A central Pennsylvania school district mishandled several homeschool students’ immunization and health records earlier this year. HSLDA intervened.
We have defended homeschooling families in the past when certain Pennsylvania districts demanded sensitive medical and immunization records. As HSLDA has intervened on behalf of member families who decline to provide this information, we can now point to a growing number of school districts that have backed down.
Since the COVID-19 pandemic and the subsequent focus of Pennsylvania authorities on immunization and medical records for homeschoolers, not a single HSLDA member family has been brought to a hearing by a school district over their refusal to provide sensitive medical and immunization records.
Standing firm
We take a strong stance on the issue of districts demanding medical records for two reasons. First, many Pennsylvania families object to providing this sensitive information to school districts. HSLDA fully respects and supports families who choose to send this information to school districts. However, we will also vigorously defend families who decline to comply with these demands.
Second, we feel strongly that any medical records and health information that families do provide must be vigorously protected. Unfortunately, that does not always happen.
Privacy breach
Here’s what happened with the family earlier this year. (At this time, we are not publishing the name of this school district to protect the privacy of the families involved.)
This district had requested immunization and medical records in the past and kept this information on file. When a homeschooling family’s child graduated high school, the district sent the student’s entire cumulative file to the graduate.
While reviewing the file at home, the family discovered that it contained the immunization and health records of two other homeschool students: one who had recently graduated from high school, and one who was still a homeschool student. The information breach was extensive. It included the names of the students, their full vaccine history, date of birth, home address, phone number, medical provider’s name, and the lot numbers of the vaccines they received.
Thankfully, the two other homeschool students were known to the family. The family who had inadvertently received this sensitive health information quickly notified the other students and returned the records to the school district.
This family’s swift and careful conduct protected the privacy of the other homeschool students, but the mix-up illustrated the problem: The more student records school districts have, the greater the risk that sensitive and private health records will be wrongly disclosed.
Meager federal protection
Federal privacy laws do not rigorously protect sensitive health records. Public schools are generally not covered entities under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA). And while the Family Education Rights and Privacy Act (FERPA) may apply to the personally identifiable information in medical records, there are numerous reasons to doubt that the act provides meaningful protections to home education records.
The text of FERPA makes no mention of “homeschooling” or “home educated” students. FERPA has numerous exceptions. FERPA has no private right of action. And FERPA is rarely enforced by the Department of Education’s Student Privacy Policy Office.
Indeed, one of the families affected by this breach filed a FERPA complaint with the US Department of Health and Human Services, and a HIPAA complaint with the US Department of Education. The family received a polite letter from HHS, which enforces HIPAA, notifying them that the case was closed because HHS has no authority over the school district. The DOE, which enforces FERPA, has not responded to the family.
Working towards solutions
HSLDA sent this letter to the school district, as well as to the Pennsylvania departments of health and education and the Pennsylvania attorney general. We hope the school district will change its policies and procedures to protect sensitive health information, and that the Pennsylvania government will enforce laws protecting the privacy of students.
Most importantly, we realize that this problem is due to the Pennsylvania departments of health and education pressuring the state’s 500 school districts to act as enforcers of immunization and health policy. HSLDA urges these departments to stop pressuring districts to collect immunization, health, and medical records.
Until that happens, we will vigorously continue to defend HSLDA member families who decline to provide sensitive health information to their local school district.
We are grateful to work with the Christian Homeschool Association of Pennsylvania on this matter and appreciate their partnership in defending homeschool freedom in the state all these years. As always, we encourage member families to speak with our legal team prior to any contact with a school district on this issue.