Illinois Families for Public Schools sent a letter to the Chicago Board of Education today with a list of concerns about privacy and other issues with a new telehealth program where mental health services are provided by for-profit company Hazel Health. IL-FPS urges the Board to answer the questions posed in the letter and revise the consent forms that parents agree to when they sign their student up for services.

The acute need for additional access to mental health services for the students of Chicago Public Schools should not require the young people receiving those services to waive their rights to privacy, nor have their personal information exploited commercially.

You can read the full letter here. The four primary concerns presented include:

• Only one of two contracts with Hazel Health are available on the CPS website. The list of data collected that is included in one of the contracts does not appear to be complete; it does not list any medical information or video or audio data as being collected, which does not make sense given the nature of the services provided by Hazel Health. Under the Student Online Personal Protection Act, parents and the public should have access to a list of what information is being shared with a third-party company.
• Pages on the Hazel Health website that parents are directed to include tracking by Amazon and Alphabet (Google's parent company). This type of commercial surveillance, especially for a site providing mental health services, is not acceptable.
• The terms in the consent/authorization form that parents agree to in order to sign students up for services are deeply problematic and conflict with state law and CPS policy. Among other things, parents agree that data shared with Hazel "may not be secure and may be illegally accessed by a third party" and that their child's information can be used for commercial and research purposes. 
• Online job review sites report that caseloads for Hazel Health therapists may be up to ten clients per day or 35 clients per week. This raises issues about working conditions for clinicians and the impact of that on the students who are receiving services.

The questions for the Board posed in the letter are:

1. What data elements of students’ covered information are being collected, transmitted and held by Hazel Health and its subcontractors?
2. What student records and covered information generated in the course of receiving services from Hazel Health are shared back to CPS? Which CPS employees have access to them? Who determines this? How are these student records shared?
3. How is confidentiality for students aged 12-17 years protected with respect to limitations on parental access? 
4. How many students does one therapist see per day and per week? 
5. How much time do therapists have to prepare for and respond to client sessions? 
6. What, if any, direct, real-time communication takes place between clinicians and school staff?

Illinois Families for Public Schools urges the Board to (i) provide families with answers to all the above questions, (ii) post any and all legal agreements between Hazel Health, United Healthcare (the funder of the current program) and the Chicago Board of Education publicly on the CPS website, (iii) revise and reissue any consent and policy documents that Hazel Health requires families to agree to in order to for children to access services, and, if needed, renegotiate any agreements with Hazel Health to ensure that no student information or records provided to or processed by them will be used for anything other than providing telehealth services.

New York City rolled out a telehealth mental health program last fall that was a contract between Talkspace and the city's Department of Health that has been widely promoted by the NYC Department of Education for public school students there as well. It has had major privacy issues (see here and here) flagged by the Parent Coalition for Student Privacy and other privacy advocates. Ultimately, the contract between NYC and Talkspace was rewritten, but problems with tracking users on their website have yet to be resolved.