Confidentiality and the Use of Confidentiality and the Use of Technology: Implications for Technology: Implications for

Student Service ProvidersStudent Service ProvidersDee Kempson MSW ACSWDee Kempson MSW ACSW

IDOE School Social Work ConsultantIDOE School Social Work Consultant

dkempson@doe.in.govdkempson@doe.in.gov

OverviewOverview

Laws and rules governing confidentialityLaws and rules governing confidentiality Ethical codes governing confidentialityEthical codes governing confidentiality Security issues regarding student informationSecurity issues regarding student information Best practices when using technology to store Best practices when using technology to store

and communicate student information.and communicate student information. What to do if …?What to do if …?

The DilemmaThe Dilemma

Students are supported by school, family and Students are supported by school, family and agency personnel – student service providers agency personnel – student service providers communicate, collaborate and serve as liaisons communicate, collaborate and serve as liaisons between these groups. Increasingly student between these groups. Increasingly student information is being stored and communicated information is being stored and communicated electronically. How does the student service electronically. How does the student service professional work efficiently with student data professional work efficiently with student data and yet meet the ethical and legal requirements and yet meet the ethical and legal requirements for confidentiality?for confidentiality?

Legislation: FERPALegislation: FERPA Family Educational Rights and Privacy Act (FERPA)Family Educational Rights and Privacy Act (FERPA) * * parents have the right to access all materials relating to the parents have the right to access all materials relating to the

education of their child regardless of the medium – this would education of their child regardless of the medium – this would include all electronic information as it would be hard to include all electronic information as it would be hard to demonstrate that the information included in electronic files met demonstrate that the information included in electronic files met the standard of “case notes” which would be the only the standard of “case notes” which would be the only documented items protected by “privileged communication”.documented items protected by “privileged communication”.

FERPA 1974 FERPA 1974 “threatens the loss of federal funds to any “threatens the loss of federal funds to any educational entity that allows the dissemination of information educational entity that allows the dissemination of information from a student’s educational records to most third parties from a student’s educational records to most third parties without parental consent”.without parental consent”.

http://www.edu.gov/policy/gen/guid/fpco/ferpa/index.htmlhttp://www.edu.gov/policy/gen/guid/fpco/ferpa/index.html

FERPA - revisionFERPA - revision2008 UDSOE published 2008 UDSOE published proposedproposed modifications to modifications to

FERPA regulations including:FERPA regulations including: directory information, subject to disclosure directory information, subject to disclosure

without written permission, may not include the without written permission, may not include the student’s SS # or other identification # but may student’s SS # or other identification # but may include a user id or electronic identifier that acts as include a user id or electronic identifier that acts as a “name”a “name”

an institution that determines that there is “an an institution that determines that there is “an articulable and significant threat to the health or articulable and significant threat to the health or safety of a student or other individuals, ..may safety of a student or other individuals, ..may disclose information to appropriate persons.”disclose information to appropriate persons.”

Privileged CommunicationPrivileged Communication

IC 25-23.6-6-1IC 25-23.6-6-1 Matters related in official capacity; exceptions to privilegeMatters related in official capacity; exceptions to privilege Sec. 1. Matters communicated to a counselor in the counselor’s Sec. 1. Matters communicated to a counselor in the counselor’s

official capacity by a client official capacity by a client are privileged information and are privileged information and may not be disclosed by the counselor to any personmay not be disclosed by the counselor to any person, except , except under the following circumstances:under the following circumstances:

In a criminal proceeding involving a homicide if the disclosure In a criminal proceeding involving a homicide if the disclosure relates relates

If the communication reveals the contemplation or commission If the communication reveals the contemplation or commission of a crime or a serious harmful act : of a crime or a serious harmful act :

The 3 exceptions: harm to self and/or othersThe 3 exceptions: harm to self and/or others See act for further exceptionsSee act for further exceptions

HIPPA Security Rule 2005HIPPA Security Rule 2005

http://www.hhs.gov/ocr/privacysummary.pdfhttp://www.hhs.gov/ocr/privacysummary.pdf Every organization, including the local educational Every organization, including the local educational

agency, is required to assign someone the duties of the agency, is required to assign someone the duties of the security officer, in order to assure compliance with the security officer, in order to assure compliance with the law. Every organization is required to set up safeguards law. Every organization is required to set up safeguards to protect records, and monitor their use, as well as to protect records, and monitor their use, as well as report any disuse.report any disuse.

A student health file managed by a school nurse is part A student health file managed by a school nurse is part of the “educational record” and therefore governed by of the “educational record” and therefore governed by FERPA.FERPA.

Children’s Online Privacy Protection Children’s Online Privacy Protection Act (COPPA) 2000Act (COPPA) 2000

“ “ prohibits the collection or use of information prohibits the collection or use of information from commercial websites and online services from commercial websites and online services directed at children under the age of 13 without directed at children under the age of 13 without verifiable parental consent.” verifiable parental consent.”

http://www.coppa.org/coppa.htmhttp://www.coppa.org/coppa.htm The act also requires the sites to get "verifiable The act also requires the sites to get "verifiable

parental consent" before children can use online parental consent" before children can use online chat rooms or submit other information about chat rooms or submit other information about themselves on Web sites. themselves on Web sites.

Ethical CodesEthical Codes

School Social Workers:School Social Workers: Most recent NASW Code of Ethics for the first time Most recent NASW Code of Ethics for the first time

addressed directly the issues related to technology: addressed directly the issues related to technology: “ “ SWs should take precautions to ensure and maintain SWs should take precautions to ensure and maintain

confidentiality of information transmitted …through confidentiality of information transmitted …through the use of computers, electronic mail, facsimile the use of computers, electronic mail, facsimile machines, telephones and telephone answering machines, telephones and telephone answering machines, and other electronic or computer technology. machines, and other electronic or computer technology. Disclosure of identifying information should be Disclosure of identifying information should be avoided whenever possible.” (NASW 1.07 Privacy and avoided whenever possible.” (NASW 1.07 Privacy and Confidentiality l & m)Confidentiality l & m)

Ethical Standards for School Ethical Standards for School Counselors: ASCA 2004Counselors: ASCA 2004

A.2. ConfidentialityA.2. Confidentiality

“ “Protects the confidentiality of students’ records and Protects the confidentiality of students’ records and releases personal data in accordance with prescribed releases personal data in accordance with prescribed laws and school policies. Student information stored laws and school policies. Student information stored and transmitted and transmitted electronically electronically is treated with the is treated with the same care as traditional student records.same care as traditional student records.

http://www.schoolcounselor.org/content.asp?contentid=173http://www.schoolcounselor.org/content.asp?contentid=173

ASCA Ethics continued..ASCA Ethics continued..

A.10. TechnologyA.10. Technology The professional school counselor:The professional school counselor: c. c. Takes appropriate and reasonable measures for maintaining Takes appropriate and reasonable measures for maintaining

confidentiality of student information and educational records confidentiality of student information and educational records stored or transmitted over electronic media including although stored or transmitted over electronic media including although not limited to fax, electronic mail and instant messaging.not limited to fax, electronic mail and instant messaging.

e. e. Who is engaged in the delivery of services involving Who is engaged in the delivery of services involving technologies such as the telephone, videoconferencing and the technologies such as the telephone, videoconferencing and the Internet takes responsible steps to protect students and others Internet takes responsible steps to protect students and others from harm.from harm.

Handling Confidential Information Handling Confidential Information in the Age of Technologyin the Age of Technology

Concerns regarding computerized record keeping:Concerns regarding computerized record keeping: “ “ all of the information in all of the files is potentially available all of the information in all of the files is potentially available

to anyone with a computer terminal – all without the consent to anyone with a computer terminal – all without the consent of clients” Soler and Peters (1993)of clients” Soler and Peters (1993)

Chicago Public Schools Superintendant Anne Duncan recently Chicago Public Schools Superintendant Anne Duncan recently came under fire from the Chicago Teachers Union after 2 came under fire from the Chicago Teachers Union after 2 laptops, containing the names and social security numbers of laptops, containing the names and social security numbers of about 40,000 teachers, were stolen.about 40,000 teachers, were stolen.

About 120,000 computers were stolen from schools in the US About 120,000 computers were stolen from schools in the US in 2007. 75% of computers with a theft recovery program are in 2007. 75% of computers with a theft recovery program are returned.returned.

IPS superintendent writes a letter of apology regarding a IPS superintendent writes a letter of apology regarding a breach of security that unintentionally exposed student, breach of security that unintentionally exposed student, teacher, and employee information that was housed in the teacher, and employee information that was housed in the school districts intranet site.school districts intranet site.

Best Practices for Securing Best Practices for Securing Computerized InformationComputerized Information

If If progress notesprogress notes are to be maintained on-line, are to be maintained on-line, knowing that security may be breached, and knowing that security may be breached, and

using professional judgment guided by ethical using professional judgment guided by ethical practice, and in consultation with the security practice, and in consultation with the security expert, decide:expert, decide:

- what to leave in/out?- what to leave in/out? - how/where to record/store information in the - how/where to record/store information in the

system?system? - who to share it with?- who to share it with?

Best practices continued..Best practices continued..

Choose a password not listed in the dictionary/ a nonsense Choose a password not listed in the dictionary/ a nonsense word/numbers/charactersword/numbers/characters

Change passwords regularlyChange passwords regularly Do NOT:Do NOT: - share passwords- share passwords - leave a password close to a computer (sticky notes on the - leave a password close to a computer (sticky notes on the

screen!)screen!) - load personal software from home computers- load personal software from home computers - leave computers unattended- leave computers unattended - have the screen facing a traffic area- have the screen facing a traffic area - doors left open/unlocked- doors left open/unlocked

RecommendationsRecommendations

Know the law, ethical standards and school policies Know the law, ethical standards and school policies that govern confidentialitythat govern confidentiality

Know your school’s security plans with regard to Know your school’s security plans with regard to technology and abide by themtechnology and abide by them

Protect your computer and access to it.Protect your computer and access to it. Portable thumb drives require the same protections as Portable thumb drives require the same protections as

computers and paper files.computers and paper files. Develop a way to identify clients other than by name Develop a way to identify clients other than by name

(or other identifying information) when information (or other identifying information) when information must be shared by e-mail.must be shared by e-mail.

Continued..Continued..

Discourage e-mail referrals from Discourage e-mail referrals from parents/teachers/administrators by e-mail.parents/teachers/administrators by e-mail.

Do not include any information in a client computer Do not include any information in a client computer file that would be identifiable in the event that the file that would be identifiable in the event that the computer file got into the wrong hands. Computers computer file got into the wrong hands. Computers (particularly laptops) are stolen every day from (particularly laptops) are stolen every day from schools! Code files so that only you can identify the schools! Code files so that only you can identify the client. Only when information enters the student client. Only when information enters the student record is the client identified.record is the client identified.

Continued..Continued..

Do not include any information in an electronic student Do not include any information in an electronic student file that would be confidential to the student/client. An file that would be confidential to the student/client. An electronic student file meets the definition of “student electronic student file meets the definition of “student record” and may be accessed by parents (FERPA).record” and may be accessed by parents (FERPA).

Include information about transmittal of information to Include information about transmittal of information to third parties on the “informed consent” form.third parties on the “informed consent” form.

Have available for staff and parents a document Have available for staff and parents a document outlining the parameters of the sharing of personal outlining the parameters of the sharing of personal student informationstudent information

ScenariosScenarios A counselor e-mails you from another school wanting A counselor e-mails you from another school wanting

information about a student who has come to the school’s information about a student who has come to the school’s attention….attention….

You know that a student you have been working with would You know that a student you have been working with would benefit from counseling services at the school s/he will be benefit from counseling services at the school s/he will be attending next year..attending next year..

You have been subpoenaed to court and have been asked for You have been subpoenaed to court and have been asked for confidential information…confidential information…

A teacher e-mails you requesting your assistance with a A teacher e-mails you requesting your assistance with a student, detailing the student’s family circumstances in the student, detailing the student’s family circumstances in the message..message..

A parent wants to know what their child has revealed in the A parent wants to know what their child has revealed in the course of counseling and what you have documented.course of counseling and what you have documented.

What to do in the event that you have What to do in the event that you have been subpoenaed to court.been subpoenaed to court.

Consult your school district attorney. That person may choose Consult your school district attorney. That person may choose to be the intermediary with the court.to be the intermediary with the court.

If attending bring all requested documents including case If attending bring all requested documents including case notes and be willing to describe why such notes meet the notes and be willing to describe why such notes meet the criteria for personal case notes.criteria for personal case notes.

Bring a copy of the law that stipulates that the requested Bring a copy of the law that stipulates that the requested information is privileged under information is privileged under IC 25-23.6-6-1 IC 25-23.6-6-1

Have a copy of the relevant section of the ASCA Code of Have a copy of the relevant section of the ASCA Code of Ethics.Ethics.

Hand this to the judge when asked for privileged information, Hand this to the judge when asked for privileged information, whether written or spoken. whether written or spoken.

Keep a copy of any correspondence/legal documents, related Keep a copy of any correspondence/legal documents, related to the subpoena.to the subpoena.

What to do in the event that a parent What to do in the event that a parent demands information regarding the demands information regarding the

content of counseling sessionscontent of counseling sessions

If possible prevent this from occurring by discussing the If possible prevent this from occurring by discussing the boundaries of confidentiality ahead of time with the parent. boundaries of confidentiality ahead of time with the parent.

Agree ahead of time with the parent and client what would Agree ahead of time with the parent and client what would constitute information about “counseling progress”.constitute information about “counseling progress”.

If it is the non-custodial parent requesting information explain If it is the non-custodial parent requesting information explain the legal and ethical limits to your ability to reveal this the legal and ethical limits to your ability to reveal this informationinformation

Listen to and validate the feelings leading to the parent’s Listen to and validate the feelings leading to the parent’s request for information – specific concerns may be addressed request for information – specific concerns may be addressed without the necessity of revealing confidential information, or without the necessity of revealing confidential information, or permission may be obtained from the studentpermission may be obtained from the student

Continued…Continued…

A student’s desire to confide in a counselor as opposed to a A student’s desire to confide in a counselor as opposed to a parent might be reframed by the counselor as a natural, parent might be reframed by the counselor as a natural, positive, developmental step in managing their own problemspositive, developmental step in managing their own problems

Sharing ethical codes, and the rationale supporting them, Sharing ethical codes, and the rationale supporting them, provides an objective perspective.provides an objective perspective.

Encourage parents to open a discussion with their child Encourage parents to open a discussion with their child regarding their experience with school counseling – allowing regarding their experience with school counseling – allowing them to reveal what is comfortable to do so.them to reveal what is comfortable to do so.

In the course of counseling the counselor might open a In the course of counseling the counselor might open a discussion, if appropriate, about sharing information with discussion, if appropriate, about sharing information with parents.parents.

Continued ..Continued ..

If all avenues have been explored and fail to resolve If all avenues have been explored and fail to resolve the issue – the options are breach confidentiality or the issue – the options are breach confidentiality or remain silent. Always undertake an Ethical Decision remain silent. Always undertake an Ethical Decision Making Process before choosing a course of action.Making Process before choosing a course of action.

See article: Professional School Counseling: “When See article: Professional School Counseling: “When parents want to know: responding to parental parents want to know: responding to parental demands for confidential information”. December demands for confidential information”. December 2002.2002.

What to do when there is a request for What to do when there is a request for client information from a colleagueclient information from a colleague

Ask for a copy of the release of informationAsk for a copy of the release of information If the issue is consultation regarding a specific issue, If the issue is consultation regarding a specific issue,

colleagues may discuss a case “hypothetically” without colleagues may discuss a case “hypothetically” without revealing personal information.revealing personal information.

If the context is a counselor’s need to transition a student If the context is a counselor’s need to transition a student to a counselor at a receiving school choices may include to a counselor at a receiving school choices may include - informing the parent/student of the opportunities at the - informing the parent/student of the opportunities at the receiving school re. counseling, receiving school re. counseling,

- providing the family/student with a referral letter to a - providing the family/student with a referral letter to a specific counselor, specific counselor,

- - ask a counselor at the receiving school to introduce theask a counselor at the receiving school to introduce the student to opportunities at the receiving school for student to opportunities at the receiving school for

counselingcounseling..