This is the second installment of our four-part blog series addressing the privacy related provisions in the new Head Start Program Performance Standards (HSPPS).  If you missed Part 1 of the series, check it out here. The new HSPPS require every Head Start program to implement data management procedures that are approved by the governing body and policy council.  Those procedures must address the “quality of data and effective use and sharing of data, while protecting the privacy of child records,” and must be in place by August 1, 2017.  As part of their privacy policies and procedures, programs will need to address when and how they will disclose personally identifiable information (“PII”) from child records.

When do you need parental consent?

The general rule is that a program may not disclose PII from a child record without the prior written consent of the child’s parent.  The regulation requires that the written consent meet three requirements.  First, the written consent must be signed and dated.  Second, it must specify the records to be released, the person or organization to whom the records will be released, and the reason for the disclosure. Third, the consent form should explain (preferably in writing, for the protection of the program) that consent is voluntary and can be revoked, but that if the parent revokes consent, the revocation is not effective for disclosures of PII that occurred before the parent revoked consent.

There are exceptions to the general rule.  A program may, without written consent, disclose PII to officials at a school “in which the child seeks or intends to enroll or where the child is already enrolled.”  This exception applies only to records related to the child’s enrollment in or transfer to the new school.  Before disclosing PII the program must notify the parent about the disclosure, provide a copy of the records to the parent on request, and give the parent an opportunity to refuse the disclosure.

Another exception allows Head Start programs to, without parental consent, disclose PII from child records to school officials, including contractors and subrecipients, “if the official provides services for which the program would otherwise use employees, the program determines it is necessary for Head Start services, and the program maintains oversight” over the official through a written agreement that contains terms relating to privacy.  Other exceptions address, among other things, disclosure of PII in an emergency, disclosure of PII for the purposes of an audit or study, and disclosure of PII pursuant to a court order.

Procedures

Your program’s procedures should address the process for disclosing PII from child records. Among other questions, your procedures should address:

• Who in the program will be permitted to review and approve requests for the release of PII?

• Who will review and approve signed consent forms to ensure that they meet regulatory standards?

• Who in the program will be responsible for reviewing records, prior to disclosure, to ensure that the program’s response includes only the specific information relevant to the request, and that the response does not include the PII of any other child in the program?

Check back next week for the third blogpost in this four-part series, when we’ll discuss a parent’s right to access child records.

Want even more information about the privacy requirements?  Check out our upcoming webinar “Privacy Policies Under the New Performance Standards” Wednesday, February 15.  And don’t forget to follow us on Twitter and Facebook for more tips on Head Start and the HSPPS!