Data sharing between schools and health providers

Introduction

Data sharing between schools and health providers refers to the exchange of students' educational, medical, psychological, and personal information between educational institutions and healthcare organisations. Such sharing may involve school health records, vaccination details, disability information, medical prescriptions, emergency contact details, mental health assessments, and information about special educational requirements.

The primary purpose is to ensure student safety, provide appropriate medical assistance, support children with disabilities, and improve coordination between educational and healthcare institutions.

However, sharing children's health information raises important legal concerns relating to privacy, parental consent, confidentiality, data security, and unauthorised disclosure. Therefore, schools and healthcare providers must establish clear legal procedures before exchanging student information.

Legal framework governing data sharing

1. Digital Personal Data Protection Act, 2023

The DPDP Act establishes rules for processing digital personal data, including information relating to children. Under Section 9, a Data Fiduciary must obtain verifiable consent from a parent or lawful guardian before processing a child's personal data, subject to applicable statutory exemptions.

The Act also restricts certain processing activities involving children, including tracking, behavioural monitoring, and targeted advertising, subject to statutory provisions and exemptions.

Accordingly, schools and healthcare providers should establish appropriate consent procedures and clearly explain why students' information is being shared. The Act's commencement notifications and applicable rules must be examined before determining the precise obligations applicable to an institution.

2. Right of Children to Free and Compulsory Education Act, 2009

The Right to Education Act establishes important educational rights and provides for the protection and welfare of children in schools.

Section 17 prohibits physical punishment and mental harassment. Although the Act does not establish a comprehensive medical data-sharing system, its child-protection objectives support responsible handling of information relating to students' welfare.

3. Rights of Persons with Disabilities Act, 2016

The Rights of Persons with Disabilities Act recognises the rights of children with disabilities to inclusive education and appropriate support.

Section 16 requires educational institutions funded or recognised by the government to provide inclusive education and appropriate facilities. Sharing relevant disability-related health information may help schools arrange reasonable accommodations, provided confidentiality and applicable data protection requirements are respected.

4. General Data Protection Regulation (GDPR)

The GDPR provides additional protection where schools or healthcare providers process personal information within its territorial scope.

Article 9 classifies health information as special-category personal data. Article 8 establishes conditions for children's consent in relation to information society services, while Article 32 requires appropriate technical and organisational security measures.

Types of information shared between schools and healthcare providers

Information exchanged between educational institutions and healthcare organisations may include:

Medical histories and existing health conditions.

Vaccination and immunisation records.

Allergy information and emergency medical requirements.

Disability assessments and accommodation requirements.

Mental health and counselling information.

Medication instructions and medical recommendations.

Emergency contact and parental information.

Only information necessary for the particular educational or healthcare purpose should be shared. For example, a school may need to know that a student has a serious allergy and what emergency arrangements are required, without receiving the student's entire medical history.

Legal requirements for responsible data sharing

1. Consent and lawful authority

Schools should obtain appropriate parental or guardian consent where required. Healthcare providers must also consider professional confidentiality obligations and the legal basis for disclosing medical information.

2. Purpose limitation

Information should be shared only for a clearly defined purpose, such as emergency treatment, vaccination programmes, or disability-related educational support.

3. Confidentiality

Medical information should be accessible only to authorised school officials and healthcare professionals who genuinely require it.

4. Data security

Institutions should use secure electronic systems, access controls, encryption, and appropriate backup arrangements to prevent unauthorised disclosure.

5. Retention and deletion

Schools and healthcare providers should establish retention periods according to applicable legal, medical, and educational requirements. Information should not be retained indefinitely without a lawful reason.

6. Emergency disclosure

Where a student faces an immediate medical emergency, relevant information may need to be disclosed to healthcare professionals to protect the child's health and safety. Such disclosure must remain limited to what is necessary and legally justified.

Relevant case laws

There are limited Indian judicial decisions directly addressing data sharing between schools and healthcare providers. However, the following judgments establish relevant principles.

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 of the Constitution. The judgment recognised informational privacy and the importance of protecting personal information from unnecessary collection and disclosure. It provides an important constitutional foundation for protecting students' medical records.

2. Suchita Srivastava v. Chandigarh Administration (2009)

The Supreme Court recognised the importance of personal autonomy and reproductive privacy. Although the case concerned reproductive rights, its reasoning supports respect for individual dignity and autonomy when handling sensitive medical information.

3. Samira Kohli v. Dr. Prabha Manchanda (2008)

The Supreme Court explained the importance of informed consent in medical treatment. The judgment is relevant when healthcare providers obtain consent before medical procedures and when institutions coordinate healthcare services involving students.

4. Montgomery v. Lanarkshire Health Board (2015)

The United Kingdom Supreme Court emphasised the importance of informed consent and disclosure of material medical risks. Its principles are relevant to understanding patient autonomy and responsible communication between healthcare professionals and patients.

These decisions provide analogous principles rather than direct rulings on school-healthcare data-sharing agreements.

Challenges and compliance measures

Schools and healthcare providers may face difficulties involving unclear consent procedures, unauthorised access, outdated medical records, cybersecurity threats, and disagreements over responsibility for protecting student information.

To address these challenges, institutions should:

Establish written data-sharing agreements.

Identify the specific information that may be exchanged.

Define the responsibilities of schools and healthcare providers.

Maintain consent and disclosure records.

Restrict access to authorised personnel.

Establish procedures for correcting inaccurate information.

Create appropriate data breach response mechanisms.

Conclusion

Data sharing between schools and health providers is important for protecting children's health, supporting inclusive education, and ensuring timely medical assistance. However, such sharing must respect privacy, confidentiality, parental consent, and applicable data protection laws. Indian legislation, particularly the DPDP Act, 2023 and the Rights of Persons with Disabilities Act, 2016, provides an important legal framework. Proper consent procedures, limited disclosure, secure information systems, and written data-sharing agreements can help educational and healthcare institutions protect students while improving coordination and welfare.