Medical documentation system not HIPPA compliant

[RNTadaaaa]

I just found out that the online system my school uses for entering attendance/medical/immunizations/etc is not HIPPA compliant due to the fact that they are not a covered entity and because the PHI stored on their server is considered Education Records.

I have been writing student notes in the medical portion of this system. When I called customer support to find out who has access to medical info they said the Principal, VP and registrar.

At my previous location all of our online documentation was HIPPA compliant and if access to notes were needed, they needed a subpoena.

Not sure how to feel about whether to continue documenting on the online system or to begin documenting on paper forms instead and filing in student medical chart?

What format do you use to chart?

As an aside, who do you go to, to ask legal questions that come up over your nursing carreer?

[scuba nurse, BSN, MSN, RN]

Are you in a district with other nurses? what do they use? Do you have a supervisor? What is your policy for documentation? Does the principal /VP/registrar even KNOW that they can read this info? And do they read it?

[AdobeRN]

I don't see a problem with the Principal or VP having access - they are in charge of the school, they should know the details that go on with each kid including those details from the clinic. Registrar - maybe shouldn't have access to your notes but in my opinion should be able to pull up your logs to see who you sent home ill so the attendance records can match - this comes into play if there are truancy issues with students.

I doubt the principal or VP even look at the records - I know mine don't, if they have questions they usually come straight to me. My Registrar doesn't look either - easier to pick up the phone and call me regarding clarification of a student going home ill - and with that I don't give details - just the general reason - vomit, fever, injury etc so she can make a note of it on her end incase truancy issues come up.

Even if your admin doesn't consider the clinic documentation HIPAA compliant it still needs to be FERPA complaint - the health records are part of the education records - there are privacy laws regarding education records.

I wouldn't worry to much about it nor would I document another way - if your district set up online documentation I would stick with that.

[OldDude]

Don't worry about it. This is what is provided by your facility and it's not your responsibility to police the system security or who is accessing the information. You are entering the data in good faith as a private medical/school record...good enough to cover your HIPPA/FERPA responsibility.

[RNTadaaaa]

2 hours ago, scuba nurse said:

Are you in a district with other nurses? what do they use? Do you have a supervisor? What is your policy for documentation? Does the principal /VP/registrar even KNOW that they can read this info? And do they read it?

I'm in an independent private school. (Sorry. I should've said that up front). No supervisor. My past experience and what I can glean from my state's nurse practice act dictates my policy for documentation, so I normally document everything.

Previous nurse entered no documentation into this system and I never got to ask why.

They do know and I don't have a problem with them having that access, I just needed to call and find out who did have access. All staff (the horror) vs just Principal, VP and Registrar.

[RNTadaaaa]

Thanks! I appreciate that.

I too think its ok for VP and Principal to have access. I didnt have alot of experience in a private school setting and so hearing that the system wasnt HIPPA compliant gave me some pause. Last school I worked in was public and our system was totally separate from the schools and FERPA rules applied differently.....somehow.

[RNTadaaaa]

Thank you Old Dude.

I think I'll do just that. I try not to be too much of a worry wart but sometimes it leaps out before I can grab it!

[aprilmoss]

FERPA only applies to schools that receive public funding (public and charter schools). Completely private ones are not subject to the law.

HIPAA only applies to entities that use electronic processing of insurance claims. Most schools are not subject to HIPAA.

I would however be concerned about unfettered access to medical records. If a Principal or Registrar can get at it, then probably just about any staff probably can.

[beachynurse, ASN, BSN]

On 3/4/2019 at 9:08 AM, RNTadaaaa said:

I just found out that the online system my school uses for entering attendance/medical/immunizations/etc is not HIPPA compliant due to the fact that they are not a covered entity and because the PHI stored on their server is considered Education Records.

I have been writing student notes in the medical portion of this system. When I called customer support to find out who has access to medical info they said the Principal, VP and registrar.

At my previous location all of our online documentation was HIPPA compliant and if access to notes were needed, they needed a subpoena.

Not sure how to feel about whether to continue documenting on the online system or to begin documenting on paper forms instead and filing in student medical chart?

What format do you use to chart?

As an aside, who do you go to, to ask legal questions that come up over your nursing carreer? 

The issue is that schools do not have to be HIPPA compliant, we have to be FERPA compliant. This is why we run into issues with MD offices, we have differeing sets of privacy rules. It is not an issue for the administrators to see our notes, in fact it falls under FERPA coverage, so you are fine and don't need to worry about your license. You might want to do some research int o FERPA. It will put your mind at ease.

[aprilmoss]

The poster was in an "independent private school" per their admission. They're likely not subject to FERPA either.