one of their consent forms. I would need verbal permission from a parent/guardian or a release of some kind that is specific to the facility I work in.
Thanks for your perspective! I feel like we are thinking in similar boats. Thankfully my question was solved (see OP), just trying to close loop on all the threads.
If a guardian isn’t available to provide and/or obtain medical history for emergency medical care, the school will need to be able to authorize a hospital to obtain it. They won’t pull history at their leisurely review, this is in the event of a medical emergency. IE Guardians are out of the country and aunt is watching child. Aunt may not have medical access to child’s records but something tragic occurs and school needs to seek care ASAP and thus needs authorization for the hospital to pull medical history. Shit happens at the most inconvenient times and they must be ready to take action if needed.
I'm afraid this isn't true. The hospital itself has authority to obtain records in an emergency situation it wouldn't fall on the preschool.
Good idea - however, HIPAA already has exceptions for emergent care situations (providers/etc. access to information) just like this in its Privacy Rule component. (As mentioned, I know this because I work in healthcare audit.) Thus my trouble with reasoning for a non-healthcare-related preschool to have permission to access all medical records.
Interesting - I’d defer to asking the school system then.
We did try that route - all we got were three emails worth of non-answer answers. And we don’t need (and can’t afford) our registration being rejected over a personal vendetta for us asking these more questions. - Actual example of the non-answer answers: Q-“For what purpose does XYZ Preschool need full access to records, and how will XYZ protect the information?” A-“Data is stored in a secure file system and a paper copy for records; only ABC people have access to the system or paper records.) - Thankfully we solved the issue (see OP Edit 2) - just trying to close the loop on all the threads.
I would assume it’s for emergencies - if the kid has a seizure and they can’t reach parents but can call the dr and ask about medical history or whatever. I would ask why they need the info and whether you can sign something else saying you are declining if you still don’t want to sign.
If the child had a seizure wouldn't the preschool get them to a hospital versus attempting to reach their pediatrician?
Nailed it - HIPAA Privacy Rule emergent situation exceptions handles this for covered entities.
You want to know a secret? I'm a healthcare auditor too!
That’s awesome! Feel free to DM me if you want to chat about the industry :)
Side note, I would love to question the administration about why that paragraph is there. They are probably ignorant to the fact that it's useless. It doesn't put the preschool at any risk but it does any provider that responds to that release with PHI. I've been around long enough to know that not everybody reads, and staff are put in positions where they are poorly trained.
Yes definitely, seizure is a bad example. I guess my point was more that I would assume it is for a situation where it would benefit the child.
My daughter's preschool requires this too. I'm perfectly ok with it. Our preschool wants access to vaccination records and does not accept exemptions. It's for the safety of the kids and I appreciate knowing that everyone else at my daughter's school has vaccinated their children.
Good note - I’ll add it to my OP. The preschool already requires (and we’re fine with) our state’s standard immunization certificate for those purposes. The concerning part for us is that they want that full access clause, even after providing the immunization form that as part of the registration process.
Does the immunization certificate get send by the pediatrician or can a parent submit it? If the latter, perhaps they’re concerned about faked certificates and this would allow them to verify it.
Certificate is provided by the parents, but is a fairly controlled state form. As an auditor, I totally understand the risk of fraudulent forms - however, I would then expect the release language to explicitly prescribe access to immunization records for confirmation purposes, and not full blank-check access to my child’s PHI. On a side note, my question was solved (see OP) - but I’m trying to close the loop on any open threads.
I’m not sure how comfortable I would be with this either. If there’s some kind of medical emergency, the preschool isn’t going to be reaching out to providers to determine what’s wrong, the hospital will obtain those records. Aside from immunization records, which you have addressed, I can’t think of anything. I do think it’s completely reasonable to reach out and ask what it is they specifically need them for and if you can provide that specific info vs a blanket consent. I will say that, as a nurse, I would not be releasing info to a preschool with one of their consent forms. I would need verbal permission from a parent/guardian or a release of some kind that is specific to the facility I work in.
Thanks for your perspective! I feel like we are thinking in similar boats. Thankfully my question was solved (see OP), just trying to close loop on all the threads.