HIPAA Compliance Guide for Pediatric Environmental Health Specialty Units

What health information do PEHSUs collect during environmental exposure consultations?

During a consultation, a Pediatric Environmental Health Specialty Unit (PEHSU) may receive information about a child’s symptoms, medical history, medications, test results, and care. Staff may also record details about a possible exposure, such as the substance, timing, location, route of exposure, and people or settings involved.

When these details identify a child—or could reasonably be combined to identify the child—and relate to health or health care, they may constitute protected health information (PHI) under HIPAA. Environmental measurements or general exposure questions do not necessarily identify a patient, but linking them to a child’s name, medical record, or other identifying details can make the combined information PHI. See HHS’s guidance on individually identifiable health information.

PEHSUs should identify what information they collect, where it is stored, who can access it, and how it may be used or shared. The applicable requirements depend on the unit’s organizational and legal status—not simply on its PEHSU name.

How does HIPAA apply to PEHSU consultations and referrals?

HIPAA applies to covered entities and their business associates. A health care provider is generally a covered entity when it conducts certain standard transactions electronically, such as submitting health care claims; using email by itself does not make a provider a covered entity. A PEHSU’s host institution, clinical unit, and service arrangements therefore need to be assessed to determine which HIPAA Rules apply. See HHS’s overview of covered entities and business associates.

If a PEHSU unit performs work on behalf of a covered entity and handles PHI as part of that work, it may be a business associate. In that situation, the covered entity generally needs a written business associate agreement (BAA) that describes permitted uses and disclosures and requires appropriate safeguards. A BAA is tied to the parties’ actual relationship; it is not a blanket compliance certificate. See HHS’s business associate guidance.

For referrals and care coordination, the HIPAA Privacy Rule generally permits a covered health care provider to share PHI with another provider for treatment without obtaining an authorization. The minimum necessary standard does not apply to provider-to-provider disclosures for treatment, though PEHSUs should still use secure, reliable processes and follow applicable organizational policies and other laws. See HHS’s guidance on treatment, payment, and health care operations and the minimum necessary standard.

What safeguards protect children’s and families’ health information?

Where the HIPAA Security Rule applies, the organization must use reasonable and appropriate administrative, physical, and technical safeguards to protect electronic PHI. It must assess risks and vulnerabilities, manage identified risks, and protect the confidentiality, integrity, and availability of electronic PHI. The specific measures should reflect the organization’s environment and risks. See HHS’s Summary of the HIPAA Security Rule.

Practical safeguards can include limiting system access by job role, promptly removing access when responsibilities change, securing devices and paper files, using approved communication tools, and training staff on privacy and security procedures. These are examples of risk-based controls, not a claim that every specific technology or practice is separately mandated in every situation.

PEHSUs should also establish procedures for handling consultation records, referrals, and requests for information; preventing accidental disclosures; and responding to suspected privacy or security incidents. If an outside vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity, the organization should determine whether the vendor is a business associate and whether a BAA is required.

How should PEHSUs share information with clinicians, schools, and agencies?

A PEHSU that is a covered provider may generally share relevant PHI with another health care provider for treatment, including to help the child’s treating clinician evaluate or manage an exposure. HIPAA does not require applying the minimum necessary standard to that provider-to-provider treatment disclosure. Staff should verify the recipient and route the information through an approved channel.

Sharing with a school requires attention to the recipient’s role and the purpose of the disclosure. HHS explains that a covered provider may disclose PHI to a school nurse or physician for treatment purposes, such as helping the nurse provide care to a student. A school employee who is not involved in treatment does not automatically have the same basis to receive a child’s medical details. See HHS’s guidance on disclosures to school nurses or physicians.

School-maintained student health records may be governed by the Family Educational Rights and Privacy Act (FERPA), rather than HIPAA, depending on who maintains the records and the relationship to the school. The distinction matters when information moves between a PEHSU and a school. See the joint HHS and Department of Education guidance on FERPA and HIPAA.

For a public agency, first determine whether it is legally authorized to receive the information for the stated purpose. HIPAA permits certain disclosures to public health authorities for activities such as preventing or controlling disease, injury, or disability; it does not make every agency request permissible by default. When the minimum necessary standard applies, limit the disclosure to what is reasonably needed for the purpose. See HHS’s guidance on public health disclosures.

When is parental or guardian authorization required for a minor’s records?

Under HIPAA, a parent or guardian who has authority to make health care decisions for a minor is usually the child’s personal representative. That person can generally exercise relevant HIPAA rights for the child, subject to state and other applicable law. The rules can differ when a minor may consent to a particular service independently, a court has directed care, or the parent has agreed to a confidential relationship with the provider. See HHS’s guidance on personal representatives and minors.

Whether authorization is needed depends on the recipient and purpose. A disclosure to a treating clinician may be permitted for treatment without authorization, while a disclosure for another purpose may require a valid authorization or a different permission under the Privacy Rule. Before relying on a parent’s signature, confirm who is legally authorized to act for the child and whether an exception or state-law limit applies. Do not assume a parent can authorize every disclosure of an adolescent’s records.

Consent to treatment and HIPAA authorization are different questions: HIPAA does not itself determine whether a minor may consent to care. State law may control that issue and may affect which parent or guardian can act as the child’s personal representative. If a disclosure involves sensitive or confidential services, custody restrictions, or a safety concern, follow applicable law and the organization’s privacy procedures before releasing information.

How can PEHSUs use health information for education and outreach?

PEHSUs can support education and outreach without automatically making every use of identifiable patient information permissible. A covered entity may use PHI for certain treatment and health care operations without an individual authorization, but a public-facing presentation, training example, or outreach product should be reviewed for its purpose and the way the information is presented. HHS notes that some supervised training activities fall within health care operations; that does not create blanket permission to use identifiable records in all educational settings. See HHS’s guidance on health care operations.

When possible, use general scenarios or properly de-identified information rather than names, recognizable case details, images, or distinctive combinations of exposure and location facts. If a proposed use or disclosure of identifiable PHI is not otherwise permitted under HIPAA, obtain a valid authorization from the person legally entitled to authorize it. If the communication is marketing, HIPAA generally requires authorization unless an exception applies; not every health education communication is marketing. See HHS’s authorization guidance and marketing guidance.

Educational materials should also respect employer and host-institution policies, which may impose additional restrictions. De-identification is not simply removing a child’s name: PEHSUs should assess whether remaining details could identify the child, especially in a small community or an unusual exposure case.

What HIPAA limits apply to de-identified data and public health reporting?

HIPAA recognizes two methods for de-identifying PHI: a qualified expert can determine that the risk of identification is very small, or the organization can remove the specified identifiers under the Safe Harbor method and have no actual knowledge that the remaining information could identify the person. Properly de-identified information is no longer PHI under the Privacy Rule, but the methods require more than casually removing names. See HHS’s guidance on de-identification under HIPAA.

For public health reporting, covered entities may disclose PHI without an individual authorization to a public health authority legally authorized to receive it for preventing or controlling disease, injury, or disability. Other disclosures may be permitted or required by law, but the applicable authority and purpose should be verified. When the minimum necessary standard applies, reasonably limit the information shared; the standard does not apply to disclosures made under an individual’s authorization or disclosures required by law. See HHS’s public health activities guidance.

In practice, PEHSUs should determine which HIPAA role applies to their unit, protect identifiable consultation records with appropriate safeguards, and share information only for a permitted purpose or with valid authorization. For education, outreach, and reporting, verify whether the information is identifiable, whether the recipient is authorized, and whether HIPAA or another law sets additional limits.

FAQs.

Are PEHSUs covered entities under HIPAA?

Not automatically. HIPAA status depends on whether the PEHSU’s organization meets the definition of a covered entity, such as a health care provider that conducts specified standard electronic transactions. A PEHSU may also handle PHI as part of a covered entity’s workforce or as a business associate. The unit should assess its host institution and service arrangements to determine which HIPAA requirements apply.

Can a PEHSU share a child’s exposure consultation with the treating clinician?

Generally, a covered health care provider may share relevant PHI with another provider for treatment without the child’s or parent’s HIPAA authorization. The minimum necessary standard does not apply to provider-to-provider treatment disclosures. The PEHSU should verify the clinician’s role and use an approved method to transmit the information.

When can PEHSUs disclose information to public health authorities?

A covered entity may disclose PHI without authorization to a public health authority legally authorized to receive the information for preventing or controlling disease, injury, or disability, including for authorized surveillance, investigations, or interventions. Other disclosures may be required or permitted by law. The PEHSU should confirm the authority and purpose, and apply the minimum necessary standard when it applies.

Does HIPAA apply to environmental health education and outreach?

HIPAA does not prohibit all education or outreach, but a covered entity must have a permitted basis for using or disclosing identifiable PHI. Some activities may qualify as health care operations, while other uses may require authorization; marketing communications have additional rules. Using general examples or properly de-identified information can help avoid disclosing identifiable patient details.