CDC Access to Students’ Health Records Raises Questions of Privacy

Researchers with the federal Centers for Disease Control and Prevention have used the records of Atlanta-area schoolchildren for years, without parental consent, for studies of developmental disabilities such as autism and cerebral palsy. When the practice was questioned in 1999 by a Department of Education official as a potential violation of privacy laws, the CDC negotiated an agreement with the agency allowing such research to continue through 2005.

The agreement, signed in 2000, gives the CDC status as an “authorized representative” of the U.S. secretary of education under the Family Educational Rights and Privacy Act. That law restricts the disclosure of student records in schools receiving federal money.

The arrangement came to light last week in an Associated Press news story. Representatives of the Education Department, the CDC, and some of the school districts involved all said the arrangement is proper and respects the privacy rights of children whose records were examined.

But a privacy expert interviewed last week is troubled by the disclosure.

“The government really shouldn’t be rooting around in anyone’s medical records without that person’s consent,” said Barry Steinhardt, the director of the American Civil Liberties Union’s program on technology and liberty. “There are legal and constitutional implications here that need to be explored.”

The CDC, based in Atlanta, has used records from nine nearby school districts since 1991 as part of a research effort called the Metropolitan Atlanta Developmental Disabilities Surveillance Program.

CDC researchers “go into schools, review student files, and obtain relevant information” on children with disabilities such as autism, cerebral palsy, and mental retardation, states the Education Department agreement.

A CDC study of the prevalence of autism, published in January in the Journal of the American Medical Association, notes that “public schools were a primary source for case identification” based on special education records maintained by the schools in the mid-1990s.

“Because this activity was considered public health surveillance, parental consent was not required,” the study says.

Concerns Raised

In 1999, LeRoy S. Rooker, the director of the Education Department’s office that enforces student privacy law, “informally advised” participating Atlanta schools that the CDC’s efforts to gather student data without parental consent “would not generally be authorized under FERPA,” according to the later agreement.

It appears that the parties then searched for a way around the legal problem, and they found one by designating the CDC as an “authorized representative” of the education secretary. Under FERPA, such representatives may gain access to student records for limited purposes.

“Without continued access to these records, the [CDC program] will not be able to provide meaningful estimates of the occurrence of developmental disabilities in children,” the agreement states.

A bill pending in Congress would give the CDC permanent access to school records for similar research purposes.

Pat Bowers, a spokeswoman for the 55,000-student Atlanta school system, which participated in the autism study, said the district took steps to protect the privacy of student data.

The CDC request, she said, “was intended to benefit children and their experience in schools.”

Mr. Steinhardt of the ACLU said his concern is with the federal government’s delving into what are essentially medical records rather than educational files.

“There is a history in this country of ‘function creep,’” he said. “We need to worry ... that a record created for one purpose is rarely limited to that purpose.”

One problem for parents who feel aggrieved by the disclosure: Under a U.S. Supreme Court decision last year, there is no private right to sue over alleged violations of FERPA.

The only recourse is to complain to the Education Department—in this case, the same agency that signed the agreement authorizing the CDC research.