15.1 Confidentiality Protocols (FERPA, HIPAA, 42 CFR Part 2)

15.1 Confidentiality Protocols (FERPA, HIPAA, 42 CFR Part 2)

Core Principle: In prevention science, participant trust is the indispensable foundation of all effective intervention. Unlike clinical treatment where patients explicitly seek healthcare, prevention programs engage individuals, families, youth, and entire communities in natural community settings—schools, youth centers, faith organizations, and civic spaces. Confidentiality is both an ethical cornerstone (Principle 5 of the Prevention Think Tank Code of Ethical Conduct) and a complex statutory mandate. Prevention specialists must master the jurisdictional boundaries between education law (FERPA), healthcare law (HIPAA), specialized federal addiction rules (42 CFR Part 2), and student survey protections (PPRA) to safeguard participant privacy while maintaining lawful program operations.

---

The Legal and Ethical Landscape of Prevention Confidentiality

Confidentiality in substance misuse prevention is not a single, uniform rule; it is a matrix of overlapping federal statutes, state privacy codes, and professional ethical standards. Navigating this matrix requires understanding the distinct legal definition of confidentiality versus privacy:

• Privacy: A fundamental constitutional and common-law right of individuals to be free from unwarranted governmental or organizational intrusion into their personal lives, beliefs, behaviors, and bodies.
• Confidentiality: An explicit professional, ethical, and legal duty established between a service provider and a participant. It dictates that information disclosed within the professional relationship will not be revealed, shared, or disseminated to third parties without lawful authorization or a compelling statutory mandate.

Under Principle 5 (Confidentiality) of the Prevention Think Tank code, prevention specialists are required to safeguard all confidential participant data, ensure informed consent, inform participants of statutory exceptions prior to disclosure, and store all physical and electronic records securely.

+-----------------------------------------------------------------------------------+
|              FEDERAL PRIVACY STATUTES APPLICABLE TO PREVENTION SETTINGS           |
+---------------------+-------------------------------+-----------------------------+
| Framework           | Primary Jurisdiction          | Core Protected Asset        |
+---------------------+-------------------------------+-----------------------------+
| FERPA               | Public & private K-12 schools | Student Education Records   |
| (34 CFR Part 99)    | and postsecondary institutions| and Personally Identifiable |
|                     | receiving federal ED funding  | Information (PII)           |
+---------------------+-------------------------------+-----------------------------+
| HIPAA               | Healthcare providers, health  | Protected Health Information|
| (45 CFR Parts 160,  | plans, healthcare clearing-   | (PHI) transmitted or stored |
| 164)                | houses transmitting EDI data  | in electronic/paper form    |
+---------------------+-------------------------------+-----------------------------+
| 42 CFR Part 2       | Federally assisted specialized| SUD patient identity,       |
|                     | substance use disorder (SUD)  | diagnosis, prognosis,       |
|                     | treatment/referral facilities | treatment, or attendance    |
+---------------------+-------------------------------+-----------------------------+
| PPRA                | K-12 educational institutions | Student surveys touching    |
| (34 CFR Part 98)    | administering surveys funded  | on eight protected sensitive|
|                     | by US Department of Education | behavioral domains          |
+---------------------+-------------------------------+-----------------------------+

---

Family Educational Rights and Privacy Act (FERPA)

Enacted by Congress in 1974 and codified at 34 CFR Part 99, the Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. FERPA applies to all educational agencies and institutions that receive funds under any program administered by the U.S. Department of Education (virtually all public school districts and state universities).

1. Education Records and Personally Identifiable Information (PII)

Under FERPA, education records are broadly defined as records, files, documents, and other materials that contain information directly related to an individual student and are maintained by an educational agency or institution, or by a party acting for the agency.

• Personally Identifiable Information (PII): Includes the student's name, parent or family member names, address, personal identifiers (Social Security number, student ID number), indirect identifiers (date of birth, mother's maiden name), or other biometric and demographic data that would allow a reasonable person in the school community to identify the student with reasonable certainty.
• Directory Information: Information contained in an education record that would not generally be considered harmful or an invasion of privacy if disclosed (e.g., student name, address, telephone listing, sports participation, honors). Schools may disclose directory information without prior consent only if they have given public notice to parents and allowed a reasonable window for parents to opt out in writing.

2. The Sole Possession Notes Exemption

For school-based prevention staff, a key FERPA detail is the sole possession notes exemption under 34 CFR § 99.3.

For school-based prevention specialists, this distinction carries profound operational consequences:

• When Notes are Sole Possession: A prevention specialist delivering a selective indicated support group makes personal handwritten shorthand notes summarizing group dynamics to prepare for the next session. These notes are stored in a private locked drawer or password-protected personal local file, are accessible to no one else, and are never shared. These notes are exempt from FERPA; parents do not have a statutory right to inspect them.
• When Notes Become Education Records: If the prevention specialist shares those notes with a school guidance counselor, enters them into the school district's shared electronic student information system (SIS), sends them via email to a school principal, or shows them to an assistant, the notes immediately lose their sole possession exemption. They instantly convert into official education records, granting parents the legal right to inspect, review, and request amendments to the content under FERPA.

3. Prevention Specialists in School Environments: CBO Contractors vs. District Staff

Many prevention specialists are not direct school district employees; they are employed by external community-based organizations (CBOs) contracted to deliver evidence-based curricula (e.g., LifeSkills Training, Project ALERT) inside public schools.

• The School Official Exception: Under FERPA, schools may disclose PII from education records without parental consent to an outside contractor only if the contractor meets the criteria of a school official with a legitimate educational interest.
• Required Safeguards: The contractor must perform an institutional service that the school would otherwise use employees to perform, must be under the direct control of the school regarding record maintenance, and must be bound by strict redisclosure prohibitions established in a formal Memorandum of Understanding (MOU).
• Transfer of Rights: Under FERPA, all parental rights transfer to the student when the student reaches 18 years of age or begins attending a postsecondary institution at any age (designated as an eligible student).

---

Health Insurance Portability and Accountability Act (HIPAA)

Codified at 45 CFR Parts 160 and 164, the Health Insurance Portability and Accountability Act (HIPAA) governs the privacy and security of health information. It establishes two central regulations:

1. The Privacy Rule: Sets national standards for when Protected Health Information (PHI) may be used or disclosed, establishing the minimum necessary standard (disclosing only the minimum amount of health data necessary to accomplish the intended purpose).
2. The Security Rule: Establishes operational safeguards across three domains:
   • Administrative Safeguards: Formal security management processes, assigned security officers, workforce training, and business associate contracts.
   • Physical Safeguards: Facility access controls, workstation security, device media controls, and clean-desk policies.
   • Technical Safeguards: Unique user identification, emergency access procedures, automatic logoffs, and end-to-end encryption (e.g., AES-256 for data at rest and TLS 1.3 for data in transit).

1. Covered Entities and Protected Health Information (PHI)

HIPAA does not apply universally to all entities that handle health data. It applies exclusively to covered entities:

• Healthcare providers who transmit any health information in electronic form in connection with HIPAA standard transactions (e.g., electronic billing, claims, benefit inquiries).
• Health plans (health insurance companies, HMOs, Medicaid/Medicare programs).
• Healthcare clearinghouses.
• Business Associates: External contractors who perform functions involving PHI on behalf of a covered entity.

Protected Health Information (PHI) encompasses any individually identifiable health information held or transmitted by a covered entity or business associate, relating to an individual's physical or mental health condition, the provision of healthcare, or payment for healthcare.

2. FERPA vs. HIPAA: The Critical School Jurisdiction Boundary

A frequent source of confusion in prevention practice is whether student health records maintained in a public school (e.g., immunization records, nurse logs, school counselor notes, screening results) are governed by HIPAA or FERPA.

• The Community Clinic Exception: If an external community healthcare center or hospital operates an independent school-based health center (SBHC) that maintains separate medical records and bills Medicaid electronically, those clinic records are governed by HIPAA, not FERPA.
• Prevention Coalition Status: A standalone community prevention coalition or 501(c)(3) youth agency is not a HIPAA covered entity unless it delivers healthcare services and bills third-party payers electronically. However, if a prevention specialist works within a hospital, a community health center delivering SBIRT (Screening, Brief Intervention, and Referral to Treatment), or an adolescent primary care clinic, HIPAA Privacy and Security Rules fully govern all participant interactions.

---

42 CFR Part 2: Confidentiality of Substance Use Disorder Patient Records

Rooted in federal alcohol and drug confidentiality statutes of the early 1970s (now 42 U.S.C. § 290dd-2), with regulations first issued in 1975 and administered by HHS and SAMHSA, 42 CFR Part 2 provides strict confidentiality protections for substance use disorder (SUD) patient records. Congress recognized that individuals suffering from addiction would refuse to seek medical treatment if their clinical records could be disclosed to law enforcement, employers, landlords, or family members, leading to criminal prosecution, job loss, eviction, or social ostracism.

1. The Two-Prong Applicability Test

42 CFR Part 2 does not apply to all substance-related conversations or organizations. It applies only if an entity satisfies both prongs of a strict two-part legal test:

                    THE 42 CFR PART 2 TWO-PRONG TEST
                    
   PRONG 1: Federally Assisted?          PRONG 2: Specialized SUD Program?
  +-------------------------------+     +--------------------------------+
  | - Direct federal grant funding|     | - An individual or entity that |
  | - Tax-exempt 501(c)(3) status | AND |   holds itself out as providing|
  | - Medicaid/Medicare provider  |     |   and provides SUD diagnosis,  |
  | - DEA registration / lic.    |     |   treatment, or referral.      |
  +-------------------------------+     +--------------------------------+
                                  │
                                  ▼
                   Is 42 CFR Part 2 Triggered?
         YES: Both prongs met (Specialized clinical SUD facility)
         NO:  Either prong missing (General community prevention)

• Application to Prevention Practice: General community prevention coalitions, school drug education programs, and universal youth development organizations do not hold themselves out as providing SUD diagnosis, treatment, or referral for treatment. Therefore, 42 CFR Part 2 does NOT apply to standalone prevention programs.
• When Part 2 DOES Apply to Prevention Specialists:
  1. The prevention specialist is an employee of a licensed, federally assisted SUD treatment facility delivering indicated prevention, early intervention, or referral services within that organization.
  2. The prevention specialist receives confidential patient records directly from a Part 2 SUD treatment program (e.g., receiving a client discharge summary or clinical assessment to coordinate aftercare prevention). In this scenario, the prohibition on redisclosure binds the prevention specialist to Part 2 confidentiality standards.

2. Consent, the 2024 Final Rule, and the Disclosure Notice

A general medical release is not enough for Part 2 records. A written Part 2 consent must identify the patient, the program or person disclosing, the recipient, the purpose, and the amount and kind of information to be disclosed; state the right to revoke; include an expiration date, event, or condition; and be signed and dated.

HHS revised Part 2 in a 2024 Final Rule (compliance date February 16, 2026) to align it more closely with HIPAA:

• A patient may sign a single consent for all future treatment, payment, and health care operations (TPO) uses and disclosures.
• HIPAA covered entities and business associates that receive records under that consent may redisclose them as HIPAA allows.
• Part 2 records still cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against the patient without the patient's written consent or a qualifying court order.
• HIPAA-style breach notification and penalties now apply to Part 2 records.

3. Statutory Exceptions to Part 2 Consent

Information protected by 42 CFR Part 2 may be disclosed without participant consent only under narrow, explicitly defined statutory exceptions:

• Medical Emergencies: To medical personnel treating an immediate life-threatening emergency.
• Suspected Child Abuse and Neglect: Mandated reports of suspected child abuse or neglect to state child protective services are explicitly permitted under 42 CFR § 2.12(c)(6). Key distinction: While the initial report of suspected child abuse is permitted, the clinical treatment records themselves cannot be disclosed or subpoenaed in subsequent criminal proceedings against the patient without a specialized Part 2 court order.
• Crimes on Program Premises or Against Program Personnel: Reporting a crime committed by a participant on the facility grounds or against staff, or threats to commit such crimes.
• Qualified Research, Audits, and Program Evaluations: To qualified personnel conducting financial audits or scientific research who agree not to re-identify participants.
• Court Order with Good Cause: A subpoena alone is insufficient. A court of competent jurisdiction must issue a specific Part 2 court order finding "good cause" (showing that the public interest in disclosure outweighs the injury to the patient and the therapeutic relationship), accompanied by a subpoena.

---

Protection of Pupil Rights Amendment (PPRA)

Originally enacted in 1978 and amended by the No Child Left Behind and Every Student Succeeds Acts, the Protection of Pupil Rights Amendment (PPRA), codified at 20 U.S.C. § 1232h and 34 CFR Part 98, governs the administration of surveys, analyses, and evaluations to minor students in elementary and secondary schools receiving U.S. Department of Education funding.

The Eight Protected Sensitive Areas

When a student survey touches upon any of the Eight Protected Areas, the school and prevention specialist must adhere to strict federal notification, parental inspection, and consent protocols:

1. Political affiliations or beliefs of the student or student's parent.
2. Mental or psychological problems of the student or student's family.
3. Sex behavior or attitudes.
4. Illegal, anti-social, self-incriminating, or demeaning behavior (directly encompasses alcohol, tobacco, cannabis, and illicit drug use).
5. Critical appraisals of other individuals with whom respondents have close family relationships.
6. Legally recognized privileged relationships, such as with lawyers, physicians, and ministers.
7. Religious practices, affiliations, or beliefs of the student or student's parents.
8. Income, other than as required by law to determine eligibility in financial assistance programs.

+-----------------------------------------------------------------------------------+
|                         PARENTAL CONSENT MODES UNDER PPRA                         |
+---------------------+-------------------------------+-----------------------------+
| Consent Type        | Operational Mechanism         | When Required / Best Practice|
+---------------------+-------------------------------+-----------------------------+
| Active Consent      | Parents must affirmatively    | Mandatory for US Department |
| ("Opt-In")          | sign and return a written     | of Education-funded surveys |
|                     | permission form for the student| querying the 8 protected    |
|                     | to participate in the survey. | areas; required by strict   |
|                     | Non-returns = Excluded.       | state laws and local boards.|
+---------------------+-------------------------------+-----------------------------+
| Passive Consent     | Written notification is sent  | Permissible under federal   |
| ("Opt-Out")         | home; parents only return the | law for non-ED funded surveys|
|                     | form if they object to student| (e.g., CDC YRBS, CTC survey)||
|                     | participation. Silence = In.  | unless local policy bans it.|
+---------------------+-------------------------------+-----------------------------+

Parental Rights under PPRA

• Right to Inspect: Parents have the absolute legal right to inspect, upon request, any survey instrument, instructional material, or curriculum guide before it is administered or used with their children.
• Reasonable Access: Schools must establish policies providing parents reasonable access to inspect these materials within a reasonable timeframe after a request is filed.

---

Multi-Framework Comparative Matrix

---

Managing and Storing Prevention Survey Data

Prevention specialists routinely administer community-level needs assessments, school climate inventories, and youth substance use surveys (such as the Communities That Care Youth Survey, the Youth Risk Behavior Survey, or local coalition questionnaires). Managing this sensitive data demands rigorous data stewardship protocols.

1. Anonymization vs. De-Identification

• Anonymous Data: Data collected without any direct or indirect personal identifiers whatsoever. The participant cannot be identified by the researcher, the school, or any third party. Recommended for universal school-based substance use surveys.
• De-Identified Data: Direct identifiers (names, street addresses, student IDs, birth dates) have been removed, but records may retain unique alphanumeric research IDs to facilitate longitudinal pre- and post-test tracking.

2. Generating Longitudinal Tracking Hash Codes

When an evidence-based selective intervention requires linking baseline, post-intervention, and 6-month follow-up surveys, prevention specialists generate self-generated identification codes that allow participant matching without revealing identity:

• Example Algorithm: First letter of mother's first name (M) + Last digit of student's birth year (7) + First letter of middle name (J) + Day of month born (14) = M7J14.
• This code allows researchers to merge longitudinal evaluation datasets while rendering the individual record completely de-identified.

3. Physical and Digital Security Safeguards

• The Double-Lock Rule: All physical paper consent forms, evaluation instruments, and participant rosters must be stored behind two distinct physical locks (e.g., in a locked filing cabinet inside a locked office room with restricted keycard access).
• Digital Encryption: Electronic datasets must be encrypted at rest using industry-standard AES-256 encryption and transmitted via secure, encrypted protocols (TLS 1.3, SFTP). Data must never be stored on unencrypted USB thumb drives or personal laptops.
• Access Controls & Multi-Factor Authentication (MFA): Database access must be role-based, granting access solely to personnel with an active need-to-know. All prevention accounts must mandate MFA and automated session lockouts after 10 minutes of inactivity.
• Data Destruction: Upon expiration of mandated retention periods (typically 3 to 7 years depending on grant guidelines and state archival codes), physical documents must undergo cross-cut shredding, and digital media must be sanitized following NIST SP 800-88 guidance (cryptographic erase, overwriting, or physical destruction).