Dancing with HIPAA and FERPA

Starting a new job means learning new protocol. Whether a home based business teaching piano lessons, or managing an apartment building and going to school full-time for a masters degree, each time I started something, there was a learning curve. In fact, after the birth of each of my children, I had to learn how to live all over again!

So what does all of this have to do with HIPAA and FERPA? There was a time in my life when I knew nothing about them, and frankly, it didn't matter. Then something happened, and all that changed. We drove eight hours to the nearest medical facility with oncology services as our three year old daughter became increasingly more feverish and yellow. The minute we walked through the door of the hospital, she was scooped out of our arms and connected to life-saving blood transfusions. We were told that she nearly didn't make it, and that we were very fortunate people.

She was diagnosed with acute lymphocytic leukemia. We first met HIPAA as we sat across the desk from the doctor to receive the news. There was no time for lengthy explanations and introductions. We were just handed the book with the other hospital information, and eagerly shepherded to a place we could stay during her months of initial treatment.

Thanks to the miracles of faith and modern medicine, she has lived a normal life. During her two years of chemotherapy, however, I had the opportunity to study health, nutrition, and anything I could find that would help me understand what was happening to my daughter. HIPAA was always there in the background, but we didn't become better acquainted until later when my own health issues came to the forefront. This time, I was not just handed the booklet, I was asked to sign that I had received and read it before I even opened the front page!

Hours spent in the waiting room of doctor after doctor finally made me realize that there was something I needed to know. Each clinic had it own privacy policies and booklets. They began to sound like a broken record I wanted to get rid of! Yet time after time, I was asked to sign that I had read and understood the law. I tried several times to read the complex jargon, only to sit back in my chair, sigh, and grab a magazine to browse instead.

The resultant surgery and recuperation enabled me to give birth to our fifth daughter. She was a very unusual child and during her kindergarten year, we requested assessments to determine a course of action. As we became involved with the special education process, we met FERPA, and IDEA, HIPAA's cousins. This time, however, we didn't just receive a booklet telling us about the rights we had to privacy of our family and educational information, but that we had the right of due process should we feel that our daughter's needs were not being met by the school.

Our daughter's information would be kept confidential and they could not share it with anyone unless they had our written concent. Indeed, the school kept their word. When our daughter's medical professionals wanted information collected by the school, HIPAA required that we sign forms for the medical people, and FERPA required forms signed for education professionals! Finally, they were able to communicate with each other!

The introduction to the special education process lead me to eventually complete my master's degree and become a school psychologist. HIPAA and FERPA moved in with me full time as roomates when the laws became a part of my knowledge base. Special education protocol required accountability on the local, state, and federal levels. They became my partners in the fight to help children obtain needed services to which they were entitled.

Working as a school psychologist, I created files of information on the development of each individual I was to assess for special education purposes. Prior to completing these assessments, I studied the files of each student, looking for family history, trauma, illness, and any information that would give clues as to how their disability developed and what affected it. According to FERPA, these files were kept under lock and key and were only to be used for the purpose established. Frequently, I used HIPAA to gain medical information that assisted in determining a course of action.

Later employed as a special education director, mine was the responsibility to see that information in the files was in compliance with HIPAA, FERPA, and other distant relatives. The compliance monitor, I checked the classrooms to see that the files were in locked cabinets, that the teachers were using the information appropriately, and that the requirements of the programming was being followed. I trained the people who worked with the files on what to include and how to keep up to date with actions taken in behalf of the students.

Twice yearly, I pulled each file and reviewed it according to specific criteria to see that all was in compliance. There never seemed to be enough time to record everything that was necessary, but it had to be done. Thankfully, before the end of my tenure, the state and federal compliance was being done on the computer. All signature pages were scanned in and stored in password protected, web-based files. Yearly training was conducted on computer security by my federally based employer, and only those who passed the training were allowed computer access.

Now here I am. I have left the medical and education world behind and am working as an office manager, once again learning the protocol of a new position. But wait...there are files...there are families...there is medical information...there is educational information...there are people who expect me to keep their information private...there are companies that require signatures on documents that contain information I wouldn't want to have shared about me if I were that person.

Although the circumstances are different, the laws are the same. Confidentiality and privacy are simply common sense. It means keeping private information private, whether it be names, addresses, phone numbers, financial data, government documentation, legal documents, applications for services, and family assets evaluations. The files are still considered to be for the eyes of the professionals working with the clients.

Thank you HIPAA! Thank you FERPA! Thank you for teaching me what I needed to know throughout the years! Thank you for protecting my identity through all of the crises in my life! Thank you for protecting the information shared about my children and grandchildren! Thank you for keeping the information I have collected about others from falling into the hands of those who would exploit it for personal gain. Thank you for being you!