Confidentiality and the Confidentiality and the Use of Technology: Use of Technology:

Implications for Implications for Student Service Student Service

ProvidersProvidersDee Kempson MSW ACSWDee Kempson MSW ACSW

IDOE School Social Work IDOE School Social Work ConsultantConsultant

dkempson@doe.in.gov

OverviewOverview

Laws and rules governing confidentialityLaws and rules governing confidentiality Ethical codes governing confidentialityEthical codes governing confidentiality Security issues regarding student Security issues regarding student

informationinformation Best practices when using technology to Best practices when using technology to

store and communicate student store and communicate student information.information.

What to do if …?What to do if …?

The DilemmaThe Dilemma

Students are supported by school, family Students are supported by school, family and agency personnel – student service and agency personnel – student service providers communicate, collaborate and providers communicate, collaborate and serve as liaisons between these groups. serve as liaisons between these groups. Increasingly student information is being Increasingly student information is being stored and communicated electronically. stored and communicated electronically. How does the student service How does the student service professional work efficiently with student professional work efficiently with student data and yet meet the ethical and legal data and yet meet the ethical and legal requirements for confidentiality?requirements for confidentiality?

Legislation: FERPALegislation: FERPA Family Educational Rights and Privacy Act (FERPA)Family Educational Rights and Privacy Act (FERPA) * * parents have the right to access all materials relating parents have the right to access all materials relating

to the education of their child regardless of the to the education of their child regardless of the medium – this would include all electronic information medium – this would include all electronic information as it would be hard to demonstrate that the as it would be hard to demonstrate that the information included in electronic files met the information included in electronic files met the standard of “case notes” which would be the only standard of “case notes” which would be the only documented items protected by “privileged documented items protected by “privileged communication”.communication”.

FERPA 1974 FERPA 1974 “threatens the loss of federal funds to any “threatens the loss of federal funds to any educational entity that allows the dissemination of educational entity that allows the dissemination of information from a student’s educational records to information from a student’s educational records to most third parties without parental consent”.most third parties without parental consent”.

http://www.edu.gov/policy/gen/guid/fpco/ferpa/index.html

FERPA - revisionFERPA - revision2008 UDSOE published 2008 UDSOE published proposedproposed modifications modifications

toto

FERPA regulations including:FERPA regulations including: directory information, subject to disclosure directory information, subject to disclosure

without written permission, may not include without written permission, may not include the student’s SS # or other identification # the student’s SS # or other identification # but may include a user id or electronic but may include a user id or electronic identifier that acts as a “name”identifier that acts as a “name”

an institution that determines that there is an institution that determines that there is “an articulable and significant threat to the “an articulable and significant threat to the health or safety of a student or other health or safety of a student or other individuals, ..may disclose information to individuals, ..may disclose information to appropriate persons.”appropriate persons.”

Privileged Privileged CommunicationCommunication

IC 25-23.6-6-1IC 25-23.6-6-1 Matters related in official capacity; exceptions Matters related in official capacity; exceptions

to privilegeto privilege Sec. 1. Matters communicated to a counselor in the Sec. 1. Matters communicated to a counselor in the

counselor’s official capacity by a client counselor’s official capacity by a client are privileged are privileged information and may not be disclosed by the information and may not be disclosed by the counselor to any personcounselor to any person, except under the following , except under the following circumstances:circumstances:

In a criminal proceeding involving a homicide if the In a criminal proceeding involving a homicide if the disclosure relates disclosure relates

If the communication reveals the contemplation or If the communication reveals the contemplation or commission of a crime or a serious harmful act : commission of a crime or a serious harmful act :

The 3 exceptions: harm to self and/or othersThe 3 exceptions: harm to self and/or others See act for further exceptionsSee act for further exceptions

HIPPA Security Rule HIPPA Security Rule 20052005

http://www.hhs.gov/ocr/privacysummary.pdf

Every organization, including the local Every organization, including the local educational agency, is required to assign educational agency, is required to assign someone the duties of the security officer, someone the duties of the security officer, in order to assure compliance with the law. in order to assure compliance with the law. Every organization is required to set up Every organization is required to set up safeguards to protect records, and monitor safeguards to protect records, and monitor their use, as well as report any disuse.their use, as well as report any disuse.

A student health file managed by a school A student health file managed by a school nurse is part of the “educational record” nurse is part of the “educational record” and therefore governed by FERPA.and therefore governed by FERPA.

Children’s Online Privacy Children’s Online Privacy Protection Act (COPPA) Protection Act (COPPA)

20002000 “ “ prohibits the collection or use of prohibits the collection or use of

information from commercial websites information from commercial websites and online services directed at children and online services directed at children under the age of 13 without verifiable under the age of 13 without verifiable parental consent.” parental consent.”

http://www.coppa.org/coppa.htm The act also requires the sites to get The act also requires the sites to get

"verifiable parental consent" before "verifiable parental consent" before children can use online chat rooms or children can use online chat rooms or submit other information about submit other information about themselves on Web sites. themselves on Web sites.

Ethical CodesEthical Codes School Social Workers:School Social Workers: Most recent NASW Code of Ethics for the first Most recent NASW Code of Ethics for the first

time addressed directly the issues related to time addressed directly the issues related to technology: technology:

“ “ SWs should take precautions to ensure and SWs should take precautions to ensure and maintain confidentiality of information maintain confidentiality of information transmitted …through the use of computers, transmitted …through the use of computers, electronic mail, facsimile machines, telephones electronic mail, facsimile machines, telephones and telephone answering machines, and other and telephone answering machines, and other electronic or computer technology. Disclosure electronic or computer technology. Disclosure of identifying information should be avoided of identifying information should be avoided whenever possible.” (NASW 1.07 Privacy and whenever possible.” (NASW 1.07 Privacy and Confidentiality l & m)Confidentiality l & m)

Ethical Standards for Ethical Standards for School Counselors: ASCA School Counselors: ASCA

20042004 A.2. ConfidentialityA.2. Confidentiality

“ “Protects the confidentiality of students’ Protects the confidentiality of students’ records and releases personal data in records and releases personal data in accordance with prescribed laws and school accordance with prescribed laws and school policies. Student information stored and policies. Student information stored and transmitted transmitted electronically electronically is treated with is treated with the same care as traditional student records.the same care as traditional student records.

http://www.schoolcounselor.org/content.asp?contentid=173

ASCA Ethics continued..ASCA Ethics continued..

A.10. TechnologyA.10. Technology The professional school counselor:The professional school counselor: c. c. Takes appropriate and reasonable measures for Takes appropriate and reasonable measures for

maintaining confidentiality of student information maintaining confidentiality of student information and educational records stored or transmitted over and educational records stored or transmitted over electronic media including although not limited to electronic media including although not limited to fax, electronic mail and instant messaging.fax, electronic mail and instant messaging.

e. e. Who is engaged in the delivery of services Who is engaged in the delivery of services involving technologies such as the telephone, involving technologies such as the telephone, videoconferencing and the Internet takes videoconferencing and the Internet takes responsible steps to protect students and others responsible steps to protect students and others from harm.from harm.

Handling Confidential Handling Confidential Information in the Age of Information in the Age of

TechnologyTechnologyConcerns regarding computerized record keeping:Concerns regarding computerized record keeping: “ “ all of the information in all of the files is potentially all of the information in all of the files is potentially

available to anyone with a computer terminal – all available to anyone with a computer terminal – all without the consent of clients” Soler and Peters (1993)without the consent of clients” Soler and Peters (1993)

Chicago Public Schools Superintendant Anne Duncan Chicago Public Schools Superintendant Anne Duncan recently came under fire from the Chicago Teachers recently came under fire from the Chicago Teachers Union after 2 laptops, containing the names and social Union after 2 laptops, containing the names and social security numbers of about 40,000 teachers, were security numbers of about 40,000 teachers, were stolen.stolen.

About 120,000 computers were stolen from schools in About 120,000 computers were stolen from schools in the US in 2007. 75% of computers with a theft the US in 2007. 75% of computers with a theft recovery program are returned.recovery program are returned.

IPS superintendent writes a letter of apology regarding IPS superintendent writes a letter of apology regarding a breach of security that unintentionally exposed a breach of security that unintentionally exposed student, teacher, and employee information that was student, teacher, and employee information that was housed in the school districts intranet site.housed in the school districts intranet site.

Best Practices for Securing Best Practices for Securing Computerized InformationComputerized Information

If If progress notesprogress notes are to be maintained are to be maintained on-line,on-line,

knowing that security may be breached, knowing that security may be breached, and using professional judgment guided and using professional judgment guided by ethical practice, and in consultation by ethical practice, and in consultation with the security expert, decide:with the security expert, decide:

- what to leave in/out?- what to leave in/out? - how/where to record/store information - how/where to record/store information

in the system?in the system? - who to share it with?- who to share it with?

Best practices Best practices continued..continued..

Choose a password not listed in the dictionary/ a Choose a password not listed in the dictionary/ a nonsense word/numbers/charactersnonsense word/numbers/characters

Change passwords regularlyChange passwords regularly Do NOT:Do NOT: - share passwords- share passwords - leave a password close to a computer (sticky - leave a password close to a computer (sticky

notes on the screen!)notes on the screen!) - load personal software from home computers- load personal software from home computers - leave computers unattended- leave computers unattended - have the screen facing a traffic area- have the screen facing a traffic area - doors left open/unlocked- doors left open/unlocked

RecommendationsRecommendations Know the law, ethical standards and Know the law, ethical standards and

school policies that govern confidentialityschool policies that govern confidentiality Know your school’s security plans with Know your school’s security plans with

regard to technology and abide by themregard to technology and abide by them Protect your computer and access to it.Protect your computer and access to it. Portable thumb drives require the same Portable thumb drives require the same

protections as computers and paper files.protections as computers and paper files. Develop a way to identify clients other Develop a way to identify clients other

than by name (or other identifying than by name (or other identifying information) when information must be information) when information must be shared by e-mail.shared by e-mail.

Continued..Continued..

Discourage e-mail referrals from Discourage e-mail referrals from parents/teachers/administrators by e-mail.parents/teachers/administrators by e-mail.

Do not include any information in a client Do not include any information in a client computer file that would be identifiable in computer file that would be identifiable in the event that the computer file got into the event that the computer file got into the wrong hands. Computers (particularly the wrong hands. Computers (particularly laptops) are stolen every day from laptops) are stolen every day from schools! Code files so that only you can schools! Code files so that only you can identify the client. Only when information identify the client. Only when information enters the student record is the client enters the student record is the client identified.identified.

Continued..Continued..

Do not include any information in an electronic Do not include any information in an electronic student file that would be confidential to the student file that would be confidential to the student/client. An electronic student file meets student/client. An electronic student file meets the definition of “student record” and may be the definition of “student record” and may be accessed by parents (FERPA).accessed by parents (FERPA).

Include information about transmittal of Include information about transmittal of information to third parties on the “informed information to third parties on the “informed consent” form.consent” form.

Have available for staff and parents a Have available for staff and parents a document outlining the parameters of the document outlining the parameters of the sharing of personal student informationsharing of personal student information

ScenariosScenarios A counselor e-mails you from another school A counselor e-mails you from another school

wanting information about a student who has wanting information about a student who has come to the school’s attention….come to the school’s attention….

You know that a student you have been working You know that a student you have been working with would benefit from counseling services at with would benefit from counseling services at the school s/he will be attending next year..the school s/he will be attending next year..

You have been subpoenaed to court and have You have been subpoenaed to court and have been asked for confidential information…been asked for confidential information…

A teacher e-mails you requesting your A teacher e-mails you requesting your assistance with a student, detailing the assistance with a student, detailing the student’s family circumstances in the message..student’s family circumstances in the message..

A parent wants to know what their child has A parent wants to know what their child has revealed in the course of counseling and what revealed in the course of counseling and what you have documented.you have documented.

What to do in the event that What to do in the event that you have been subpoenaed you have been subpoenaed

to court.to court. Consult your school district attorney. That person Consult your school district attorney. That person

may choose to be the intermediary with the court.may choose to be the intermediary with the court. If attending bring all requested documents If attending bring all requested documents

including case notes and be willing to describe why including case notes and be willing to describe why such notes meet the criteria for personal case notes.such notes meet the criteria for personal case notes.

Bring a copy of the law that stipulates that the Bring a copy of the law that stipulates that the requested information is privileged under requested information is privileged under IC 25-IC 25-23.6-6-1 23.6-6-1

Have a copy of the relevant section of the ASCA Have a copy of the relevant section of the ASCA Code of Ethics.Code of Ethics.

Hand this to the judge when asked for privileged Hand this to the judge when asked for privileged information, whether written or spoken. information, whether written or spoken.

Keep a copy of any correspondence/legal Keep a copy of any correspondence/legal documents, related to the subpoena.documents, related to the subpoena.

What to do in the event that a What to do in the event that a parent demands information parent demands information

regarding the content of regarding the content of counseling sessionscounseling sessions

If possible prevent this from occurring by discussing If possible prevent this from occurring by discussing the boundaries of confidentiality ahead of time with the the boundaries of confidentiality ahead of time with the parent. parent.

Agree ahead of time with the parent and client what Agree ahead of time with the parent and client what would constitute information about “counseling would constitute information about “counseling progress”.progress”.

If it is the non-custodial parent requesting information If it is the non-custodial parent requesting information explain the legal and ethical limits to your ability to explain the legal and ethical limits to your ability to reveal this informationreveal this information

Listen to and validate the feelings leading to the Listen to and validate the feelings leading to the parent’s request for information – specific concerns parent’s request for information – specific concerns may be addressed without the necessity of revealing may be addressed without the necessity of revealing confidential information, or permission may be confidential information, or permission may be obtained from the studentobtained from the student

Continued…Continued… A student’s desire to confide in a counselor as A student’s desire to confide in a counselor as

opposed to a parent might be reframed by the opposed to a parent might be reframed by the counselor as a natural, positive, developmental counselor as a natural, positive, developmental step in managing their own problemsstep in managing their own problems

Sharing ethical codes, and the rationale Sharing ethical codes, and the rationale supporting them, provides an objective supporting them, provides an objective perspective.perspective.

Encourage parents to open a discussion with their Encourage parents to open a discussion with their child regarding their experience with school child regarding their experience with school counseling – allowing them to reveal what is counseling – allowing them to reveal what is comfortable to do so.comfortable to do so.

In the course of counseling the counselor might In the course of counseling the counselor might open a discussion, if appropriate, about sharing open a discussion, if appropriate, about sharing information with parents.information with parents.

Continued ..Continued ..

If all avenues have been explored and fail If all avenues have been explored and fail to resolve the issue – the options are to resolve the issue – the options are breach confidentiality or remain silent. breach confidentiality or remain silent. Always undertake an Ethical Decision Always undertake an Ethical Decision Making Process before choosing a course Making Process before choosing a course of action.of action.

See article: Professional School See article: Professional School Counseling: “When parents want to know: Counseling: “When parents want to know: responding to parental demands for responding to parental demands for confidential information”. December 2002.confidential information”. December 2002.

What to do when there is a What to do when there is a request for client information request for client information

from a colleaguefrom a colleague Ask for a copy of the release of informationAsk for a copy of the release of information If the issue is consultation regarding a specific If the issue is consultation regarding a specific

issue, colleagues may discuss a case issue, colleagues may discuss a case “hypothetically” without revealing personal “hypothetically” without revealing personal information.information.

If the context is a counselor’s need to transition a If the context is a counselor’s need to transition a student to a counselor at a receiving school choices student to a counselor at a receiving school choices may include - informing the parent/student of may include - informing the parent/student of the opportunities at the receiving school re. the opportunities at the receiving school re. counseling, counseling,

- providing the family/student with a referral letter - providing the family/student with a referral letter to a specific counselor, to a specific counselor,

- - ask a counselor at the receiving school to ask a counselor at the receiving school to introduce theintroduce the

student to opportunities at the receiving school for student to opportunities at the receiving school for counselingcounseling..