D590 Task 1 Budget and Privacy Analysis Example

When the Grant Ends and the School Calls: How Policy Shapes a Composite County Health Department's Budget, and Which Privacy Laws Govern a Request for Student Immunization Data

Student Name

Leavitt School of Health, Western Governors University

D590: Public Health Administration, Task 1

Course Instructor

Month Day, Year

When the Grant Ends and the School Calls: How Policy Shapes a Composite County Health Department's Budget, and Which Privacy Laws Govern a Request for Student Immunization Data

The Department and Its Funding

Oak County Health Department is a composite department serving about 420,000 residents with a budget of $38 million. Its money comes from four sources: a local property tax levy (22%), state funding (25%), federal grants passed through the state (41%) and fees and insurance billing (12%). Most of the federal money is categorical, meaning it may be spent only on the program it funds, such as the nutrition program for women, infants and children, immunizations, emergency preparedness or HIV prevention. Last spring, a pandemic-era federal grant of $4.2 million a year, which paid for 26 positions including epidemiologists, data analysts and a new disease surveillance system, ended earlier than planned. At the same time, the local school district asked the department for access to immunization records for its 9,000 students. This paper explains how policy shapes the department's budget and how privacy law governs the data request.

How Policy Shapes the Budget

Federal policy decides what most of the budget can do. Categorical grants come with rules on allowable costs, reporting and staffing, and funds for one program cannot be moved to another even when needs change. That is why the loss of the pandemic-era grant cannot be covered by shifting money from the nutrition or preparedness grants, even though those programs employ similar staff. Flexible federal money exists but is scarce. The Preventive Health and Health Services Block Grant gives health departments latitude to fund local priorities, and a study of how states used it found that three-fourths directed funds to programs addressing social determinants of health, often programs that had no other funding source (Frazier et al., 2025). The contrast between that grant and the categorical majority shows how much funding structure, set by policy, limits a department's choices.

State policy sets matching requirements for some grants and a per capita formula for state public health funding. Local policy matters too: state law caps annual increases in the county's property tax levy, so local revenue grows slowly regardless of need. Insurance policy affects the fee line: the department can bill Medicaid and private insurers for clinical services such as immunizations and sexually transmitted infection testing, but only if it maintains the credentialing and billing systems that payers require.

Budget Options After the Grant

Five options are available. The county commission could add general fund money, which competes with roads and public safety. The department could apply for flexible block grant funds through the state. It could expand insurance billing for clinical services, which would require an upfront investment in billing staff. It could allocate the cost of shared data staff across several categorical grants, where each grant's rules allow a proportional share of analyst time. Or it could reduce services.

The case for protecting capacity is strong. Over a thirteen-year period, mortality from preventable causes fell between 1.1% and 6.9% for each 10% increase in local public health spending, with larger gains in low-resource communities, although the authors cautioned that money alone is not enough without improvements in practice (Mays & Smith, 2011). The recommended approach combines allocation of shared data staff across eligible grants, a block grant application and a two-year general fund request tied to measurable outcomes, while accepting that some of the 26 positions will not be replaced.

The Data Request and the Laws That Apply

The school district wants to confirm that enrolled students meet the state's school immunization requirements. Before deciding what to share, the department must identify which law governs each piece of information, because health information in public health settings is not automatically covered by HIPAA.

State law. The immunization records are held in the state's immunization information system, the registry that providers use to report vaccines. Access to the registry, and the purposes for which schools may use it, are set by state law and regulation. In Oak County's state, the law allows authorized school staff read-only access to the immunization records of enrolled students for the purpose of verifying school requirements.

HIPAA. The health department is a hybrid entity: its clinics that bill insurance are covered components subject to HIPAA, while its registry and disease surveillance functions act as a public health authority. HIPAA permits covered health care providers to disclose information to public health authorities, and since 2013 it has also allowed a provider to send proof of a student's immunizations to a school when state law requires it and a parent agrees. For the registry itself, state law rather than HIPAA sets the rules.

FERPA. Once immunization information enters a student's school record, it becomes part of the education record, and from that point the federal student records law, FERPA, protects it rather than HIPAA. Federal guidance from the Departments of Education and Health and Human Services explains that health records maintained by a school about its students are generally education records under FERPA (U.S. Department of Health and Human Services & U.S. Department of Education, 2019).

What May Be Shared, and How

The department should grant access, but only as the law allows and with safeguards. It should sign a data sharing agreement with the district that limits use to verifying school immunization requirements, prohibits further disclosure, and requires the district to protect the records under FERPA. Access should be through individual, role-based registry accounts for named school nurses, not a bulk file of every student's records, which keeps disclosure to the minimum necessary. The registry's audit logs should be reviewed quarterly, and accounts should be removed when staff leave. Families should be informed through the district's annual notice how immunization status is verified.

Ethically, this approach balances two goods: protecting children from vaccine-preventable disease in schools, and respecting families' expectation that health information is used only for the purpose for which it was collected. If the district later asks for more, such as names of unvaccinated students to share with coaches or outside groups, the agreement's purpose limit gives the department a clear basis to say no.

References

Frazier, C. M., Mumford, K., McMillan, H., Carlin, M., Peterman, E., & Lindan, K. (2025). The use of the CDC Preventive Health and Health Services Block Grant to address social determinants of health to advance health equity. Journal of Public Health Management and Practice, 31(3), 428-439. https://doi.org/10.1097/PHH.0000000000002073

Mays, G. P., & Smith, S. A. (2011). Evidence links increases in public health spending to declines in preventable deaths. Health Affairs, 30(8), 1585-1593. https://doi.org/10.1377/hlthaff.2011.0196

U.S. Department of Health and Human Services & U.S. Department of Education. (2019). Joint guidance on the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to student health records (2019 update).