Data sharing between schools and hospitals

Introduction

Data sharing between schools and hospitals refers to the exchange of personal, educational and medical information to support students' health, safety, welfare and educational development. Schools may require medical information from hospitals to manage students with chronic illnesses, disabilities, allergies, infectious diseases or special healthcare needs. Similarly, hospitals may require educational and developmental information from schools when assessing a child's learning difficulties, behavioural conditions or medical requirements.

Although such information exchange can improve healthcare and educational support, it creates important legal and ethical concerns involving privacy, confidentiality, informed consent and data security. Medical records may contain sensitive information about physical health, mental health, disabilities and family circumstances. Therefore, schools and hospitals must ensure that information is shared only for legitimate purposes and with appropriate legal safeguards.

Legal framework in India

1. Digital personal data protection act, 2023

The Digital Personal Data Protection Act, 2023, regulates the processing of digital personal data.

Section 4 establishes requirements for lawful processing, Section 6 addresses consent, and Section 8 specifies obligations of data fiduciaries.

When schools and hospitals exchange identifiable student information electronically, they must consider the applicable requirements of the Act.

An important consideration is that children receive additional protection under Section 9. It establishes requirements concerning verifiable parental consent and restricts certain processing practices involving children's personal data, subject to applicable exemptions.

Therefore, organisations must carefully assess the legal basis for sharing children's medical and educational information.

2. Right of children to free and compulsory education act, 2009

The Right of Children to Free and Compulsory Education Act, 2009, establishes the right to elementary education for children between six and fourteen years.

Section 17 prohibits physical punishment and mental harassment of children.

Although the Act does not establish a comprehensive framework for school-hospital data sharing, its child-protection objectives support appropriate coordination where medical information is necessary to protect students' welfare.

3. Rights of persons with disabilities act, 2016

The Rights of Persons with Disabilities Act, 2016, provides protections concerning equality, accessibility and non-discrimination.

Section 3 addresses equality and non-discrimination, while Section 16 establishes duties concerning inclusive education.

Schools may need relevant medical and disability-related information to provide reasonable support and appropriate educational facilities.

However, such information should not be unnecessarily disclosed or used to discriminate against students.

4. Information technology act, 2000

The Information Technology Act, 2000, provides a legal framework for electronic records and cybersecurity.

Section 43 addresses unauthorised access and damage to computer systems, while Section 66 covers specified computer-related offences. Section 72 concerns breach of confidentiality and privacy by persons obtaining access through powers conferred under the Act.

These provisions may become relevant when student medical records are accessed or disclosed without proper authorisation.

Important principles governing school-hospital data sharing

1. Informed consent

Schools and hospitals should obtain appropriate consent before exchanging identifiable medical information, unless another lawful basis or applicable legal requirement permits the disclosure.

For children, parental or guardian involvement is particularly important, subject to the child's age, maturity and applicable legal requirements.

2. Purpose limitation

Information should be shared only for clearly identified purposes, such as emergency treatment, medication management, disability support or public health protection.

A hospital should not provide a student's complete medical history to a school when only limited information about a specific medical condition is necessary.

3. Confidentiality

Medical and educational records should remain confidential. Access should be restricted to authorised individuals, such as designated school health professionals, treating doctors and relevant administrative personnel.

4. Data security

Both institutions should adopt encryption, authentication, access controls and secure record-management systems.

They should also establish procedures for responding to unauthorised access, accidental disclosure and cybersecurity incidents.

5. Data accuracy and retention

Shared records should be accurate and updated when relevant medical circumstances change.

Institutions should also establish appropriate retention and deletion policies consistent with applicable legal requirements.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 of the Constitution.

The judgment recognised informational privacy and established that interference with privacy must satisfy legality, legitimate purpose and proportionality.

Relevance: Medical information exchanged between schools and hospitals concerns an individual's private life. Institutions must ensure that disclosure is lawful, necessary and proportionate to the intended healthcare or educational purpose.

2. Samira Kohli v. Dr. Prabha Manchanda (2008)

The Supreme Court examined informed consent in medical treatment and explained that consent must be voluntary and based on adequate information.

Relevance: Hospitals should maintain proper consent procedures when sharing identifiable medical information for purposes beyond the immediate treatment relationship. The judgment also supports transparent communication with patients and their authorised representatives.

3. Mr. X v. Hospital Z (1998)

The Supreme Court considered medical confidentiality and circumstances in which disclosure of confidential health information may be justified.

The Court recognised that medical confidentiality is important but is not necessarily absolute in every situation.

Relevance: Schools and hospitals should generally protect students' medical information. However, disclosure may be justified in legally recognised circumstances, including certain situations involving serious risks to others.

4. Avinash Mehrotra v. Union of India (2009)

The Supreme Court examined school safety following a serious school fire and emphasised the importance of safety measures in educational institutions.

Relevance: The judgment supports the broader responsibility of schools to protect students' safety and welfare. Access to relevant emergency medical information may assist schools in fulfilling these responsibilities, provided privacy safeguards are maintained.

Practical safeguards for institutions

Schools and hospitals should establish written data-sharing agreements covering the following matters:

Clearly defined purposes for information exchange.

Identification of authorised personnel.

Appropriate parental consent procedures.

Restrictions on unnecessary disclosure.

Secure electronic transmission and storage.

Procedures for correcting inaccurate records.

Appropriate retention and deletion schedules.

Incident reporting and breach management.

Confidentiality obligations for employees.

Periodic review of data-sharing arrangements.

Challenges in implementation

Schools and hospitals may use different record-management systems, making secure information exchange difficult. Smaller institutions may also lack trained data protection personnel and adequate cybersecurity infrastructure.

Another challenge is balancing confidentiality with emergency healthcare requirements. For example, school staff may need immediate access to information about a student's serious allergy or medical emergency, even when the usual consent process cannot be completed at that moment.

Institutions should therefore establish emergency disclosure procedures that are legally justified, limited to necessary information and properly documented.

Conclusion

Data sharing between schools and hospitals can improve student healthcare, emergency response and inclusive education. However, it must be governed by privacy, confidentiality, informed consent and data security principles. India's Digital Personal Data Protection Act, 2023, Rights of Persons with Disabilities Act, 2016, and Information Technology Act, 2000, provide important legal safeguards. Judicial decisions such as Puttaswamy, Samira Kohli and Mr. X v. Hospital Z establish significant principles concerning privacy, informed consent and medical confidentiality. Schools and hospitals should therefore adopt transparent data-sharing agreements and appropriate security measures to protect students while ensuring effective healthcare coordination.