In collaboration with Yale Health and the Yale School of Medicine (YSM) Student Mental Health and Wellness Program, we have compiled a summary of information about the protection of student privacy.
YSM Mental Health & Wellness Program
Our own Mental Health & Wellness Program for medical and PA students, led by Lisa Ho, MSW, and team, keeps confidential paper records that are stored in locked storage cabinets on site. The YSM program does not use electronic records.
Yale Mental Health & Counseling (MHC)/Epic
On June 1, 2022, MHC switched to using Epic EMR for progress notes to better coordinate care and improve communication between MHC, Yale Student Health, and patients. Progress notes are brief summaries of the reason for visit and therapeutic plan. Given the sensitive nature of mental health records, access to MHC visits and progress notes are not widely available to Epic users, but rather are viewable only by clinicians in MHC and Student Health. Clinicians with Epic access in other settings, including the inpatient psychiatric hospital, acute care settings (emergency rooms and hospitals), and other outpatient settings, cannot see MHC visits and progress notes unless a student signs a release of information.
Below are a few additional details about MHC/Epic:
● No medical students rotate through Yale Health MHC or Student Health, and no one in those departments has evaluative capacity within the medical school.
● MyChart messages are not protected in the same way as MHC progress notes in Epic. If you want to contact your clinician about something sensitive that you do not want viewable to your other medical providers or staff, call MHC to speak to your clinician over the phone, rather than messaging them through MyChart.
● Your MHC clinician appears as part of your care team in MyChart.
Protecting student privacy
The Yale University Privacy Office has built customized safeguards for student health records and continuously monitors Epic audit logs for inappropriate access to electronic health records. Suspicious activity or access (e.g., by another student or by a resident, physician, or other provider or staff member not involved in your care) will trigger an alert to the Privacy Office for investigation. This process has proven to be rapidly and highly effective in detecting potential inappropriate access. The Privacy Office process includes notification to the person whose health record has been confirmed to have been inappropriately accessed, and those who engage in unauthorized access of another’s electronic health record are subject to disciplinary action up to and including termination of employment and/or dismissal from the university.
Break The Glass (BTG)
BTG is a tool in Epic which requires users to re-enter their credentials and provide a business reason for accessing a patient’s record protected by BTG. BTG does not stop a user from accessing a record; rather, it slows access and records a reason for access. The limited benefit of BTG along with the added login burden for legitimate treatment providers led to a decision to not routinely set BTG, however it is available on request. To request BTG, call the Yale Health HIPAA Privacy Officer at 203-432-0305.
Connecticut’s Health Exchange
In May 2023, health care providers in Connecticut began participating in Connie, Connecticut’s official Health Information Exchange. Yale Health is currently not participating in Connie so as to comply with federal student privacy law (FERPA), which limits disclosure of student records.
Note that if you receive care from other healthcare providers in Connecticut who do participate in Connie, you can opt out of Connie by filling out a form on the Connie website, which will prevent your records from being shared through Connie.