Course Articles
Florida Statutes and Rules Affecting the Practice of Psychology
Katie Kirk, LAC, PsyD
Florida licensees in Psychology are required to complete at least one hour of continuing education on Florida laws and rules relevant to the practice of psychology, which shall include Chapters 456 and 490, F.S. and Rule Title 64B19, F.A.C.
Click on the chapter or section number to access the current statutes and rules from the Florida Legislature website. Upon reviewing these materials in their entirety, proceed to the exam to complete the course.Florida Statutes
Chapter 456: Health Professions and Occupations, General Provisions
Chapter 490: PsychologyFlorida Administrative Codes
Rules - Chapter 64B19: Florida Administrative Code
Rules - Chapter 64B: Division of Medical Quality Assurance, Florida Administrative CodeMay 3, 2024
1 CE CreditCultural Competency in Behavioral Health
Sophie Nathenson, PhD
This text-based course is an edited transcript of the webinar, Cultural Competency in Behavioral Health, presented by Sophie Nathenson, PhD.
Learning Outcomes
After this course, participants will be able to:
- Describe the concepts of cultural competency, cultural humility, and culturally competent behavioral healthcare.
- Explain three types of culturally based mental health disparities in the United States.
- Explain three evidenced-based approaches to improve health equity through culturally responsive care.
Risks and Limitations
There are a few notable risks and limitations in this presentation. It does not contain a comprehensive list of techniques or approaches for practicing culturally competent care, nor does it contain an inventory of cultural customs or attributes of any group. Any data presented is subject to change over time, population, and methods. The concepts in this presentation have differing and evolving definitions and applications across disciplines.
Introduction
I will start by introducing the sociological perspective, which I am trained in, and the social and cultural drivers of health and health disparities. Then, we'll move to defining cultural competency and related concepts. We will discuss the rationale for cultural competency in the behavioral health fields and for a systemic sociological view of cultural competency. Then, we will discuss the central components of cultural competency: knowledge, attitudes, awareness, and skills. To preface this, when defining cultural competency, we distinguish cultural competency from simply competency.
Defining Cultural Competency
Culture is a way of life. It includes a worldview, values (what is considered good or bad), beliefs (what is considered to be true), customs, and norms of behavior (the expected ways of behaving). Culture is very much related to the health and well-being of individuals. It is something to look at when it comes to health outcomes, including mental health. Competence can be defined as the ability to perform a task; when we talk about cultural competency, it includes knowledge as a foundation, awareness, attitudes, and skills to navigate the cultural concerns and problems that clients may present. Essentially, this means the ability to work with a variety of individuals across cultures, and be able to address cultural concerns, things that are culturally based or have to do with some of the bigger picture influences on that individual.
Many times, we'll think of cultural competency not as simply the ability to perform a task or a knowledge base, a set of facts to be learned. Rather, more as qualities, some of which you may already have, and some of which can be developed over time in a continual process across the entire life course. Defining culturally competent care, it means clinicians can work with diverse clients, with a different cultural background, with variation in their responses based on this awareness of cultural differences.
A Sociological Perspective
To bring a sociological perspective to cultural competency, it is a slightly different perspective that training on specific cultural customs, and everything that makes this culture different from that culture. Instead, we are taking a bigger picture, societal of perspective. I am a medical sociologist, not a healthcare professional, and not a behavioral health professional. I'm coming from this perspective, where we're studying underlying social conditions that affect the health status of an entire group. This could be an entire society of people. And specifically, we're looking at inequalities; in sociology, as compared to psychology which studies individual differences, we are comparing group differences. This is not to say that people in a certain group are similar to each other. When we compare groups, we're looking at the health status of that group as a whole. If we see significant differences in life expectancy, physical illnesses, and mental health issues between one group versus another, what that tells us is that there may be something at a broader level within a community, within a society, that may be driving that inequality, or that difference.
When we look at the research on diverse populations, diverse is defined as non-dominant races. In the U.S., white individuals are the "dominant race." Looking at diverse populations and their perspectives, there's often a mention that being aware of systemic issues on the part of the clinician does impact the therapeutic relationship. We're going to zero in on that idea. Understanding some of the social context, even at the broadest country level and even on the global level--that knowledge and awareness impacts the relationship that you have with the client.
In our society, we have documented health disparities, and they've existed and persisted over a very long period of time. These inequities sparked the need for cultural competency. As our country becomes more diverse, as we get hip to the fact that culture does have an effect on health, these disparities and these inequities are deemed important to address. When looking at the whole health status of an entire population--again, that could be a country, county, a city, neighborhood, client base, patient population of a specific healthcare organization--if there are massive disparities, the health status of that entire group is going to go down. It causes decreases in the quality of life of many individuals. It also creates very poor metrics in terms of patient outcomes. It costs a lot more money. There are all sorts of negative impacts. Cultural competency, as a concept, is about creating more awareness and providing more knowledge to potentially reduce these disparities by providing better and more appropriate care (Phelan & Link, 2013).
From the sociological perspective, to wrap this up, we’re including the social context that goes beyond biomedical and psychological factors contributes to the manifestation of certain behaviors and disorders. When we include that social context in the mix, we acknowledge those other factors, and we can then address some of those factors that may be causing problems within a client. We'll talk more about that throughout this presentation.
Disparities Research
Taking a super broad brush of disparities research, I'll first say of the different social factors, age, race, gender, and socioeconomic status are the most studied regarding their effect on health outcomes. In cultural competency trainings and literature, there's often a focus primarily on race. Many different social factors are in the mix. We’ll look at some of the main kinds of domains of disparities, which are differences in any kind of health outcome; anything that we can measure that has to do with health. For example, Asian and Native American populations tend to have a higher prevalence of mental disorders. Black and Latinx populations tend to have a greater lifetime persistence of mental disorders.
In terms of access, minorities have fewer visits to mental healthcare services, are less likely to initially fill prescriptions for psychiatric disorders, and have higher dropout rates. This is controlling for other factors that may affect dropouts, such as language barriers, socioeconomic status, and the ability to pay for services. Tribal communities have less access and are less likely to access services. In terms of care quality, Black and Latinx individuals are less likely to receive guideline-based care, and Asians have a lower standard of care. These are very broad variables in terms of disparities, but an entire presentation could be dedicated to these disparities in a very wide variety of outcomes that have to do with mental health.
Mental Health Inequity
In terms of inequity, we differentiate between health disparities and health inequities. Health disparities are simply differences in health outcomes by group, but health inequities are disparities that are due to policy, system, practice, and access injustices. A lot of this has to do with a misdistribution of resources or a distribution that negatively affects certain groups more than others. It can be things like discrimination and racism at the individual or the system level. All of this is wrapped up into producing health inequities.
Looking at some data from the Substance Abuse and Mental Health Services Administration, SAMHSA, 69% of Black and 67% of Latinx adults were found to not be receiving any treatment for their mental health problems. 42% of Black adults and 44% of Latinx adults were not receiving treatment for serious psychiatric disorders. Shockingly, 88% of Black adults and 89% of Latinx adults were not receiving any treatment for substance abuse disorders. This paints a picture for you initially, at how different mental health access outcomes are. We can talk about why, like reverse engineering, as to what is going on at the system level to produce and contribute to this inequity. And how cultural competency can begin to address this, starting with the one-on-one level. Again, there are other social risk factors, such as gender, gender identity, sexuality, disability, and socioeconomic status, with inequities found when comparing those groups (Substance Abuse and Mental Health Services Administration, 2018).
This is important to consider that, again, while individuals in a certain social group or social status are not necessarily similar to each other in terms of individual similarities, we're looking at the fact that these social statuses essentially lend themselves to differences in how your experience of the world is within a certain societ,y and that there are differences there.
Now, moving to the field of psychology and psychiatry. There are plenty of researchers, scholars, and people who practice in these fields that are calling for action taken to reduce disparities and to encourage cultural competency. This is not just something that is applied to healthcare, and it's also not new. We are at a point in society where public awareness of health disparities and health inequity has gone up significantly. Part of that is from events that happened during the pandemic. Everyone's at home tuning into the same news. Experiencing--at very different levels-- events at the societal level, and there is more awareness. When the concept of cultural competency entered the lexicon in healthcare 20, 30 years ago, it was not a new concept then either. It was just new on the scene in healthcare.This goes back to 1970. "We are asking white psychiatrists to become increasingly aware of how their everyday practices continue to perpetuate institutional white racism in psychiatry." Looking at the sociological: "it means a significant reduction in economic barriers to psychiatric care, and it means relinquishing negative stereotypes" (Sabshin et al.,1970). Moving on to 1985, it's referred to as "an ethical obligation that cross-cultural skills are placed on a level of parity with other specialized therapeutic skills" (Ridley, 1985), part of the ethics of being a provider; to have the skills to serve a variety of clients and to be aware of the issues that may be disproportionately affecting these individuals. The APA (2002) says to "take precautions to ensure that their providers' potential biases, the boundaries of their competence, and the limitations of their expertise do not lead to, or condone unjust practices." In order to do these things and engage in actions according to these calls for action, there has to be first a knowledge of cultural differences in the social context, then trickling down to what that means for individual care and that therapeutic alliance.
Components of Cultural Competency
Now, we will go over the components of cultural competency and get more in-depth, especially with knowledge, the foundation, bringing in the social context of it all. The components of cultural competency are knowledge, attitudes, awareness, and skills. Number one: knowledge. I'm adding here an understanding of the context and the relevant issues. There are other definitions of the knowledge component of cultural competency that may be more specifically about knowing and learning about specific cultures. This is important. It can open your mind to the variation and the cultural implications to care and to all sorts of aspects of diagnosis and health philosophy, the subjective nature of different illnesses, the practices and the treatment, philosophies among different cultures. We don't want to build up this knowledge base so that we stereotype. That's part of the understanding of those cultural differences. We're building on that definition of knowledge of different cultures, to make sure that the knowledge domain includes inquiring about these cultural issues impacting the client and getting that information specific to that individual client (Sue et al., 2009).
Attitudes: this can be your attitude towards diversity in general. It can include empathy, non-judgment, and the therapeutic alliance wrapped up in that domain. Next is awareness: understanding one's own biases. Self-awareness is the practice of reflecting on where you're coming from and where your culture fits into the mix. Finally, we have skills. This can include assessment and your ability to use culturally sensitive interventions. All of these components exist at the personal, agency or organizational level, the community level, and the societal level. It's not just the one-on-one. It can be as broad as society in general; the knowledge, attitudes, awareness, and skills (Sue et al., 2009).
There are other key terms and terms to know, in part because culture can be very closely associated with ethnicity or race, and it's much broader than that. Ethnicity refers to cultural heritage and traditions: shared history, nationality, country of origin, religious affiliation, beliefs, and belonging to a particular faith. Race is a conglomeration of similar physical characteristics, but that's where we associate race within society. There's a very important distinction here where it could be seen as a biological set of differences, genetic differences, but we have the research to demonstrate that two people of the same race, physically, may have actually more differences than two people who do not look alike in terms of their race.
From a sociological perspective, we look at race as a social construction, not as something biological, because the differences by race that we see in how people are treated in society, their health outcomes, and their well-being as a whole are different. There's a different social experience and a different social context. A social construction is how we define race here. Identity could be at the individual, the group, or the universal level. Someone's personal identity, how they identify, and aspects of culture they identify with are part of their core identity. Multiculturalism refers to appreciating diversity, understanding group identities and cultural differences, and welcoming that.Getting into the knowledge component of cultural competency, we have knowledge of cultural differences, differences in customs, differences in health philosophies, behaviors, health-improving behaviors, and norms. These all affect mental health. Everything that we're talking about in terms of disparities, these components of culture and cultural competency, all affect mental health, and are documented factors and drivers of mental health outcomes. Cultural factors in mental health outcomes could be related to things like barriers to mental health care. It could be about the role of the social context that we live in. Social context is the broader set of norms, values, and beliefs in broader society. It's how people are portrayed in the media, it's the political climate, it's the economic situation of a certain society or smaller community. It’s everything that's going on outside the individual, the things that affect us collectively and affect people in different sectors of society with different social statuses differently.
The culture of mental healthcare, the bias, or the limitations of interventions is an interesting topic because it has to do with the fact that our diagnosis and our treatment in behavioral health and healthcare have a culture to them. They're not necessarily objective in the grand scheme of things. They are also culturally based, and they're often looked at as objective because they're driven by scientific discoveries and the like. They also have a culture to them. It's very significant.
Role of Culture in Mental Health
The role of culture in mental health: these are just a couple of the ways that culture affects mental health. First, it can influence how clients present symptoms and their subjective experience. We're keeping in mind that from one culture to another there can be a big difference in the interpretation of what's happening mentally. For example, with depression: if you're in an individualistic society, you may be interpreting that as personal misery and despair. In a more collective society, you may be internalizing things at the group level, and there's less of a focus on the individual. This can seem very different to us in the United States where we're zeroing in on that individual experience.
In terms of diagnoses of mental health conditions, they vary quite widely across cultures--things like attention deficit disorder. The set of behaviors that might be used to diagnose attention deficit disorder, for example, in another culture may be more tolerated and therefore not looked at as an abnormality. That is part of the difference in interpreting and diagnosing different mental health conditions. Symptomology can be looked at as abnormal in one society, normal in another. Whether we define something as an abnormality or a disorder is culturally based, including our own system here in America where mental illnesses are classified according to Western systems and worldviews. That's just something to be aware of. It can help us have an openness to different cultural elements when it comes to the interpretation and presentation of symptoms related to mental health issues. Just being aware of that can help cultivate that open-mindedness--not to switch your views, but to be able to gather information-- culturally relevant information--from the client that may greatly affect the relationship between provider and client (Hinshaw et al., 2011; Maslowski et al., 1998).
Cultural Factors and Barriers to Behavioral Healthcare
Moving on to more cultural factors and barriers to behavioral healthcare. These are part of that set of factors that are culturally based that drive, or at least influence mental health outcomes. There could be physical barriers and a lack of providers based on a geographical area. We see this in rural communities, but it’s not just rural communities where there's a major lack of providers. There may be a lack of providers with the same background as a client. Oftentimes people who fall into minority populations might have a desire for this, so that the cultural issues are more understandable on the part of the provider.
Cultural mistrust of mental health interventions in general can have to do with historical injustices, cultural appropriateness of intervention, and consideration of the client's values and beliefs. For example, beliefs regarding their spirituality, beliefs associated with their religion, resource barriers, lack of insurance cost, language barriers, transportation barriers, and stigma in help-seeking in terms of mental health. Sometimes there's a stereotype that there's a stigma in certain cultures in terms of seeking services, but in actuality, it's an economic barrier, not a stigma.
Racism and Mental Health
Racism is an example of the social context and how that can affect mental health. We have an abundance of research on how racism, including discrimination, profiling, and microaggressions, are linked to more emotional distress, PTSD, depression, anxiety, self-esteem issues, and alcohol, and substance misuse. It affects social wellbeing. It can affect educational attainment. It can affect physical well-being. There's a whole scientific discipline called psychoneuroimmunology. This field studies how that social context, which affects your psychology, affects your physical body. We know that the experience of discrimination over time is cumulative in terms of its effect on both mental health and physical health. You have that release of cortisol that can help you in the short term and harm you when it's a long-term production of cortisol in the body. It can affect the degradation of your body in general, your risk of heart disease, and high blood pressure. It can affect body mass index and poor overall health. All of this gets into the body (Paradies, 2006).
Societal “Structural” Conditions
Looking at societal, or we refer to them as structural conditions, different from social factors and statuses. We're looking at these again in terms of their effect on mental health. Racial segregation, controlling for socioeconomic factors, controlling for the socioeconomic status. By the way, that is a measure that includes your income, your wealth, and your occupation; it can also include education. We can look at the socioeconomic status at the neighborhood level and at the city level. Controlling for that, when we have segregated communities, it can influence and contribute to mental health outcomes.
By the way, in the field of medical sociology, one of the assumptions is that health and illness are not randomly distributed across a geographical area or across groups. So, you can imagine a map of a community and almost like a Doppler radar when we see meteorologists present the weather systems. There are hotspots of certain illnesses, certain mental health conditions, physical health conditions. When we map onto that socioeconomic status, but also things like racial segregation, we see those hotspots of illness. That tells us that it's not necessarily random. There are social factors and structural conditions that are related to those outcomes, things like mass incarceration. We know that incarceration very disproportionately affects different groups, adverse childhood experiences, and this can lead to a higher likelihood of interacting with the criminal justice system. If a child has parents that are away, that are incarcerated, this can lead to adverse childhood experiences, which most of you probably know is related to mental health, but also related to physical health, and chronic illnesses in adulthood. Institutional racism and sexism, both historical and contemporary, affects mental health.
In general, the social experience based on socioeconomic factors, gender, sexuality, religion, disabilities, and other social statuses that we call social statuses. Much of the time fits into a social hierarchy, which means not necessarily at the individual level, but within a society, there’s a difference in the treatment, the social norms and ways of interacting with people that fall into different groups. Poverty, neighborhood deprivation, and unemployment affect mental health greatly.
Displacement, loss of culture, and sense of belonging. If a culture is physically displaced, and there are examples that go way far back into history, hundreds of years ago where if a group is displaced, moved to another location, or the culture breaks down, there are higher rates of substance abuse, there are higher rates of overdose. It has a massive effect on the entire group as a whole. Social capital is like capital, only instead of monetary resources, which means more social resources, social cohesion, and the closeness of the group.Redlining, reduced investment, blocking out people of certain groups accessing loans and resources in general, or employment. That includes services, schools, and hospitals. A neighborhood might have their property taxes, you know, their property values go down and then the schools suffer because that’s where they’re getting their funding. They could go out of business, and they don’t have a school. All of that has a massive effect on a neighborhood, a group, a culture, the built environment, and how a community is structured to foster social interaction and safety. All of those things affect mental health (Cummings et al., 2017).
Structural Racism
Structural racism; a defined by the Aspen Institute as "A system in which public policies, institutional practices, cultural representations, and other norms, work in various, often reinforcing ways to perpetuate racial group inequity, dimensions of our history and culture that have allowed privileges associated with 'whiteness' and disadvantages associated with 'color' to endure and adapt over time." (The Aspen Institute, 2016). Suppose you hear the concept of structural racism or systemic racism. In that case, it's that level above the individual where this is something that has gone on in history and continues today, where there are simply privileges and disadvantages by group.
Structural Competence
Structural competence is a great adjunct to cultural competency. Structural competence is the ability to discern how these downstream clinical symptoms, problems, and diseases are influenced by upstream social determinants of mental health. I'll break that down a little bit in terms of upstream and downstream. Downstream factors are things that may affect a health outcome quickly. They're the things that we're observing - clinical symptoms, suicidal ideation, or something physical like a heart attack that leads to death. Things that happen downstream are those things that fall into emergency situations.
Going a little further upstream we have health behaviors; further upstream, the social context, relationships, family situation, home environment. Even further upstream, we have the economic level, political level, and policy level. Problems that are happening at the systemic level are identified as problems in terms of their influence on these health disparities. Recognizing the history of pathologizing responses to trauma, there are truly disturbing aspects of history and how things are medicalized and were medicalized, and pathologized. Things like drapetomania, which was defined as the desire to escape slavery. These illnesses were legitimate diagnosable illnesses, essentially justified inhumane treatment and structural racism, and impacted diagnosis and mental health treatment. In other words, a trauma response to something external was then labeled as a mental illness. When we take that to today, if we're focusing only on that symptomology and we ignore those broader social factors, we could be missing a large part of the story (Metzl & Hansen, 2014; Willoughby, 2018).
Client Perspectives of Culturally Competent Psychotherapy
Looking at client perspectives of culturally competent psychotherapy, these are some important issues: understanding cultural issues, recognizing bias, using the social justice framework, having the desire that their therapists be advocates in terms of social problems, and preference of the same race therapist. As a side note: the outcomes may not always be better--you can rest assured if you are not the same race or of the same culture as your client, it doesn't necessarily mean you’re going to be less effective.
A study showed that a cross-cultural counseling inventory had a greater impact than only the counselor rating form on satisfaction with their provider among minority clients. This shows that there is some evidence of a positive impact of practicing cultural competency. This is also a sidebar, but a very important one (Constantine, 2002; Fuertes et al., 2006).
Knowing and Not-Knowing
When we talk about knowledge and gathering all the facts, there are things we may know, but practicing and embracing not knowing, and being open about what you don't know, can be powerful. It's like taking accountability. Oftentimes in our society, if we take accountability, if we show our biases, our lack of knowledge in certain areas, it can be associated with weakness, or you may not think that you're going to be respected.
That is a cultural thing, and breaking that down can be powerful at the individual level. Knowledge can include knowledge of cultural influences on care, the efficacy of care, culturally specific resources, programs and policies, and what’s out there that could help certain groups. If you avoid sensitive topics altogether, it can be detrimental. It can be beneficial and meaningful to have that dialogue. We don't have to know at all. When in doubt, you can ask a client to explain further, and you can always ask about how the social, or political environment may be affecting them personally.
Making the Connection
We're making the connection here: how does this form of knowledge fit into the other components of cultural competency? No matter how wide-ranging your knowledge base, awareness of these broader factors matters to clients, and individual-level care is impacted by understanding this broader context.
Attitudes and Cultural Humility
Knowledge can shape our attitudes. It can help us cultivate awareness, That's a great foundation for the skills you can pick up. Attitudes refer to things like embracing diversity, inquisitiveness, and having a positive attitude towards cultural differences. Practicing cultural humility, as distinct from cultural competency; viewing other mental health paradigms (which could be very different from the paradigm we ascribe to) as having value, emotional intelligence, and avoiding stereotypes. Cultural humility is different than cultural competency, and this is the definition that I gravitate towards in terms of how it could be impactful. It's a lifelong practice of self-evaluation, self-reflection, and self-critique. You're digging deep to understand where you're coming from and your biases. It's about reduced power imbalances. As I just talked about--vulnerability and taking accountability for potential biases and potential harm-- can be very influential in the therapeutic alliance. It also could include advocacy, community outreach, and organizational partnerships. We're looking at competency as more akin to knowledge, whereas cultural humility is more about not knowing (Tervalon & Murray-García, 1998).
Awareness
Having a bias isn't necessarily a bad thing. It's your own values, your own culture, and their impact. Ethnocentrism is looking at your own culture as the standard and looking at other cultures as other, as different. This shows up even in the “DSM-5”: there is an appendix of more culturally based disorders, that are set aside. In contrast, things like anorexia nervosa, for example, are also culture-bound, but is not included in the category of culture-bound illnesses. This is an illness that is more prevalent in Western cultures. Looking at differences in the impact of social issues, we’re simply being aware of institutional and intervention bias. We’re looking at approaches to behavioral health and being aware that they aren't culture-free, and there are cultural differences in engaging with care.
Skills
There are three skills outlined by Cardemil and Battle (2003). You can suspend preconceptions about the client and the family's race and ethnicity. You can recognize that clients may be different from other members of their same racial and ethnic group. You can consider how these differences between the therapists and client could affect psychotherapy. You can acknowledge that power, privilege, racism might also be affecting interaction with clients. Erring on the side of discussion again, you might be in doubt of what the significance is of culture. You can continue to receive ongoing professional development in culturally competent practices (Cardemil & Battle, 2003). This is from 20 years ago. It still applies today.
Anti-Racist Care
Working on the level of addressing some of those social factors, this addresses internalized racism, collective trauma, and emotional regulation. Black psychologist Kenneth Hardy talks about the concept of the assaulted sense of self. This means that there's an internalization of the externalized racism that happens at the societal and cultural levels. Once that is internalized, it can affect self-esteem. How could this affect therapy? An example is looking at self-esteem issues. Working with that just as an individual thing, versus considering that this may be societally-based. Being aware of that and engaging in discussion with the client may have a positive impact there.
We consider care differences, like over-prescribing and mistrust. We can address those issues, taking the time to explain pharmacological treatment, the reasons, the side effects, and we gather information on a wide variety of cultural factors. We'll talk about that in terms of assessment as a culturally competent skill. The American Psychological Association (2020) has deemed racism a pandemic. This is coming late to the party, but nonetheless it is part of bringing awareness of some of these issues. Looking at it as a public health issue, as a mental health issue, as a pandemic that is spreading, that can be addressed. There's a treatment for this pandemic (Cénat, 2020; Ogundare, 2020; Singh, 2019).
Culturally Competent Assessment
Moving into culturally competent assessment, there is in the "DSM" something called the Cultural Formulation Interview. We can use that to gather information related to culture. We're not assuming homogeneity. This set of assessments, and there are lots of different assessments, can gather information on how symptoms may be related to things like racism and socioeconomic issues.
Culturally competent assessment recognizes the impact of these issues, such as mass incarceration and police violence, and how these can affect individuals. It assesses both the individual factors and the collective protective factors, strengths, and resources. Resources could be religious and spiritual, and culturally-based. It could be a culture where there's more social cohesion, or more collectivist, and these can be a strengths and protective factors. For all of the risk factors, there are also protective factors. We're going to look at two frameworks for culturally competent assessment.
- The RESPECTFUL Framework - An acronym of the different aspects of culture (D'Andrea & Daniels, 2001):
- R-religious/spiritual identity
- E-economic class background
- S- sexual identity
- P-level of psychological maturity
- E-ethnic/racial identity
- C chronological/developmental challenges
- T- threats to well-being and trauma
- F-family background and history
- U-unique physical characteristics
- L- location of residence and language differences
This is information you may be already collecting; it can serve as a base for conversation and deepen your understanding of your client.
- The ADDRESSING Framework – is similar and also an acronym (Hays, 2001).
- A- age/generation
- D- disability status (developmental)
- D- disability status (acquired)
- R- religion/spiritual orientation
- E- ethnicity
- S- socioeconomic status
- S- sexual orientation
- I- indigenous heritage
- N- national origin
- G- gender
Other Scales and Tools
I mentioned the Cultural Formulation Interview and there is a Trauma Symptoms of Discrimination Scale. Deepening your understanding of discrimination and how that gets into the mind and body is fascinating. There's lots of research on how the social environment gets into the body and is passed on generationally. There's research that, for example, our grandmother's social environment affects our genetics. The field of epigenetic studies this. Consider two generations ago, and what was going on in society two generations ago. It’s pretty bad now, in terms of inequality, but go back two generations. There are other sets of issues that can have an effect on present day, the present generation (Cénat, 2020). Other tools: Everyday Discrimination Scale, UConn Racial/Ethnic Stress and Trauma Survey and, again, the Cultural Formulation Interview.
Communication
Communication applies to any client, but these are some tips when it comes to developing culturally competent skills in communication. You may already do this, but it's food for thought to take into your day-to-day. You can ask clients to describe their identity versus prescribing an identity (again, learning about a culture and then putting that on them or making those assumptions may not be exactly correct). You can ask about ideas, experiences, and beliefs. Consider that cultural and historical factors influence the etiology, symptom presentation, interpretation, how they talk about their mental health issues, and how that interacts with family pressures, cultural pressures, and stigma. The idea that therapy for a long time was associated with something that white individuals did. In your one-on-one communication, just knowing, and not assuming that there’s a universal in terms of symptom presentation and diagnosis. Note in-group differences to avoid inaccurate assessments or racial bias. Again, that's turning the cultural knowledge into a stereotype--avoiding that.
Resisting avoiding gathering information due to discomfort, and moving through discomfort. This applies to all of our relationships, right? When there's a conflict, when there's tension, when there's a power differential--being able to break that down and work through that can lead to a more meaningful connection. You can also consider more structured interviews versus unstructured ones. That relates to that discomfort. If there's a lot of discomfort, needing to know how to start the conversation, how to keep that conversation going, or what to take from it, you can use more structured interviews to gather that information as a starting point.
Beyond the Individual: Community-Based Interventions
As was mentioned before, cultural competency is a continuum, but it's also a continuum from individual all the way up to the policy level. You can integrate community-based interventions. This might be something that you do, and it might be something at the agency level. Many coalitions in communities have certain goals to address health and social issues in that community. I lived in a small town for many years, and there were many coalitions of people that came from different cultural backgrounds and political ideologies, and there were common goals. For example, ending child abuse or raising the high school graduation rate in the county. Understandably, you have, probably, a heavy workload and a lot going on. Being able to go outside of that, if you do have the time to join those coalitions, you can bring your expertise in the mental health field to interventions, whether that's disseminating mental health information or partnering with those community organizations or coalitions to bring that expertise. You can bring ideas to the table, assist individuals with resources and access, and even provide services. What we're talking about here is meeting people where they're at. If there's a barrier to care, doing something like a pop-up where you're providing some care, or maybe some assessments, similar to pop-up medical care, like a pop-up diabetes clinic or providing oral healthcare.
Policy Recommendations: Education and Research
Now we get into policy recommendations. We have covered the societal view and different societal issues, social factors, systemic issues that affect mental health. How structural issues have a trickle-down effect on clients. How those issues can be embedded, not only in their mind but in their body, and can affect how they are engaging with their mental health.
After looking at that big picture and how that affects individual care, now we’re moving back up to that policy level, which is something that many folks in the mental health fields have called for in terms of engaging more at that policy level as a mental health professional. At the educational level and the workforce level: recruiting, mentoring, and striving for a more diverse workforce. It does matter to have professionals at the table with that lived experience, and have more options for clients to have a provider who is of the same race, or cultural background that, again, may be more understanding of those issues. That’s not to say that there can be an assumption there when two people are of a similar culture. The same skills apply to collecting that information specific to that individual.
The educational level: inclusion of cultural competency education and looking at different forms of education. I've tried to find evidence of when training works, because the truth is that the disparities we see persist. They're not going away. There is a question, and there is a debate: is cultural competency training making an impact? That's why, personally and professionally, I'm passionate about looking at that big picture, and including cultural humility. The educational practice that is a best practice is experiential learning. Spending time in a certain community with a different culture than you and becoming kind of embedded. Communicating, but mostly listening to people in that group that is different from your background, is very influential in that attitude and awareness piece.
We want to dedicate time and resources for any mandated training. If you're having to go to a training (and you're going to a training right now), having that time, and having resources. If it's happening at the organizational level, it’s putting time and resources behind that. Advocacy for interpreter services, incentivizing buy-in at the leadership and administrative levels, and expanded funding from government agencies and hospital systems to improve cultural competency (McGregor et al., 2019).
At the research level: this is critical as there is an unbelievable dearth and lack of research on the efficacy of therapies on a variety of different cultures and races. Research is needed on these underlying factors that explain these disparities, not just at the individual level. Program evaluation of cultural competency training: as I said, finding where the best practices are. More research on the client experience and more assessment of these other components like humility and empathy, and I would add vulnerability and accountability. Assessing when those skills and qualities are present, what's the effect on the health outcome? More diagnostic research, looking at the reliability and validity of different assessments, increasing studies on diverse populations, more diversity among researchers, and interdisciplinary approaches. As mentioned, those other fields such psychoneuroimmunology added to the research base (Ogedegbe, 2020; Singh, 2019).
Summary
There's a difference between cultural competency and competency, right? Cultural competency is a set of qualities. It's a lifelong practice that includes inner work for us to do. Based on what we know, the quality of the interaction is more important than anything. That's what we want to influence. We can't assume that knowledge of cultural differences automatically translates into more effective interventions (Shim, 2020).
Our general knowledge is very good for understanding that there are cultural differences and systemic inequalities. That's our base, and then we grow into being more comfortable discussing these issues and working on that humility piece. The empathetic inquiry is preferable over extrapolation, or taking your knowledge base and making those assumptions. Finally, a holistic approach to cultural competency also can include outreach, advocacy, and even engagement with policy change.
Thank you. Your time is appreciated.
References
Alarcón, R. D., Becker, A. E., Lewis-Fernández, R., Like, R. C., Desai, P., Foulks, E., et al. (2009). Issues for DSM-V: The role of culture in psychiatric diagnosis. Journal of Nervous and Mental Disease, 197, 559-560.
American Psychological Association. (2002). Ethical principles of psychologists and code of conduct. American Psychologist, 57(12), 1060-1073. [PubMed: 12613157]
American Psychological Association. (2020, May 29). ‘We are living in a racism pandemic,’ says APA President.
The Aspen Institute. (2016, July 11). Terms you should know to better understand structural racism.
Betancourt, J. R., Green, A. R., Carrillo, J. E., & Owusu Ananeh-Firempong, I. I. (2016). Defining cultural competence: A practical framework for addressing racial/ethnic disparities in health and health care. Public Health Reports.
Cardemil, E. V., & Battle, C. L. (2003). Guess who's coming to therapy? Getting comfortable with conversations about race and ethnicity in psychotherapy. Professional Psychology: Research and Practice, 34(3), 278.
Cénat, J. M. (2020). How to provide anti-racist mental health care. The Lancet Psychiatry, 7(11), 929-931.
Constantine, M. G. (2002). Predictors of satisfaction with counseling: Racial and ethnic minority clients’ attitudes toward counseling and ratings of their counselors’ general and multicultural counseling competence. Journal of Counseling Psychology, 49(2), 255–263.
Cummings, J. R., Allen, L., Clennon, J., et al. (2017). Geographic access to specialty mental health care across high- and low-income US communities. JAMA Psychiatry, 74, 476-484.
D’Andrea, M., & Daniels, J. (2001). Respectful counseling: An integrative model for counselors. In D. Pope-Davis & H. Coleman (Eds.), The interface of class, culture and gender in counseling (pp. 417–466).
Fuertes, J. N., Stracuzzi, T. I., Bennett, J., Scheinholtz, J., Mislowack, A., et al. (2006). Therapist multicultural competency: A study of therapy dyads. Psychotherapy: Theory, Research, Practice, Training, 43(4), 480–490.
Gurung, R. A. R. (2019). Cultural influences on health. In Cross-cultural psychology: Contemporary themes and perspectives (pp. 451–466).
Hays, P. A. (2001). Addressing cultural complexities in practice. Washington, DC: American Psychological Association.
Hinshaw, S. P., Scheffler, R. M., Fulton, B. D., Aase, H., Banaschewski, T., Cheng, W., et al. (2011). International variation in treatment procedures for ADHD: Social context and recent trends. Psychiatric Services, 62(5), 459-464.
Kleinman, A. (1978). Concepts and a model for the comparison of medical systems as cultural systems. Social Science & Medicine, 12(2B), 85-95.
Maslowski, J., Jansen Van Rensburg, D., & Mthoko, N. (1998). A polydiagnostic approach to the differences in the symptoms of schizophrenia in different cultural and ethnic populations. Acta Psychiatrica Scandinavica, 98(1), 41-46.
McGregor, B., Belton, A., Henry, T. L., Wrenn, G., & Holden, K. B. (2019). Improving behavioral health equity through cultural competence training of health care providers. Ethnicity & Disease, 29(Suppl 2), 359.
Metzl, J. M., & Hansen, H. (2014). Structural competency: Theorizing a new medical engagement with stigma and inequality. Social Science & Medicine, 103, 126-133.
Ogundare, T. (2020). Culture and mental health: Towards cultural competence in mental health delivery. Journal of Health and Social Sciences, 5(1), 023-034.
Ogedegbe, G. (2020). Responsibility of medical journals in addressing racism in health care. JAMA Network Open, 3, e2016531.
Paradies, Y. (2006). A systematic review of empirical research on self-reported racism and health. International Journal of Epidemiology, 35, 888-901.
Phelan, J. C., & Link, B. G. (2013). Fundamental cause theory. In C. Bird, P. Conrad, A. Fremont, & S. Timmermans (Eds.), Medical sociology on the move: New directions in theory (pp. 105-125). Springer.
Ridley, C. R. (1985). Imperatives for ethnic and cultural relevance in psychology training programs. Professional Psychology: Research and Practice, 16(5), 611-622.
Sabshin, M., Diesenhaus, H., & Wilkerson, R. (1970). Dimensions of institutional racism in psychiatry. American Journal of Psychiatry, 127, 787-793.
Shim, R. S. (2020). Mental health inequities in the context of COVID-19. JAMA Network Open, 3, e2016531.
Singh, S. P. (2019). How to serve our ethnic minority communities better. The Lancet Psychiatry, 6(4), 275-277.
Substance Abuse and Mental Health Services Administration. (2018). National Survey on Drug Use and Health: African Americans.
Substance Abuse and Mental Health Services Administration. (2018). National Survey on Drug Use and Health: Hispanics, Latino or Spanish Origin or Descent.
Sue, S., Zane, N., Nagayama Hall, G. C., & Berger, L. K. (2009). The case for cultural competency in psychotherapeutic interventions. Annual Review of Psychology, 60, 525-548.
Tervalon, M., & Murray-García, J. (1998). Cultural humility versus cultural competence: A critical distinction in defining physician training outcomes in multicultural education. Journal of Health Care for the Poor and Underserved, 9, 117-125.
Willoughby, C. D. (2018). Running away from drapetomania: Samuel A. Cartwright, medicine, and race in the Antebellum South. The Journal of Southern History, 84(3), 579-614.
Nathenson, S. (2023). Cultural competency in behavioral health. continued.com, Article 46. Available at www.continued.com/psychology
Oct 23, 2023
1 CE CreditHIPAA for Allied Health Professionals
Kim Cavitt, AuD
Editor’s note: This text-based course is an edited transcript of the webinar, HIPAA for Allied Health Professionals, presented by Kim Cavitt, AuD.
Learning Outcomes
After this course, participants will be able to:
- List the main components of HIPAA.
- List the 18 pieces of protected health information.
- Identify specifics of the Privacy Rule and explain how it applies to texting, email, and marketing in a healthcare setting.
Components of HIPAA
HIPAA was a bipartisan piece of legislation in the Clinton administration. HIPAA stands for the Health Insurance Accountability and Portability Act of 1996. The main website for HIPAA information is https://www.hhs.gov/hipaa/, but you will see specific links in this presentation (copy and paste them into your browser) that will direct you to additional information typically from Health and Human Services in the Office of Civil Rights, specifically related to the government and HIPAA. As links often change, please search from the main website previously listed if the link doesn't work.
After 2013, HIPAA has civil and criminal penalties and addresses the following:
- Standard Transaction and Code Sets
- National Provider Identifier
- National Employer Identifier
- HIPAA 5010
- Security
- HITECH (Breach Notification)
- Privacy
- Marketing
- Business Associates
The first thing to think about regarding HIPAA is, are you a covered entity under HIPAA? A general rule of thumb is if you transmit any information electronically, then you are subject to HIPAA rules. You are a covered entity anytime you're submitting a claim to a third-party entity or submitting health information or medical records to a third party.
Standard Transaction and Code Sets
Let's start with standard transaction code sets. HIPAA requires that all covered entities use standard transaction and code sets such as CPT (Current Procedural Terminology), ICD 10 (International Classification of Diseases, 10th revision), or HCPCS (Healthcare Common Procedure Coding System), which are the codes for hardware and the services surrounding the hardware or the pharmaceutical (or that type of entity). These are the code sets that you're supposed to follow.
National Provider Identifier (NPI)
Your national provider identifier (NPI) is your unique personal identification number that is now going to follow you for your entire career. That is given out by the national plan and provider enumeration system, or NPPES. You can go to their website at https://nppes.cms.hhs.gov/#/ to get an NPI or look up an NPI, especially if you need it to go out on a claim. Just like the NPI, this number moves with a provider from employer to employer throughout their career. If you submit the information correctly the first time, a new NPI number is usually generated in one to three hours.
National Employer Identifier
The next item is the national employer identifier (EIN). The EIN is a unique number that's assigned to your business by the Internal Revenue Service. It's oftentimes also known as your tax identification number. Every business has an EIN except for businesses that are sole proprietors, where the business is operating under the social security number of the owner. Your practice or organization needs an organizational NPI. Remember, the NPI is going to be given out by the NPPES system and the EIN is going to be given out by the IRS.
HIPAA 5010
HIPAA 5010 was a systems update that went into effect in 2012. This change allowed for the additional characters of ICD 10 and really affected office management systems, electronic health record systems, electronic medical record systems, software vendors, and clearinghouses. Also, this is where they made the switch from working in a CMS 1500 format, where the electronic format mirrored the form, to working in a format now that's called an 837P format.
The 837 claims submission format was set forth by HIPAA 5010. You should ask your office management vendor or electronic health system (EMR) vendor how your system operates. Many systems, except for certified EHRs, still operate in a 1500 format. Your clearinghouse is doing the conversion to the 837 format. The CMS 1500 format is everything around the paper form that's read, including its electronic version. If your system operates in the 1500 format, or you're still using paper, everything is going to be converted to an 837, either at your clearinghouse or the payer.
Protected Health Information (PHI)
Let's talk about the 18 pieces of protected health information. All 18 pieces are equally protected. That means that they cannot be shared without the patient's authorization except for three exceptions, which we'll talk about in a moment.
- Names
- Street number and name, city, and last two digits of the zip code
- Dates directly related to the individual (birthdate)
- Phone number
- Fax number
- Email address
- Social security number
- Medical record number
- Health insurance member number
- Account numbers
- Certificate or license numbers
- Vehicle identifiers and serial numbers
- Device identifiers and serial numbers
- URLs
- IP addresses
- Biometric indicators
- Finger, retinal, and voiceprints
- Photos
- Any unique identifying number, characteristic or code
Someone's first and last names are protected. In my case, Kimberly Cavitt is a piece of protected health information. Your street number, name, city, and last two digits of your zip code are protected. For example, 2480 State St., Chicago, 60 is protected. Any dates directly related to the individual, such as a birthday, are protected. Your phone number, whether cell or landline, and your fax number are protected. Your email address and social security number are also PHI. I want to really reiterate here that someone's name is equally protected as their social security number. Your medical record number, health insurance member number, account number, certificate or license number, and vehicle identifiers or serial numbers are protected as well.
Any device identifiers or serial numbers are included as PHI. If your patient has hardware, such as a hearing aid or an augmentative communication device, that has a serial number and that number is uniquely assigned to that patient, that serial number is protected. In addition, URLs, IP addresses, and biomedical indicators including finger, retinal, and voiceprints are protected. I cannot stress enough that a patient's image is protected. Before you put a video with a patient on social media, you really need to make sure that you get the patient's authorization to use their image. Again, any unique identifier number, characteristic, or code is also protected.
HIPAA Security Rule
The Security Rule is an extension of the Privacy Policy and went into effect on April 20, 2005. HIPAA security is about protecting the electronic formats that are controlling patient information. Electronic patient health information is called ePHI. HIPAA security is around ePHI and everything that you store. When it comes to security, you have to think about everything in your office that stores or transmits patient information. Providers need to have administrative safeguards, physical safeguards, and technical safeguards. You also need written policies and procedures related to these security provisions. In addition, you need to document how people have been trained and what your audit and sanction processes are in your security policies. We're going to break this down a little bit.
Risk Assessment
The first thing you need to do is a risk assessment. What do allied health professionals need to think about when they're thinking about HIPAA? You need to think about computers, phones, tablets, fax machines, and answering machines. Remember, a patient's voice and any protected health information they've shared on an answering machine are protected and you need to go through a risk assessment on it. Also think about any test equipment that stores or transmits ePHI as well as your EHR, EMR, and OMS vendors because they have access to your information. While NOAH is unique to audiology, it would also be included in this list. You need policies around anything that is storing or transmitting information and how that information is being protected.
Administrative Safeguards
The first step is administrative safeguards. What do you have in place to reduce the risk of breaches of protected health information that is stored electronically? What policies and procedures do you have? Every practice needs a security officer. You need to know who is responsible for the securitization of this ePHI. If we are talking about a hospital or large clinic, you probably have a security officer that is the head of IT or the CIO at your entity or facility. Those of you in private practice or nonprofit, you are going to need to assign someone as your security officer. If you have a practice manager in a bigger entity, they or the executive director of a nonprofit would be your security officer. If it's an ownership of a private practice, it's typically the owner that is the security officer.
All the security officers and every facility need to regulate who has access to protected health information and by what means. For example, what equipment can they access PHI on? Can they use personal devices or access the PHI at home? Can every employee access it or do some folks have more access than others? It's all about minimally necessary access. You need to look at each one of your staff members and determine for that position, how, where, and when can they access electronic protected health information. You need training and accountability. You should authorize and document either by individual name or by position who has access to ePHI including where, when, and how. You need to train staff on these policies and procedures once they're created. Audit your staff to make sure you're following the policies and sanction staff who do not comply. That sanction has to be documented. I strongly recommend that you have a process of sanctioning that's outlined in your HR materials including employee manuals. It can include firing or termination.
Physical Safeguards
Physical safeguards are about the actual hardware that is storing and transmitting things. You have to limit access and control to that hardware. Think about who can have access to the equipment, when, and how. Are laptops and other hardware locked down? How can people move laptops or personal devices from location to location? Can they take them home? You need to have facility access and control over any hardware that stores and transmits EHR. You should have workstation and device security, including proper use of electronic devices and workstations. Ensure that you have policies and procedures related to the transfer, removal, disposal, and reuse of both ePHI and the hardware that is storing ePHI. How do you get rid of a laptop? How do you get rid of a personal device that has access to ePHI? You have to have this all documented for your practice.
Technical Safeguards
Technical safeguards include how we control access to the software. That is typically through password protection or authentication. How are you gaining access from a software perspective to systems that hold ePHI? One thing that a lot of entities are looking into is two-step authentication so information is not just password protected. There's a second step of authentication. You're going to need to audit and determine how you are going to take your policies and make sure your staff is following them. You have to audit how your policies are being followed. Be sure that whatever electronic system you are using to store or transmit ePHI does not allow things to be improperly altered or destroyed.
If you are using a notation system for your notes, you need to have a system that doesn't allow those notes to be permanently deleted. Certified type systems, like if you had a certified EHR, will let you hide things that you've amended, appended, or modified, but they never can be deleted. They can never permanently go away. It's something that you can always see and pull up if need be. You should never be operating in any form of an electronic patient management system that lets you delete information. I know I'm saying this repetitively in a lot of different ways, but it's really important. You should never be working in a system where you're just putting notes, for example, in Notes on an Apple device or in Word or in Excel and then you can just delete it and wipe it. You have to be able to be in a system that cannot be altered. Then you need to put in place all of the software around transmission security so that you can reduce the risk of being hacked.
Mobile Devices and HIPAA Security
HIPAA has a lot of implications and things you have to consider around using mobile devices. I'm going to consider mobile devices for us today to be a laptop, a tablet, a phone, or a smartwatch. We have to be very cognizant of all of the rules around these mobile devices.
Every practice needs to consider if they want to allow, by policy, their staff to access ePHI on mobile devices that the facility or practice does not own? That's your first decision. If you do allow that, then you need to make policies around those two separate pathways. Many entities that work in large medical facilities would never allow people to access ePHI on a personal device. They have a lot of rules around that and you have to log into a portal to be able to do anything using multi-step authentication. You have to determine what the rules are for your practice. Let's say you are allowing access to ePHI on a mobile device. You need to make sure that you use a password or user authentication. There have to be steps to be able to open the device itself before getting into the software. The first step is having to use a password to get into the laptop or other device.
You need to enable and install encryption. We should not be communicating any ePHI to any entity, including the patient, without going through an encrypted service. You can communicate with the patient about an appointment. You can communicate with the patient about services they need, such as a COVID test, what your policies are, or reminders. But you cannot communicate any ePHI, any test results, or anything specific to that patient without going through an encrypted service.
Install and activate remote wiping and/or remote disabling. I am an Apple person, so that's what I'm going to give an example of. Essentially, that's where you find your iPhone and you kill your iPhone remotely. At any point in time, you can go to a third-party site and literally make that device a brick so that it doesn't actually function anymore. That's what you need to be able to do. If you have a device that is transmitting or storing ePHI, you need to be able to remotely shut that device down and remotely wipe it.
Disable and do not install or use file-sharing applications, such as Dropbox that multiple people, including people outside your facility, can access or utilize. This is especially important in your home or other location. You don't want to use file sharing when you're communicating about ePHI. The entity that might be file sharing with you may not be allowed access to that ePHI. The rule of thumb is to turn off all file sharing unless you're keeping everything internal-only in your practice.
Install and enable a firewall as well as security software, such as Norton or another protection software. Keep your software up to date. When your service vendor provides a software update, whether that's Microsoft, Android, or Apple with an iOS update, make sure you download it and keep your software updated. Many times the iOS updates are around bugs and security fixes. That's why you always want to keep that up-to-date and current.
Maintain physical control. If you have a device that you're traveling with that stores or transmits ePHI, you want to make sure you keep that device on your person as much as possible. If you are doing work and accessing ePHI, you should not be on a public Wi-Fi network, whether that's at the library, Starbucks, or in your own hospital. You should never be doing report writing or communicating with your patients or anything that involves protected health information on a public unsecured network. Make sure that before you recycle a laptop, a tablet, your watch, or a phone you have completely wiped that device. Delete everything off the device before it's either recycled or destroyed.
Telehealth and HIPAA Security
Medicare defines telehealth as "the use of electronic information and telecommunications technologies to support and promote long-distance clinical health care, patient and professional health-related education, public health and health administration. Technologies include videoconferencing, the internet, store-and-forward imaging, streaming media, and terrestrial and wireless communications.” Store-and-forward means that it is recorded and stored, and then it is forwarded to another entity. Store-and-forward is asynchronous because it's not happening in real-time. That's an important distinction because many health insurers don't pay for asynchronous telehealth. Telehealth can include streaming media and terrestrial and wireless communications such as online, telephone, and video. Synchronous is real-time telehealth. Asynchronous is typically store-and-forward where it's not happening in unison.
Before they begin providing telehealth, allied health professionals have to ensure that their transition systems meet all the HIPAA security requirements and that they are able to maintain the confidentiality, integrity, and availability of ePHI that they create, retain, maintain, or transmit. You are responsible for making sure that the transmission from your end is secure. You cannot control the patient end. If it is with your facility, whether from you to the patient, a technician that might be with a patient, or a student, or somebody at another location that works for you, you are responsible for controlling the security of those transmissions. The only transmission you are not responsible for is if the patient is doing telehealth in their home or office and the transmission back to you.
As a general rule of thumb, we cannot use FaceTime, TikTok, Facebook Live, Messenger, Google Hangouts, Twitch, SMS, Skype, Zoom, or unencrypted email (to store or forward) for telehealth. When I say all of these things, I'm talking about software that is free, such as the free versions of Skype and Zoom. Skype and Zoom also have healthcare versions. I'm talking about their free versions of things or any unencrypted email for telehealth. That is the general non-COVID rule of thumb. As I mentioned before, you can buy paid services through Skype and Zoom that are HIPAA compliant. Those free versions, as a rule of thumb, are not allowed for telehealth because of HIPAA security provisions. There have been COVID allowances that will expire when the public health emergency expires. So if in your state your public health emergency has already expired, a lot of those provisions have already expired.
At the time this course was created, the federal government, which is the main controller of HIPAA, has not gotten rid of the public health emergency yet. When they do, those HIPAA allowances will go away. The HIPAA allowances for COVID included allowing FaceTime, Messenger, Google Hangouts, Zoom, and Skype. As a general rule of thumb, those are not allowed under the HIPAA compliance provisions. I recommend to people before they get into telehealth that they hire an IT consultant to make sure that their transmissions are secured. Have someone help you set up a program at the outset to make sure you're going to meet all these HIPAA security provisions.
Business Associates
A business associate is a person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involves the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing.
To break this down, a business associate is someone that you are sharing protected health information with during the processing of your business. For example, you might share PHI with a vendor if you are ordering a product for the patient. The patient gave you their information as a covered entity and now you are giving it to a third party. That third party is a business associate. You as a provider are responsible for your business associates securing your patients' health information. Every practice needs to have a business associate agreement between themselves, one that you and your practice generate, and the business associate, the entity that you are sending protected health information to.
This needs to be supplied by you, not the vendor. Many vendors may want you to sign their business associate agreement, but that means that they're the covered entity, and it's going to all be adjudicated in their state. You are the covered entity who has gotten the information from the patient. They should be completing your business associate agreement. Some common business associates include medical device manufacturers and vendors, such as those who manufacture or sell hearing aids, augmentative communication systems, or compression equipment for patients. Other business associates are your accountant if they have access to ePHI through your QuickBooks or your attorney because you're transmitting information to them. Your EHR, EMR, or OMS (office management system) vendors are also business associates.
Your clearinghouse, the entity between your computer and the computer of the payer, also needs a business associate agreement since you're giving them ePHI. So does your cloud services provider, because they again are storing your information, and any IT consultants you may hire that you're bringing in and giving access to your systems. If you were in a buying or management or cooperative group where you're sharing information with a business development team, they need to sign a business associate agreement, because they're typically able to access your systems. You can see a sample business associate agreement when you go to the HHS.gov website that can be customized to a degree.
Hitech-Breach Notification
The HITECH-Breach notification applies to both paper medical records and electronic medical records. It addresses how to handle a breach, which is an impermissible or unauthorized use or disclosure of PHI. This is a good time to give you my general rule of thumb about HIPAA. You want to do unto others as you want to be done unto you. We are all HIPAA consumers and we are all someone's patient. Before you do an action, you want to think about what you would want someone to do for you. I really want to bring this up as we talk about a breach. If someone lost your medical record or sent your information to the wrong person, what would you want to be done for you? The government requires you to do a risk assessment if you believe that there is a breach. The risk assessment is taking a look at what the risk is of this ePHI or PHI being used for illicit or nefarious purposes.
I'm going to give you a few examples. Let's say you were going to fax or email a report to a physician and you sent the report or patient information to the wrong physician's office, either by email, mail, or fax. In this case, I would consider it low risk. You are sending information to another entity, which is also a HIPAA compliant entity. I would think the risk of that information being used for illicit or nefarious purposes would be very low. In this case, you would contact the physician's office that you sent it to incorrectly and request that they destroy it by whatever means, either deleting the email or shredding the fax or mailed copy. Then you would go into the affected patient's medical record and document that breach. Next, you need to go to the portal at this link. Here you will document the breach including what occurred and that it was a low-risk breach. You have to document all of your breaches.
Now let's look at another situation. You emailed or mailed a report to the wrong patient. You sent information or documents from a patient's medical records and put them in the wrong envelope or sent it to the wrong email address. In this case, you don't know the end entity and what they could use that information for. In that case, I would consider it a moderate to high risk and you should notify the patient. You have 60 days from the date of a breach to notify a patient of that breach and you have the burden of proof to show that you notified them. You want to notify them in a way that you can prove receipt. If you can do that by email and you have systems that you feel like you can prove receipt, you could do it by that mechanism. Lots of folks do it by certified mail because they can prove that the person signed for it and received it. If business associates have a breach, they have the burden of proof to tell you, but you have to notify the individual within 60 days of the breach. You also then need to give them identity theft protection. The standard in the industry is for you to give them a year of identity theft protection.
Let me give you another example. Let's say you are still working with paper charts and records and you lose a paper chart. I can tell you from my experience of being in this industry for a while, that's actually where I've seen some of the biggest HIPAA problems and things being used illicitly. Someone stole a paper chart and then tried to take on that person's identity. I've seen that more with paper records, but I've also seen that with electronic records on small, singular breaches. I recommend that you try to find the lost chart. If you don't, consider that a high or moderate breach and notify that patient accordingly.
Let's say someone hacks into your system. Many of you may have gotten a letter in the mail from a health system saying that someone breached their systems. If someone hacks into your system, and it's a large breach of over 500 people, you have to notify your local media and health and human services. That large breach is absolutely something you have to report in the portal. Any breach, no matter the size or if it's at low risk, needs to be reported in the portal at the link I provided earlier. Big breaches must immediately be reported to your local media, to health and human services, and then all the affected patients need to be contacted. Again, think about how you would want someone to treat you.
Privacy Rule
The privacy rule is really the hallmark of HIPAA. This was the first thing created, and it is the meat and bones of HIPAA. All of the other things are equally important, but this is the one that really affects us the most in daily practice. It protects both electronic and paper formats and was first set forth in 2003 and later updated in 2013. We should expect an update to HIPAA in 2023 from the government. Every time the government makes an update, we typically have to make updates to our notice of privacy practices in all our forms, documents, processes, and procedures. Everyone needs to be prepared that there could be an update in 2023.
HIPAA privacy protects "individually identifiable health information" including demographic data. In a nutshell, it's everything that's in your medical record. Everything that's stored either by paper or electronically in a patient's medical record is subject to HIPAA privacy. Everything that's there, even things from other providers is still covered under the HIPAA privacy umbrella. This includes an individual's past, present, and future physical and mental health or conditions, the provision of their healthcare, their past or future payments, all payment information, and any of those 18 pieces of individually identifiable health information. All of that is protected under HIPAA privacy. It's the 18 pieces plus all of their records, chart notes, test results, inventories, inquiries, and invoices that the patient has access to and is protected under privacy.
Notice of Privacy Practices
Every practice needs to have a notice of privacy practices. These are your practice's rules and policies around the privacy policy and protecting health information. You can find a template on the health and human services website. You have to have the patient sign an acknowledgment of the receipt of your privacy policy. Most patients will never read it, but you have to be able to give them the opportunity to read it if they so choose. Most big healthcare systems are constantly changing their privacy policies and updating privacy officers so they typically have people sign it every visit. There is no requirement to have people sign at every visit. The requirement is that any time you make any change at all, whether it's a word, letter, or you make something plural, you have to have the patient sign a new acknowledgment and all changes need to be dated. You always need to have the date on your privacy policy reflect the last time it was changed. Acknowledgments need to be replaced every time you change your privacy policy, even if all you did was change your privacy officer, all your privacy policies need to be updated.
If your privacy policy is dated prior to 2013, it isn't valid. That should have been updated with 2013 information. If your acknowledgment was signed prior to 2013, it's not valid. You need a new, signed acknowledgment. The notice must be readily available to your patients so you must prominently post it in your office and you must have copies available if the patient wants a copy of your privacy policy. In the practice I used to run, we had a supply of printed copies for patients who requested a copy of the policy. We could just hand it to them. Some people have posters in their offices and others have a brochure of it that is in a brochure holder. Some people have it bound in a booklet that sits in their lobbies and exam rooms. You just have to make it prominently available. The biggest way you make it prominent is to put it on your website. Everyone's website needs to have their notice of privacy practices on the site. You have to make a good-faith effort to get the acknowledgment of the notice of privacy practices signed. If that cannot be obtained or the patient refuses, you need to document that in the patient's medical record. You have to document what happened and why you didn't get it signed. It's very important that that documentation exists.
Transfer From Paper to Electronic Records
Some people ask me all the time, what happens when I transfer records from paper to electronic? The first thing you have to do is always consult your state's medical record retention laws. HIPAA's requirements are to retain records for six years. But many states have rules that exceed that. You need to know what your individual state or territory's medical record retention policies are. My next question is, was it a one-to-one transfer? What that means is, was every piece of paper in the paper file transferred over and scanned in electronically? If the answer is yes, you can properly destroy the paper file. If the answer is no, you need to retain the paper record through the state medical record retention policies.
Disclosures that Do Not Require Authorization
There are three times that you can disclose protected health information without the patient's written authorization. They are for treatment, payment, or health care operations. Let's take a closer look at each of these.
You can disclose PHI without the patient's written authorization if you are communicating with the ordering and referring physician or the physician or healthcare practitioner you're referring to because that's all-around coordination of care. I am always going to tell you to err on the side of being conservative. Here's an example. A physician referred a patient to your practice. You could send results back to that physician and not need the patient's authorization to do so. But let's say a different physician reaches out to you and wants a copy of the patient's records. You should get authorization from the patient to send to that new entity or to transfer your records to another provider. You should get authorization from the patient. Let's say a school system reaches out to you. I would not send results to a school without the patient's authorization.
You do not need a patient's authorization to send claims to their insurance company. It's important to note that patients can restrict disclosures to their insurance company and waive their insurance benefits if they want. Health care operations generally include anything around your business. This could be administrative, financial, legal, and quality improvement activities of a covered entity that are necessary to run its business. Remember, you're going to have business associates' agreements with your accountant and your attorney, things regarding accreditation, and insurance or other audits and you do not need the patient's authorization. You can disclose information that's in your medical record that was provided by another provider because it's now part of your record.
Privacy Rule Specifics
Regarding the privacy rule, there are several specific things you need to do. You need to keep disclosures to the minimum necessary. You need to have a privacy officer. I would have that privacy officer be consistent with what I had spoken of about the security officer. It could be the practice administrator, executive director, owner, or manager. All your staff needs to be trained on privacy. This includes all new hires within 90 days of hiring and all of your staff that should be trained annually on privacy. This course can be used for that purpose. You must have a complaint process that is clearly documented on your notice of privacy practices. That is complaining both to you, the practice, through your privacy officer, and directly through health and human services or the office of civil rights.
You must have record safeguards for the storage, disposal, and access of protected health information. You can think back to some of the security provisions, but think about how would you secure things for paper? How is your paper stored? It doesn't have to be locked if it's got a staff member in front of it all the time. If not, is it locked up? Is it somewhere behind a secure door when your business is closed? Think about how those things are stored and secured. How are you going to destroy them? HIPAA records have to be kept for six years from the last encounter with the patient. Remember, state record retention policies really vary and they vary a lot around children so you want to be very aware of what those are.
I'll give a disposal example. I was always taught that if you're going to dispose of medical records, you pulverize them. When I had medical records in my office here in Chicago, I hired someone to come destroy them. I can account for what records I was having destroyed. They were scanned into a secured system. Mine was batched by dates and not by individual names, so I wouldn't have ePHI held in my system, but you could have it by individual records. Once the information was scanned in, I literally had it pulverized into dust and then that vendor gave me a receipt to show what had happened on which date. Then I scanned that in with the documents that I had destroyed. You should always keep a record of what was destroyed, when, why, and how.
Texting and Email
Again, ePHI should only be submitted through encrypted email service providers and text providers. Your practice needs a written policy and email and text need to be mentioned in your notice of privacy practices. Again, you need to have an email and text consent from your patients that you can communicate ePHI via text and email. Some patients may not want that. That's why you need to give them the opportunity to opt-in. I'm going to tell you the same for telehealth. You need to have a telehealth informed consent policy that states patients want to participate in telehealth systems.
Use and Disclosure
Use and disclosure is the HIPAA version of a medical release. Again, this includes who information can be disclosed to and what can be disclosed. It's a very specific HIPAA form. It allows the patient to list what they want to be disclosed and to whom. They can also restrict disclosures here if they don't want some information disclosed to certain parties.
Marketing
The Privacy Rule defines marketing as making a communication about a product or service that encourages the recipients of the communication to purchase or use the product or service. The HIPAA marketing provision only applies to a communication sent to your database. HIPAA is very clear that if a third party is paying in whole or in part for communication, then that becomes marketing, even if it's merely educational. It's really important that if you are going to communicate to your database, you pay for your own communications.
Testimonials
It's also important that you have the patient's acknowledgment if you are going to use testimonials in your marketing. You can't share ePHI in a testimonial, published review, or response review. You really shouldn't respond to negative reviews online without consulting your attorney and having them give you guidance on how you should best respond. You need a patient's authorization to use their image, their review, or their name. Your notice of privacy practices needs to outline your use of testimonials and reviews and all your staff needs to be trained on these policies and that training must be documented. One physical therapy practice had a pretty hefty HIPAA fine of about $25,000 over the inappropriate use of testimonials in their communications.
Marketing Versus Education
Let's talk about the difference between marketing and education. Marketing requires authorization. It is always going to be marketing if a third party is paying in whole or in part for the communication, if you're trying to get a patient to purchase an item or service, or if you're marketing a specific price, product, or promotion. That is marketing, and it requires authorization. Education is when you're just training people. That's when it's informational only. You don't talk about a specific product, price, brand name, or anything of that nature. You are talking about general healthcare topics or general information about your practice locations and staff. That's educational. That's allowed without authorization. But the minute you're trying to drive a purchase, whether it's the purchase of your services or purchase of a product, it becomes marketing. Again, HIPAA marketing provisions only apply when you're communicating to your database.
Marketing Authorization
There are two different types of marketing authorization. Let's say you want to market to your database. There are two different requirements based upon who's paying for the communication and if money is exchanging hands. You can have a short authorization that you get at intake. See the example of a short form below. The short form is used when there is no remuneration, in cash or in kind, and no money is exchanging hands in any form for products you market. If you are marketing something and paying for it yourself or marketing another product and they aren't giving you anything back in return, such as free training, a lease, a loan, or a trip, you can use the short form. Once you receive anything of that nature you need to disclose it on a long form marketing authorization.
Example of short form:
By initialing this section and signing below, I authorize Clinic A to send me educational and/or marketing information on the products and services offered by Clinic A. No remuneration is involved in this communication. I understand that I may revoke this authorization, in writing, at any time.
You need a long form the minute any money, in cash or in kind exchanges hands. You have to disclose to your patient what you got in return, and who paid for what. It is a very long form that you're going to need your attorney to help you create. I will tell you from experience that patients are not going to be excited to sign that form. It has a lot of perceptions of your practice. A great rule of thumb that I really want you to take away is if you want to market to your database, get a short form marketing authorization. You cannot market to them without authorization. Pay for every one of those communications and pay for everything around your business yourself. Don't let vendors pay for them.
Omnibus Rule
The Omnibus Rule was a change to HIPAA that became effective in 2013. It meant that business associates are responsible for notifying you of breaches. That includes business associates and their contractors and subcontractors. If you store protected health information electronically, the patient has the right to access it and receive it electronically. They have the right to request that you send a copy of their electronic medical record, often as a PDF, to them through secured encrypted systems. They have the right to restrict disclosures to their insurance company and waive their insurance benefits so that you are not sending any information to them. You will need a specific insurance waiver form.
Marketing has been redefined as any patient communication where a third party is paying for that communication in whole or in part. Even if it's educational it's deemed marketing and you have to go through the marketing provisions. You can't sell protected health information. There must be a defined breach notification process where any breach, even a minor one, has to go through a risk assessment process and be documented, both in the patient's record and to the government.
Omnibus allows for broader uses of ePHI for fundraising and research. Again, in those situations, I would have your attorney involved to help define it for you and your situation because sometimes state laws can come into play. Finally, the penalties for HIPAA got bigger because people were just saying, well, I'll just pay the fine. Now they've made the fine up to $1.5 million per calendar year, and now you can go to jail because they have criminalized HIPAA provisions.
HIPAA and Social Media
Remember, don't disclose any ePHI on any form of social media format. This includes sites such as Facebook, Twitter, LinkedIn, Instagram, Yelp, Google, etc. This includes, but isn't limited to, responding to reviews. Responding to a review confirms the patient was seen in your practice and could be deemed a privacy violation. Always start by contacting that patient who gave you the review directly and not in a public forum. If you've worked it out, ask them if they'll remove their review. Before you post anything on social media around a patient, ask your attorney because this is a complaint-driven process. You want to make sure that you know how this should legally be handled before you start responding online, posting testimonials, patient pictures, or patients' test results for feedback. Remember, patients' test results are protected. You can't just post it on social media to get feedback from your colleagues without the authorization of the patient.
Examples of HIPAA Violations
Here are some examples of HIPAA violations within healthcare.
Physical Therapy:
Complete P.T., Pool & Land Physical Therapy, Inc. has agreed to settle violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rules with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). Complete P.T. is a physical therapy practice located in the Los Angeles area. The settlement agreement is an admission of civil liability by Complete P.T., requiring payment of $25,000, adoption and implementation of a corrective action plan, and annual reporting of compliance efforts for a one-year period. On August 8, 2012, OCR received a complaint alleging that Complete P.T. had impermissibly disclosed numerous individuals’ protected health information (PHI), when it posted patient testimonials, including full names and full-face photographic images, to its website without obtaining valid, HIPAA-compliant authorizations. OCR’s investigation revealed that Complete P.T.:
▪Failed to reasonably safeguard PHI;
▪Impermissibly disclosed PHI without authorization; and
▪Failed to implement policies and procedures with respect to PHI that were designed to comply with HIPAA’s requirements with regard to authorization”.
▪https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/complete-pt/index.html
Respiratory Therapy:
"A former respiratory therapist has been convicted on criminal HIPAA violations by a federal jury in Ohio. The jury agreed with prosecutors that the protected health information of patients was wrongly obtained and that PHI was used to seek and obtain intravenous prescription drugs. Jamie Knapp was employed as a respiratory therapist at the ProMedica Bay Park Hospital in Oregon, Ohio. Over a period of 10 months, Knapp improperly accessed the medical records of 596 patients. Knapp was permitted access to patient records in order to conduct her work duties; however, she was only permitted access to the records of patients she was treating. Knapp abused her access rights and viewed the PHI of other patients without authorization, according to the prosecution.”
▪https://www.hipaajournal.com/respiratory-therapist-convicted-criminal-hipaa-violations-3486/
Additional examples:
- https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
- https://etactics.com/blog/social-media-hipaa-violations
- https://www.hipaajournal.com/hipaa-violation-cases/
- https://healthitsecurity.com/news/ocr-settles-with-dental-provider-for-potential-hipaa-violation-on-yelp
- https://assets.hcca-info.org/Portals/0/PDFs/Resources/Rpt_Privacy/2016/rpp0716.pdf
Resources
Here are some professional resources from your associations. If your profession isn't listed here, it's because they don't have specific HIPAA guidelines or those HIPAA guidelines were behind a member-only firewall that I could not access. If you are a member of a national association in your profession, see if that association has HIPAA provisions that can help guide you specifically to your profession.
- American Physical Therapy Association: https://www.apta.org/your-practice/compliance/hipaa
- American Speech-Language-Hearing Association: https://www.asha.org/practice/reimbursement/hipaa/privacy/
- National Association of Social Workers: https://www.socialworkers.org/About/Legal/HIPAA-Help
Citation
Cavitt, K. (2022). HIPAA for allied health professionals. AudiologyOnline, Article 28262. Available at http://www.audiologyonline.com
May 13, 2022
1 CE CreditFERPA: Family Educational Rights and Privacy Act
PJ Winters, EdD
Editor’s note: This text-based course is a transcript of the webinar, FERPA: Family Educational Rights and Privacy Act, presented by PJ Winters, EdD.
Learning Outcomes
After this course, participants will be able to:
- Identify the rights described in FERPA.
- List key components to the complaint process of FERPA.
- List ways this law relates to their practice when working with schools.
Introduction
I appreciate the opportunity to share with you the Family Educational Rights and Privacy Act (FERPA). It is important not only for educators but for people that work in public schools to understand how the law relates to what they do in their everyday practice. I always tell people working for schools to follow the policies and procedures of their school district. However, it helps if you know the law as it helps you ask better questions as a practitioner, especially if you hear something that you think might be a violation of FERPA. You will want to bring that forward to someone so that you can protect yourself and the school from complaints through the FERPA process.
Presenter Information
- Dr. PJ Winters
- 21 years in education in Oklahoma and Texas, P-16.
- Currently Director of M.Ed. Programs and Associate Professor at East Texas Baptist University in Marshall, TX.
- DISCLAIMER! I am not an attorney. I am an informed educator who teaches this material to graduate students. This training is not meant as a substitute for legal advice.
This is some information about me. I am not an attorney. I am an informed educator that teaches this material to graduate students. This talk is not meant as a substitute for legal advice. This is simply how I interpret the law as it relates to educational records and record keeping.
What is FERPA?
- Federal law passed in 1974
- FERPA protects student records
- Gives parents and eventually, students (eligible students) access to educational records
- Students become eligible at their 18th birthday when the transfer of the rights to them
This is the big question that we are going to try to answer today. Why do we need such a law at the federal level? Back in the 1800s, schools started keeping registers of enrollment and attendance for students. At that time, the educational record was born. This educational record accumulates information from the time the child enters school until they are no longer involved in the educational system.
According to some people, it can destroy the people that it was meant to protect. This record was created to be efficient, but there are times when this process becomes quite inefficient. We live in an age where we want access to information quickly and can do so with smartphones and computers. To be honest, snooping in our society has become the norm. People seek out information about people, even those they do not know. Open TikTok if you do not believe me. Many TikTok videos show people who they feel have wronged them. This is the current culture. This makes protecting students' records just as important now as it was back in 1974 when this federal law was passed.
In the seventies, you could see a personal record if you were official-looking or flashed a badge. If the school secretary believed that a person was part of a government process, they could most likely get access to whatever record they wanted, including things like psychiatric evaluations and medical records. And, it was unlikely that parent or student would even know that this information was being shared. In addition, a parent might be refused access to all of that information due to confidentiality. "No, that is confidential and for the use of the school only." Decisions were being made without parents' permission, and parents also had no access to the information. An example might be a father learning during a routine parent-teacher conference that the teacher commented that his son was interested in girls. We would look at that today and say, "That's not pertinent to his education." However, back then, there was not a lot that we could do to remove that type of information from the record.
The author of FERPA served on the New York City Board of Education's Committee to revise student records. He cited several things as to why FERPA was necessary. These are readily available for you to read. I am going to go through some real-life examples. A secretary at a private tutoring agency called a public junior high school to inquire about a child's reading level. The principal opened the child's record and gratuitously informed the unseen caller that the child had a history of bedwetting. In addition, the mother was an alcoholic, and a different man slept at the home every night. When the disclosures were reported to the Board of Education, the principal denied the incident even happened, and his superiors backed him up. This obviously was an invasion of privacy. Another example was a teacher getting a summary of a student's past academic year with comments such as frequently absent, truant, stubborn, very dull, verbal only about outside topics, states irrelevant facts, can barely read, a huge accomplishment to get this far, etc. As a former principal, these comments shock me. Lastly, there was a Black father who worked for a school system. He had a teacher show him his bright daughter's confidential record. In that record, there was a critique of how his own community activities as a "Black militant" were "causing his daughter to be too challenging in class."
This is the behavior that FERPA was meant to curb; showing records to people that did not really have an educational need to know and people putting down biased opinions about other people in an official record. The Family Educational Rights and Privacy Act is a Federal law that protects the privacy of student educational records. This went into effect in 1974 and applied to public and private schools that received any funds from the U.S. Department of Education. This includes, but is not limited to, public school districts, local school districts, charter schools, and higher education institutions.
It is designed to protect these records from people who do not have an educational need to know and gives parents and eligible students, the right to control who sees what is in their educational records. Parents get control of this until the child's 18th birthday. At that point, the rights are "mostly" transferred to the child. I put in that caveat because if the 18-year old is still carried on a tax return as a dependent, parents can access some of that information. As a worker in higher education, we deal with students over 18 all of the time. As long as the 18-year old has given a parent permission, we share that information with parents.
What Rights Do They Have?
- Right to inspect and review records maintained by the school
- Right to request a school correct records they believe are incorrect
- Right to give permission before schools disclose some information about the student
What rights do the parents have? First, they have the right to inspect and review records maintained by the school. This includes grades, testing, and anecdotal notes. It could be in the official school record or a record that a teacher or therapist keeps on the child. It is important that when a record is going to be kept, we use only facts and not any disparaging opinions. Obviously, as a professional, you will have some opinion based on your assessment, but it should be based on data and not simply your gut feelings about things. It also should not include inflammatory language that is going to cause parents to raise a stink.
These rights apply to both custodial and non-custodial parents unless a court has ordered that the non-custodial parents do not have these rights. The school must have a court order on file. For example, when I was a principal, I had to copy a student's report card every six weeks and send it to her father in North Carolina because he wanted to see it. We will talk about the copying issue later because the law says, "Review and inspect." It does not use the word copy. However, he was the non-custodial parent and had rights to every single educational record that that school kept on file on his child.
Parents have the right to request a correction or amendment to the educational record that he or she believes is incorrect, misleading, or violates the right of privacy. Generally, though, a FERPA amendment process is not used to do things like challenging a grade, a disciplinary decision, or any other substantive decision made by a school official. Those things can be handled locally with local school districts and parents. This does not go through the FERPA process. They have no interest in determining whether your child needed an A or a B in a class. The school has the right to refuse to make the change because the law says that the parent only has the right to request the change. If the school decides not to make the change, then the school must inform the parent or eligible student of their right to a formal hearing on the matter. The parents or students are allowed to have representation by their attorney at their own expense at the hearing. They must be provided with the opportunity to present evidence at the hearing. The hearing's decision must be written and based solely on the evidence presented. Even after the hearing, the parent's request for amendment of the record could be denied. If that is the case, the parent or eligible student has a right to include a statement in the record why they believe that information contained in the education record is incorrect, misleading, or violates their right to privacy. They could even write a statement that says why they disagree with the hearing decision or both. Even if a parent is denied the right to have it officially changed, they can still have their voice/statement put in that record not to be removed for as long as that record exists.
It is also important to note that under FERPA, a school is not generally required to maintain a particular education record or records that contain specific information. They are only required to provide the privacy protections for the education records that they do maintain. Unless there is an outstanding request by an eligible student to inspect and review education records, FERPA does permit the school to destroy records without notifying the student.
Right to Inspect and Review Records
- These are records maintained by the school. They could include:
- Grades
- Transcripts
- Class lists
- Course schedules
- Health records
- Financial records
- Discipline files
- Supplementary service records
- Schools are not required to provide copies of the records for inspection.
- Must provide for inspection within 45 days of receipt of the request
I have listed a few things that are part of FERPA, things like grades/report cards. Grades are recorded on the permanent record. There are also transcripts from any school that the student has attended. Class lists often include the names of other students. We will talk about this a little later. This class list is considered directory information. This may be eligible to be released under FERPA. Parents have the right to know what classes their child is going to and when. Health records like visits to the nurse or outside educational evaluations like with a psychiatrist are also included. Financial records are usually things like financial aid, mostly at the higher education level. We do not see a lot of financial records in public schools. Disciplinary files are also included. Lastly, supplementary service records fall under FERPA, including records from social work, counselors, occupational therapy, et cetera.
FERPA does not require schools to provide an eligible student with access to academic calendars, course syllabus, or general notices and announcements. There is no need for them to retain that type of information in the educational record. Note that under FERPA, schools are not required to provide information that is not maintained, nor is it required to create an educational record in response to an eligible student's request. For example, they are not required to provide a student with updates on their progress in a course unless that report already exists. So, those midterm progress reports that parents often get are not required for the school to maintain. However, if they maintain it, it then becomes part of the record.
Education records may include things like date and place of birth, parents and/or guardian addresses, and where parents can be contacted in case of an emergency. Special education records are also a part of that. Schools must provide the records for inspection within 45 days of the receipt of the request. Of course, we hope that the request is in writing to have a date/time stamp. They have 45 days from the date of this request. Again, many will want the information quickly, but the school has a month and a half to get that information for parents to be able to inspect it. In my experience, schools typically provide that information sooner. However, if a parent has been particularly demanding about something, I have seen schools take every day that they have. I am not saying they should, but it does happen.
FERPA Does Not Include
- School employee records
- Teacher personal records
- Law enforcement records (mostly)
FERPA does not include school employee records. I said earlier that records that the teacher maintains could be considered releasable under FERPA. However, if the teacher is taking anecdotal notes about students in the classroom or having some of these types of notes as a therapist, this is not a part of the educational record and will not be included.
If the school initiates a law enforcement investigation and retains that record at the school, it is covered under FERPA. But if law enforcement comes to the school and they create the record, they do not have to release that record. In this case, FERPA does not apply because that record does not become a part of the educational record.
Example: Little Sally Sue
- Little Sally Sue’s mom has requested that her daughter be evaluated for OT services. The district has you perform this evaluation, and during the IEP meeting, you let the team know that Little Sally Sue did not qualify for OT services. The parent decides that she will seek outside private testing for her daughter for a second opinion. She wants copies of all your testing documentation to take to the private company. Does the school have to provide this to her?
This is just a little scenario to talk through. Earlier, I said the law says, "Review and inspect." The law does not cover copying. There are several instances on the U.S. Department of Education's website where they state that schools are not required to provide copies to parents. This goes back to reasonableness. I do not know personally of a school that has refused to provide a copy because schools are in the business of helping students. Most people tend to have that mindset. The parent is trying to get help for their child. Most would be happy to provide this service, but the law says they are only required to let a parent/child look and inspect it. In this day of smartphones, parents could take pictures.
Records Correction
- Right to request correction of records they believe are inaccurate or misleading
- Schools can refuse if they disagree. The parent has a right to a hearing about the accuracy of the record.
- If the school prevails, the parent is allowed to add a notation to the record stating their disagreement
Under FERPA, a parent has the right to request that inaccurate or misleading information in his or her child's education records be amended. Again, the wording here is important, "The right to request." It does not say they have the right to have it changed. While a school is not required to amend it, the school is required to consider it. We already talked about what happens after we have the hearing. Even if the school prevails and you put a notation in the educational record, a complaint can be filed. We will talk about complaints in a little bit.
The complaint process may not be used to challenge a grade, an opinion, or a substantiative decision. I talked a little bit about opinions earlier. You need to make sure that the opinions you write and that will become part of the educational record are fact-based and that you are not using inflammatory language.
This is where records correction stands. A parent can request a record correction, but the school has the right to say no. Then, the next step is a complaint process.
Release of Records
- Generally, parents or eligible students must give permission before a school is allowed to give access to the student records. This permission must be in writing.
- There are some exceptions:
- School officials with a legitimate educational interest
- Other schools to which a student is transferring
- Officials auditing or evaluating the school/district
- Parties in connection with a student’s financial aid
- Organizations conducting studies on behalf of the school
- Accrediting organizations
- To comply with judicial order or subpoena
- Officials involved in the case of a health or safety emergency
- State and local authorities within a juvenile justice system
Under FERPA, a school may not generally disclose personally identifiable information from a minor student's education records to a third party unless that student's parent has provided written consent. There are some exceptions to that rule.
Under these exceptions, schools are permitted to disclose personally identifiable information without consent. One of the exceptions is school officials with a "legitimate educational interest." A legitimate educational interest means that you need this information to help make decisions about the student. For example, if I am a fourth-grade teacher or an occupational therapist and some information might be helpful while I am currently working with this student, then I would not have to go through the approval process to get that information. Access to that information is covered under FERPA. In contrast, if I am a fourth-grade teacher and want to check on a student I absolutely loved and worked hard to get them up to a grade-level performance, I cannot check their eighth-grade record. Out of curiosity, I cannot ask the eighth-grade counselor if I can review their records. I no longer have a legitimate educational interest. My heart might be in the right place, but this FERPA exception is not designed for people who just want to know because they want to know. The school will determine if there is a legitimate educational interest.
They often will make an exception and disclose personally identifiable information to another school in which the student seeks to enroll. For example, if a student is moving from one school to another, the sending school may make the disclosure that they will do that, but they do not have to notify the parents in advance. This is usually done annually, and we will talk more about this in the next topic. If the parent requests, the school must provide the parent with a copy of the records that they sent.
Directory information is defined as information in the educational record that would not generally be considered harmful or an invasion of privacy. The way the law is written says that directory information is probably not harmful. However, there is extensive personal information in there such as the student's name, email address, telephone number, date/place of birth, major field of study, participation in any officially recognized activities and sports, weight and height (members of athletic teams), dates that the student has attended the school, any degrees or awards received, grade level, and sometimes photographs. To release directory information, a school must provide notice to parents what information they are planning to release. This is not specific to each time they release directory information. There is usually a notice that comes at the beginning of the school year that says, "The school collects the following directory information and has the right to release those as they see fit." Parents have a right to opt-out of that, but it is usually an all-or-nothing deal. Parents can say, "No, you may not release any directory information of my child." Or, they can say, "Sure, that's fine." Parents do not realize that if they opt-out of directory information, that usually means that their child will be excluded from all things. For example, if the school is taking pictures of science fair winners for the local newspaper, their child will not be included. Additionally, their name must be omitted because they are not included in the release of directory information. Oftentimes, this means that the child is not going to appear in the school yearbook either. It can be a double-edged sword for parents on whether or not they want to release directory information. As an example, we fostered a child and adopted him. In the beginning, we did not want him included in directory information. When reminded that this would mean he would not appear in his school yearbook or any releases, we had to discuss that. Was his protection more important than his image being out for multiple people to see?
There are some exceptions. We already talked about school officials with a legitimate educational interest and the other schools to which a student is transferring, but some officials are auditing or evaluating the school districts. Perhaps the school is a failing school, and district officials need to determine what is going on curriculum-wise. They have an obligation to look at those records without parental consent. Parties in connection with a student's financial aid would be privy to that information, and that is protected. Any organization that the school has hired that is conducting a study on the school. Studies can be done for efficiency and effectiveness or be around financial planning. Governing bodies accredit most schools and institutions of higher learning, and they are allowed access to records should they desire them. Any time the school has records subpoenaed would be another instance. The school record is sent immediately, which requires no parental consent. Any time that the child has a health or safety emergency would be another example. Child Protective Services or another social service agency may be involved and need to access a child's records. This is allowed under FERPA. And, any state and local authorities within a juvenile justice system can have access to educational records.
Directory Information
- Directory information can automatically be disclosed without the permission of the parent. However, parents must be given the option to opt-out of the release of directory information.
- The option to opt-out must be provided annually and in writing. The method of delivery is a matter of local control.
- Directory information includes:
- Name
- Address
- Telephone number
- Date and place of birth
- Honors and awards
- Dates of attendance
We already talked about directory information. Remember, the above information is available for schools to disclose without parental permission unless they opt-out.
Example: Eli the Eighth Grader
- You provide speech services to Eli as a contract employee with the school district. Eli is in the eighth grade and has made so much progress you think it may be time to dismiss him. You would like to call his parent and discuss his progress with them. However, the parent has opted out of the release of directory information. Can the school legally give you Eli’s parent’s phone number?
The answer to this is yes. You, as a provider of speech services, have an educational interest in having this information. You need to discuss this with the parents. If the local school policies allow for that, they have to give you that information.
Example: Sara the Second Grader
- You provided PT services to Sara as a contracted district employee when Sarah was in Kinder and first grade. In the second grade, Sarah came off your caseload and was assigned to another PT. You really enjoyed working with Sara and wanted to touch base with her mom to see how she likes her new provider. Sara’s mom has opted out of the release of directory information. Can the school give you her mother’s phone number?
We talked about a similar scenario earlier. The parent has opted out of the directory information, and you no longer have a legitimate educational interest. The school cannot give that information to you under FERPA.
Right to File a Complaint
- Parents and eligible students also have a right to file a complaint with the Department of Education.
- 180 days post violation or when the complainant should have reasonably known about the violation
- Can be filed by parent, eligible student, advocate, or attorney acting on behalf of parent or eligible student
The right to file a complaint with the U.S. Government should a parent want to is a big issue. It has been my experience that when people want to file a complaint, they usually want to know that they are right. The response is usually not what they want to hear. They typically want the school to be punished because they have not done what they need or have broken the law. Usually, it does not get to that level of punishment. Oftentimes, it is retraining staff on how to do it correctly the next time. However, parents have the right to file a complaint. It has to be a written complaint. The right to file a complaint can either come from the parent or the student if the student has turned 18 years of age. There are some guidelines to filing a complaint. First, the complainant needs to the FERPA section on the U.S. Department of Ed's website and review all of the guidelines to determine if there has been a FERPA violation. There are many resources on there to think about and discuss before the complaint filing process.
If they have reviewed these materials and still believe that there has been a violation, they have 180 days to post the complaint. The clock starts once the violation happened or once the parent/child reasonably should have known that the violation happened. This is important because the law does not allow something to happen in first grade, and then in fourth grade, the complaint is made. The response is going to be, "If signs of these things were happening since the first grade, you should have known back then."
The complaint is filed online, and there are instructions there for them to do that. Before a FERPA complaint is filed, the U.S. Government likes for these cases to be handled at the local level, if at all possible. They do not want to get involved in a FERPA violation if a reasonable solution can be made at the local level.
The Privacy Act of 1974 governs the collection and maintenance, and dissemination of information in systems and records by Federal agencies. It prohibits disclosing a record absent the prior written consent of the individual to whom the record pertains. Thus, if you open a complaint with FERPA, they have to have consent for them to release the records they have. Again, there are circumstances where that is not the case. The government can disclose personal information from the complaint form without consent. For example, they may need to reveal personal information to officials at the school to verify facts or gather additional information.
Reasons Complaints Are Filed
- Student’s personally identifiable information has been disclosed without permission
- Wrongfully denied access to records
- Right to request inaccurate information be amended
- Note: the feds would like all complaints to try and be resolved at the local level before filing a complaint.
These are typical reasons why complaints are filed. The student's personally identifiable information has been disclosed without permission. Parents were wrongfully denied access to records. Oftentimes, this is a timing issue. Remember, schools have 45 days to provide these records for inspection. Sometimes, they take longer than that as school officials can get busy or forget. Other times, schools have denied access to the records or the right to request inaccurate information be amended.
The federal government does three things once a complaint is filed. They will either dismiss the complaint. They will try to mediate between the school and the parent to try to solve the problem. Or, they will find that the school is in violation and try to solve how the school handles record releases and the protection of personally identifiable information. This is usually the extent of what happens with a FERPA violation. There is not a lot of recourse other than to get the schools to shore up their system. I suppose that future legislation could include financial penalties if this becomes problematic, but stiff penalties do not exist in the way FERPA is currently written.
Filing a Complaint
- All complaints must be submitted in writing to the Department of Education
- Complaint must include the facts of why the complainant feels a FERPA violation has occurred
- Resolution:
- Dismissal
- Initiate informal remediation or resolution
- Initiate a formal investigation
- If a violation is found, there could be corrective action in the form of revised policies and procedures or mandatory training for the school/district.
We talked about filing a complaint ad all of these different bullets. It is important to know that the complaint must include why the parent/student feels a FERPA violation has occurred.
Example: Darrell the Dad
- Darrell sent his son’s school administrator an email requesting that he be allowed to come to inspect his son’s disciplinary records. His son has quite an extensive record regarding discipline in the schools. The administrator responded that he would get the appropriate staff member to get these records together and will contact him when they are ready for inspection. Time passes, and Darrell realizes that it has been 20 days since his original request to inspect the records. He contacts the school administrator again, who apologizes and says they will get right on that. 10 more days pass without word from the school. Darrell decides to file a complaint with the Department of Education. Has a FERPA violation occurred?
The answer to this question is no. A FERPA violation has not occurred because the school has 45 days to provide those records for inspection. Darrell may think that that is unreasonable as his son goes to a small school, and they could easily make those records available for inspection. However, they have 45 days. He has the right to file a complaint, but it will likely be dismissed at the federal level because it is not a violation.
What Are My Responsibilities?
- Accurate record-keeping; facts not feelings
- Be careful about disclosure
What are your responsibilities as a therapist, social worker, or someone coming into the school as a contracted employee? It is important to keep accurate records. You want to make sure that everything you report that will be a part of that educational record is true and accurate. You do not want to get into a situation where your records are needing to be amended. This could affect whether or not a school or a third-party employer wants to continue using your services.
Remember to document facts, not feelings. Everything in that record should be based on data. "I'm basing this off of these scores or this assessment." It should not just be, "I've been providing speech services to this child for three years, and he does not do what I tell him at home to practice. There is no need to provide services for him anymore because he won't listen." These statements reflect a lot of feelings and frustration. It would be better to say something like, "I've been working with this student for three years. During this time, he has grown this much or has achieved this much. It is my opinion that he could achieve even more if these things were occurring outside of our speech therapy time." This statement makes some assumptions that he is not doing what he needs to do but removing the negative feelings. We need to take all of that emotional language out of the educational records.
Also, please be careful about disclosure. Oftentimes, this is done innocently without people meaning to do it. It could happen around the water cooler or the coffee pot when talking to a therapy friend. This might be because you need to vent, or you have had a rough day. If you are giving personally identifiable information away about a child, that is a FERPA violation. I am not saying that you should not have an opportunity to vent to your coworkers. We all need an opportunity to blow off a little steam, but you need to do that in such a way that you are not disclosing information.
There is another easy way that is very easy for people to disclose information. I call this sort of the "small town paradox." You run into somebody's aunt at the grocery store. You have known this woman for years, and she is a good friend of yours. She wants to talk to you about her niece and how well her niece is doing with therapy. It is very easy to get caught up in a conversation with a person who is the parent. You have to be very careful that you do not disclose information in the educational record. Even though you are not giving access to the educational record, you are giving that information to someone that is not supposed to have it.
Review
- Rights under FERPA
- Complaints Process
- What are my responsibilities?
Let's review a little bit, and then we will run through a few more scenarios to wrap up.
What are rights under FERPA? Parents/children (over 18) have the right to review and inspect items in the educational record. They have 45 days from the time that they request that to be able to inspect those records. It is their right to have those records amended if there are inaccuracies like a violation of privacy or paint an incorrect picture of what is happening. The right is simply to request and be heard. School districts do not have to amend the record. If they choose not to, they have to inform the parent of the right to a hearing. This can be a full-blown hearing. Parents can have attorneys at that meeting, and the school district will decide whether or not to amend the record. If they choose not to amend the record, then the parent has the right to put something in the record that states why they disagree with the decision or why they believe the record should have been amended in the first place. It also gives the parent the right to file a complaint against the school.
After a supposed FERPA violation has occurred, hopefully, the parent or eligible student has taken the time to go to the school district to resolve the issue. If it is not resolved to the parent's/child's satisfaction, they can fill out a form on the Department of Education's website. The Department of Education will then review the form and decide whether or not the case has merit. If it does not, they will dismiss the complaint, act as a mediator between the two parties to resolve the situation, or find fault with the district. Then, they will provide the district with either additional training or procedures to shore up their process to prevent future FERPA violations. Remember, it is unlikely that any restitution or violation is going to come from a FERPA complaint. This office is concerned with is how to make practices better.
What are your responsibilities as a therapist or a social worker going into this facility? You need to ensure that your records are accurate and fact-based. Feelings should be kept out of documentation, and all opinions should be based on data. You also need to be very conscious about disclosing personally identifiable information to any non-parent of a student. You can discuss personal information with the child's principal, a counselor, or anyone that is currently dealing with this child in their educational realm. You cannot talk to last year's teacher or an aunt at the grocery store. You have to be very careful about disclosure.
Let's go through a few more scenarios to help tie a lot of this together.
Example: Larry, the Litigant
- You are providing outside counseling services to a student. After your first counseling session, you had a medical emergency and did not get a formal report typed up from your anecdotal treatment notes. Larry is desperate to get the results of this first session, but you are incapacitated and have taken a leave of absence from the job. He requests to see this record, and 45 days pass. At this time, you are still not able to give him access to the records. Does Larry have a legitimate complaint under FERPA since the school did not provide him with the records he sought in the 45-day time window?
The answer to this question is yes. Larry does have a valid FERPA complaint. I understand that you might be medically incapacitated or whatever happened that you cannot get this information to him, but that is not a concern of FERPA. In these types of situations, it is best for the school or the company that you work for to assign him to a different caseworker to complete a session and get a record created to avoid a FERPA violation. If there were no anecdotal notes, there might not have been a record to share or a FERPA violation. However, as there were notes, we have to at least provide something that went on.
Example: Tammy the Therapist
- She goes into a counselor's office at a junior high school because she is working with a child in physical therapy. She needs to be able to see some things that are in that educational record to help that child during the therapy sessions. Does the counselor have to give her that to her?
This one should be easy. If Tammy is the current therapist, she has a legitimate educational interest. However, she has to be searching for something that will relate to what she is doing in therapy, not whether they were on the honor roll. This is an important distinction. To do her job, is there something in that record that will help her understand the child better to provide optimal physical therapy? If the answer is yes, then absolutely she can have access to those records. Schools have to keep a record of who accesses these records. Tammy would have to sign something to inspect the child's record. It would include how long you had the record and when you returned it.
Example: Henrietta the Helicopter Mom
- Henrietta, the Helicopter Mom, was appalled that the school published a picture of her child in the newspaper as part of a STEM project in their kindergarten class. She goes to the school and revokes the directory release. Now, the honor roll has been published in the paper, and her child's name is not listed. She is now not happy about that. Does she have a FERPA violation? Does she have a complaint under FERPA?
The answer to that question is no. That should have also been a fairly easy one. If you have opted out of directory information, this means everything. Some schools might allow you to determine what directory information they can release and what they cannot, but they do not necessarily have to. They can say, "Here's what we use for directory information. You tell us if we can use that or not."
Example: Isaac the Investigator
- Isaac is investigating issues of child abuse. He comes to the school and wants to see the occupational therapy notes. Can he have access to those records?
The answer is yes. Isaac can access those records because it is within the scope of what he is trying to do. He is a part of state and local authorities that are investigating a safety or medical emergency. Schools cannot deny these investigations. They typically go to the school to get those records, not directly to the therapist. This inquiry may not affect the therapist directly.
Example: Gladys the Gossiper
- Gladys is a gossiper and calls you on the phone to talk about her bad day. She starts telling you about all the children she served and why it caused her to have a bad day. Has she violated FERPA?
The answer to that question is maybe. If she does not tell you about the students she served that day, she has not violated FERPA. She can tell you all about generic scenarios using names like student A or a fake name. As long as she does not give you the student's real names, she can vent to you. However, if she says, "Oh, you know Missy's child Xavier," now we have a FERPA violation.
Example: Marietta the Messy Student
- Marietta went into the counselor's office, retrieved an educational record, and posted all this information on social media. Does the school have a FERPA violation?
The answer to that question is yes. The school has a FERPA violation because they did not protect the educational record. If Marietta had not broken into the counselor's office and posted all this from memory, then there would be no FERPA violation. She accessed the student's educational record without the school knowing, and the school failed to protect that educational record. Therefore, that is a FERPA violation.
References
Available in the handout.
Questions and Answers
How long does a school need to keep educational records?
School records are not governed under FERPA. As far as length is concerned, this is determined by the state legislature. In Texas, it is usually five years for most educational records. Schools should follow the policies of both their state law and whatever organization they are working for as far as record retention.
You mentioned that schools have 45 days to get the records available for the parents to inspect. Is that 45 calendar days, or is that 45 business days?
It is 45 calendar days. They essentially have a month and a half to get that together so that parents can inspect that.
If all the documentation said they have the right to view and inspect, does this include verbal discussion, say in a store?
They are; however, I would caution about doing it in a public place. Be aware of your surroundings. There is one other point of clarification that I should make. I want to stress that the school district is not required to make copies. They are, however, if it is unreasonable for the parent(s) to come and inspect. This goes back to the parent that was in North Carolina. I was required to make those copies because that parent could not get to the school to inspect the record.
That concludes this course. Thank you for participating, and I hope you find the information helpful with your work in the schools.
Citation
Winters, P.J. (2021). FERPA:Family Educational Rights and Privacy Act. Continued Social Work, Article 128. Available at www.continued.com/social-work
May 18, 2021
1 CE Credit