Did I just sign a permission slip that lets an in-school dental clinic extract my child’s teeth? Navigating student and school health privacy
A Baltimore mom was surprised and unhappy recently when her son came home from school missing three teeth. The source? A mobile dental clinic at a Baltimore city public school had extracted some of her son’s teeth that day. The mother didn’t realize it, but she had already consented to the dental work through signing a permission slip/release form. For parents who may not be familiar with these types of programs and how they operate, this kind of situation can be a difficult wake-up call, both for health, and potentially for privacy.
Typically, mobile or visiting dental clinics will work with the schools, with the schools sending out a permission slip or release form that contains a detailed consent form the parent must sign for any dentistry to take place. These forms can often go out to parents at the beginning of the school year as part of a large “back to school” package. These packages can contain many permission and other forms for parents to sign, and it is not unthinkable that parents might fill out and sign these dental consent release forms without fully understanding all of the consequences.
What might one of these release forms look like?
In the case of Baltimore city public schools, it appears that this release form, seen partially in the screenshot below, is the one being used currently, as it is linked from the school’s current forms and publications page. The release form contains questions asking for quite a bit of sensitive information, including the child’s SSN or Medicaid number, the parent’s SSN and date of birth, the child’s health conditions, and much more. During the journey from parent to the dental clinic, a signed and filled-in paper form could potentially be seen and accessed by multiple people, or could even get lost along the way. Release forms may vary, but surely this permissioning process, from start to finish, could be improved for this type of form.
A sound policy would be to have the dental release form be given to parents as a separate permission, apart from any other permission slips for items such as yearbook photos or field trips. The permission would ideally have an explanatory letter focused only on this topic, explaining all possible dental procedures that could be done. Also ideally present would be prominent information about how parents could withdraw their consent later on, and describe the procedure for doing that. And schools would ideally have written procedures and checks in place for how they are handling sensitive health data in returned release forms.
All returned forms should be returned securely, in a manner that protects the child’s sensitive health information and medical history, as well as the parent’s SSN and other information. There’s a lot of sensitive information in these forms, and each point along this process needs careful, robust attention to detail to ensure first that parents are well-informed and that the information is protected. If even one parent has a surprise like the Baltimore mom did, it is fair to say that the process broke down somewhere and needs improvement in one or more places.
What health privacy law applies to students?
The need for improvement doesn’t just stop with the release forms and how they are handled— the underlying problems of how student health information is handled in a school context overall needs serious attention and reform. The interaction between the two key laws that control health privacy in schools — HIPAA and FERPA — is incredibly complex. So much so that it can be difficult to tell what law applies, when, and where.
The federal health privacy law, HIPAA, does not always apply to any and all health information in schools. Sometimes HIPAA applies, and sometimes it doesn’t. The same applies to FERPA, which stands for the Family Educational Rights and Privacy Act. (FERPA is the other major law that impacts student health privacy.) FERPA can in some circumstances cover student health information held by schools, but not always. Sometimes neither HIPAA nor FERPA apply, sometimes both apply.
If you are confused, don’t feel alone — this topic of what law applies to student health information has been the subject of lengthy, convoluted documents. We have worked to simplify this topic at least a little bit for parents in a brief overview of health privacy in schools as part of our Student Privacy 101 series. You can find our Health Privacy in Schools – What law applies? document here. If you want to dig deeper into this issue, here is detailed information about the topic.
What if I have already signed a release form?
If you are a parent who has signed a dental or other in-school health release form and you want to reverse your decision, the release form should contain information on how you can withdraw your consent. As a parent, your key action steps are to request a copy of the permission slip or release form from the school or dental clinic, then ask what steps you need to take to withdraw your consent. Ideally, a copy of the form will be readily available to you online.
To be certain what law applies, HIPAA or FERPA, it is important that you ask the school and the dental clinic directly. The two laws have different rights. See our discussion of these rights here. Going forward, it’s a good idea to take a picture of any school form you sign and save it for the duration of the school year.