Jane Smith got home after a long day at work and played the message machine. The only message was from the school nurse at Acme Elementary School.

“Mrs. Smith, this is Nurse Amanda at Acme Elementary. I am afraid we cannot let your daughter, Becky, return to school until her immunization chart is updated. I called your pediatrician’s office as you requested, but they told me that because of HIPAA they could not provide me the updated information without you signing their authorization form. I tried to explain that you told your doctor this was okay, but they got a bit upset with my questioning them and told me to take this up with you.”

Jane sighed. Tomorrow suddenly became a logistical nightmare trying to sort out the “pass the buck” game she had gotten herself into. She certainly was not going to make it to work on time. So is Jane solely to blame for not straightening this out before school started? Maybe, but the doctor’s office could have helped too by not being HIPAA-lazy.

Most states prevent students from attending school without proper immunization records. In general, a lot of states and school districts basically push the burden of documentation on to parents to complete the records and turn them in. However, sometimes a physician’s office might be requested to send records directly to the school. In those instances, HIPAA unfortunately would have prevented that necessary communication unless a parent signed a written authorization. The folks that oversee HIPAA got a lot of feedback about this paper obstacle and essentially took HIPAA back to school and changed, or rather, tweaked the law to be a bit more helpful to haggard parents like Jane.

This past January 2013, the Office for Civil Rights (OCR) published another massive set of HIPAA rules. One small change was a new provision that allowed covered entities (e.g., physician offices) to accept oral agreement from parents versus strictly written agreement before sending over proof of immunization to a school that required such documentation. By way of example, OCR commented that if a parent called a doctor’s office and requested that records be sent to the school, the simple notation of that request by the doctor’s office would suffice as an oral agreement. As a result, the subsequent disclosure of the records to the school would not be a HIPAA violation.

How does this help Jane? Well, assuming the office is open first thing in the morning, Jane should be able to clear this up with a phone call to the pediatrician’s office rather than having to drive across town to sign a form. The doctor too should be updated with HIPAA’s new schooling about notating a parent’s permission, like Jane’s earlier approval, in the pediatric chart. Hopefully, Jane will not miss more work than she needs to and Becky will not miss a day of school.