HLTH 6443 Module 2 Policy and Compliance Analysis Example

One Platform, Five Rulebooks: Policy and Compliance Requirements for a Community Referral Network Linking Clinics, Schools and Social Service Agencies

Student Name

American College of Education

HLTH6443: Systems, Policy, and Leadership in Health Informatics

Module 2 Assignment

Instructor Name

June 8, 2026

Introduction

Module 1 found that a composite western Michigan county's closed-loop referral platform connects the health department, clinics, school nurses and 64 community agencies, and that unclear governance of privacy across such different organizations is one of its weaknesses. Early adopters of similar platforms have named compliance with privacy regulations as one of three main implementation challenges, alongside engaging community partners and managing internal change (Cartier et al., 2020). This paper sets out the policies and legal requirements that apply to the platform, organized by the type of participant, and proposes a consent and governance model that satisfies them. Because state law varies and changes, the county attorney will review the final model; this analysis describes federal requirements and general principles.

HIPAA and Covered Participants

The HIPAA Privacy Rule applies to covered entities, health plans, health care clearinghouses and providers that conduct standard electronic transactions, and to their business associates. In this network, the federally qualified health center, the hospital clinics and the health department's clinical programs are covered. Under HIPAA, a covered entity may share protected health information without authorization for its own treatment, billing and operational needs, and some referrals to social services may fall within treatment or care coordination. However, whether a particular disclosure to a community agency qualifies can be uncertain, and many networks choose to rely on the individual's written authorization for referrals to avoid ambiguity. The platform vendor, which stores data on behalf of the health department, is a business associate and must sign a business associate agreement that limits its use of the data and requires safeguards and breach notification.

The Gap: Agencies Outside HIPAA

Most of the 64 community agencies, food pantries, housing programs and utility assistance offices, are not covered entities, so HIPAA does not govern what they do with information they receive. An Institute of Medicine committee noted that HIPAA's protections follow the type of organization rather than the information itself, so health information can lose federal protection once it leaves a covered entity (Institute of Medicine, 2009). For families, this means that the same sentence about a child's asthma is protected in the clinic and may not be protected once it reaches a pantry. The network must fill that gap by contract: the network participation agreement will require every agency to use platform data only to serve the referred family, to limit access to trained staff, to report breaches and to follow the network's privacy policy, whether or not HIPAA applies to it.

FERPA and School Nurse Referrals

School nurses employed by the district keep education records governed by FERPA, not HIPAA, and federal guidance explains this distinction and its consequences for sharing (U.S. Department of Health and Human Services & U.S. Department of Education, 2019). FERPA generally requires written consent from a parent, or from an eligible student aged 18 or older, before personally identifiable information from education records is disclosed to anyone outside the school, apart from narrow exceptions like a health or safety emergency. A school nurse's referral of a family to a food program is not an emergency, so the platform's school workflow must capture parental consent before any student information is sent. Nurses should also enter only what the agency needs, such as a family's name, contact details and the type of need, rather than health details from the student's record.

Special Protections: Substance Use and Domestic Violence

Two groups of participants have stricter confidentiality rules. Federally assisted substance use disorder treatment programs are governed by federal confidentiality regulations known as Part 2, which restrict disclosure of information identifying a person as a patient more tightly than HIPAA, although recent revisions have aligned some requirements with HIPAA. Domestic violence service providers that receive federal Violence Against Women Act funding are generally prohibited from disclosing personally identifying information about the people they serve without informed, written, time-limited consent, and these programs have long been cautioned against entering client data into shared databases. The network will therefore not require these programs to receive referrals through the platform. Instead, the platform will show a referral option that gives the family the program's hotline and records only that a warm handoff was offered, with no identifying information sent.

Language Access and Accessibility

Compliance also includes access. Recipients of federal financial assistance, including the health department and the health center, must, under Title VI of the Civil Rights Act, take reasonable steps so that people with limited English proficiency can use their programs meaningfully. Consent forms, screening questions and text messages in the platform are available in English and Spanish, but Module 1 found that Arabic and Swahili speakers, members of recently resettled refugee families, are not served. The network will add translated consent forms and messages in both languages and use interpreters for screening. Web accessibility for staff and families with disabilities, such as compatibility with screen readers, will be included in the vendor's next contract requirements.

Security Requirements

Privacy rules decide who may see information; security rules decide how it is protected. The HIPAA Security Rule requires covered entities and business associates to guard electronic health information through administrative, physical and technical measures, including risk analysis, workforce training, access controls, audit controls and transmission security. Community agencies outside HIPAA have no equivalent federal duty, and some have never done a risk assessment. Because a breach at the smallest pantry would damage trust in the whole network, the participation agreement will set one security baseline for every user: individual logins with multifactor authentication, access limited by role, automatic logout after inactivity, no downloading of referral lists to personal devices and annual security training. The vendor's contract will require that data be encrypted both while moving and while stored, and an independent security assessment each year. Module 4 will turn these requirements into written protocols.

A Consent Model for the Network

Given these rules, the network will use a single, plain-language consent that the family signs, electronically or on paper, before any referral. The consent will name the type of information shared, the specific agency receiving it, the purpose, the duration of one year and the family's right to revoke it. Separate checkboxes will allow sharing of the referral outcome back to the referring organization, and optionally with the health department for aggregate reporting. For school referrals, a parent signs; for referrals from substance use or domestic violence programs, the platform is not used for identifying information. The consent record is stored with the referral so any agency can confirm it before acting. This approach uses the strictest applicable standard, written authorization, as the default for everyone, which is simpler to train and to audit than separate rules for each participant.

Governance and Accountability

The network will form a privacy and data governance committee including the health department's privacy officer, the county attorney, two agency representatives, a school district representative and a community member. The committee will approve the privacy policy, review requests to use platform data for evaluation or research, oversee audits of user access and review any breach. Agencies that repeatedly violate the policy will lose access after a warning. An annual report on consent rates, access audits and incidents will be published to participating agencies.

Conclusion

The platform operates under several sets of rules at once: HIPAA for covered participants, contract obligations for agencies outside HIPAA, FERPA for schools, special protections for substance use and domestic violence programs, and civil rights duties for language access. A network-wide consent model using written authorization, combined with a participation agreement, business associate agreement and a governance committee, allows the platform to comply with the strictest applicable rule while remaining usable. Module 3 turns to training staff to apply these rules consistently.

References

Cartier, Y., Fichtenberg, C., & Gottlieb, L. M. (2020). Implementing community resource referral technology: Facilitators and barriers described by early adopters. Health Affairs, 39(4), 662-669. https://doi.org/10.1377/hlthaff.2019.01588

Institute of Medicine. (2009). Beyond the HIPAA privacy rule: Enhancing privacy, improving health through research. The National Academies Press. https://doi.org/10.17226/12458

U.S. Department of Health and Human Services & U.S. Department of Education. (2019). Joint guidance on the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to student health records (2019 update).