Most states have enacted laws that require proof of immunization before a child can be enrolled in school. Previously, schools complied with this requirement by either having legally emancipated students, students over the age of majority, or minor students’ parents or legal guardians provide these immunization records directly, or by obtaining a written authorization allowing the school to contact the health care provider directly. The Privacy Rule prohibited schools from contacting a student’s health care provider directly without written authorization. 

As a result, schools in states with required pre-entry immunizations were prevented from admitting potential students where the student, or minor student’s parents or legal guardians, delayed in providing the requisite proof of immunization or written authorization. The Omnibus HIPAA Final Rule amends the Privacy Rule to now allow a covered entity to disclose a student’s immunization records to aschool in states with pre-entry immunization laws based on written or oral authorization from the student or minor student’s parents or legal guardians. Covered entities will be required to document receipt of either the written or oral authorization in the student’s records, but will not be required to receive a HIPAA-compliant authorization or obtain a signature. The goal of the amendment is to facilitate enrollment of students in schools, while also protecting the rights of students and parents/guardians to object to disclosure of this information. This amendment finds its basis in an exception already existing in the privacy rule: that disclosure of student immunization records promotes a public health purpose in preventing the spread of communicable diseases.