UW Privacy Office

Privacy Policy for Third-party Requirements for Drug Screening Students

Last updated on December 15, 2022

ON THIS PAGE:

Endorsed by: Privacy Steering Committee on August 22, 2019
Approved by: Associate Vice Provost/University Privacy Officer on August 27, 2019

Purpose

This policy establishes a framework for protecting student privacy when third-parties, referred to as Host Sites and defined in Section 4, require drug screenings in connection with experiential learning.

Scope

This policy applies to a University unit when it:

  1. Requires experiential learning or similar student engagement outside of the University;
  2. Places students at one or more Host Sites that require drug screening; and
  3. Does not allow students to make a choice about placements or allows students to make a choice about placements when all University unit-selected Host Sites require drug screening.

University Responsibilities

Chancellors, vice presidents, vice provosts, deans, or other individuals with delegated executive authority from the President or Provost are responsible for implementing processes and procedures that are consistent with University policies, standards, and guidelines. This includes the responsibility for protecting student privacy per this policy as well as Administrative Policy Statements 2.2 University Privacy Policy and 2.4 Information Security and Privacy Roles, Responsibilities, and Definitions.

University units must develop and implement processes and procedures for managing Host Sites’ drug screening requirements that are consistent with this policy.

Definitions

Host Site
Refers to a third-party that hosts students for experiential learning.
Lab
Refers a third-party contractor that tests student samples for identified substances on behalf and at the instruction of a University unit that manages student drug screenings.
Place or placement
Refer to an assignment of a student to a Host Site by a University unit.

Limit Involvement in Drug Screenings

University units may only be involved in student drug screenings in response to a mandate imposed by a Host Site. University units must be clear in their internal processes, procedures, and student-facing communications that only those students encountering drug screening mandates imposed by a Host Site may be the subject of University-managed drug screenings. Further limiting involvement, University units cannot pay for the cost of any student drug screenings.

Create Student Awareness of Host Sites’ Drug Screening Requirements

University units must create awareness of the existence, nature, and impacts of drug screenings mandated by Host Sites. Rather than limiting student awareness to a single formal student-facing notice delivered at a fixed time in connection with onboarding processes at Host Sites, University units must adopt an iterative notice and communication strategy that leverages varying forms of content delivery and engagement over time. University units’ notice and communication strategies must include both informal communications and the formal Student Drug Screening Notice Template, [hyperlink] as described on the University Privacy Office website.

Manage Relationships with Host Sites

University units must advance student privacy and learning at Host Sites by addressing compliance, establishing arrangements that inform interactions with Host Sites, and responding to certain requirements introduced by Host Sites.

7.1 Address Disclosure-related Compliance

Prior to the disclosure of any student personal data (such as a student’s name, level of education, contact information, availability, anticipated commencement of a placement, confirmation of a negative drug screening result) to a Host Site, a University unit must comply with the disclosure-related obligations under applicable laws and regulations including, but not limited to, the Family Educational Rights and Privacy Act (“FERPA”).

7.2 Establish Arrangements with Host Sites

Separate from and in addition to the compliance considerations in Subsection 7.1, a University unit must have a transparent arrangement with a Host Site that, at minimum:

  1. Clarifies that student drug screenings are required by the Host Site and not the University unit or the University;
  2. Establishes that the University will manage student drug screenings through its Lab;
  3. Clarifies that University-managed drug screenings will be conducted for the sole purpose of facilitating student experiential learning per the Host Site’s requirements;
  4. Establishes the University unit’s and Host Site’s relative roles and responsibilities with respect to experiential learning;
  5. Clarifies the nature, timing, and validity of drug screenings per Subsection 7.2.1 below;
  6. Documents, with respect to disclosures of student personal data to the Host Site, the specific:
    1. Nature and purpose of the Host Site’s data processing;
    2. Categories of students to which the data processing relates;
    3. Types of personal data to be processed;
    4. The University unit’s and Host Site’s points of contact; and
  7. Addresses audit and inspection rights if sought by the Host Site per Subsection 7.2.2 below.

As a best practice, a University unit and a Host Site should enter into an agreement that addresses the considerations listed above. However, a University unit may determine the form and structure of the arrangement it establishes with a Host Site.

7.2.1 Clarify the Nature, Timing, and Validity of Drug Screenings

To create clarity about student drug screenings, an arrangement with a Host Site must establish the:

  1. Substances to be included in a drug screening and the drug screening method (such as urinalysis or blood sample examination);
  2. Window of time between a University unit’s placement of students at a Host Site (such as when students to be onboarded are made known to the Host Site by the University unit) and the actual commencement of the placement;
  3. Window of time between the required completion of student drug screenings and the actual commencement of placements; and
  4. Length of time that students’ negative drug screening results will be deemed valid by a Host Site for placement purposes and/or any Host Site requirements for multiple or recurring drug screenings over time for a single placement.

7.2.2 Address Audit and Inspection of Student Drug Screening Records

If a Host Site expresses a need to audit or inspect student drug screening records in a University unit’s possession, a University unit’s arrangement with a Host Site must clarify that:

  1. Relevant drug screening results may only be disclosed to a Host Site when it must demonstrate its student drug screening practices to satisfy obligations related to its own compliance, accreditation, insurance coverage, or similar matters;
  2. University records retention schedules govern the length of time that student drug screening results are held by a University unit and, accordingly, drug screening results that have reached the end of their retention period may no longer be available at the time of an audit or inspection request;
  3. The University-managed student drug screening process does not yield any information beyond a positive or negative result and the University unit will not possess any detailed reports indicating specific detected substances, narratives such as medical review officer notes, or other similar information; and
  4. Information about student drug screenings will only be disclosed to a Host Site for the purpose of an audit or inspection and in accordance with applicable laws and regulations, including, but not limited to FERPA.

7.3 Navigate Opposition to University-managed Drug Screenings

A Host Site may refuse to allow University-managed drug screenings due to its own obligations relating to compliance, accreditation, insurance coverage, or similar matters. A University unit may still place students at that Host Site when it:

  1. Makes a good faith effort to negotiate in favor of University-managed drug screenings;
  2. Believes that an inability to place students at the Host Site would negatively impact student learning and/or diminish the quality of its experiential learning program and/or overall academic instruction;
  3. Adjusts its informal student-facing communications and its use of the Student Drug Screening Notice Template to:
    1. Identify the Host Site that refused University-managed drug screenings;
    2. Describe the nature of the Host Site’s drug screenings;
    3. Articulate the possible privacy impacts students may subsequently experience; and
  4. Establishes an arrangement that addresses the remaining considerations listed in Subsection 7.2 that do not relate to a University unit’s management of student drug screenings (i.e., considerations (a) and (d-g)).

Select and Use a Lab for University-managed Drug Screenings

When conducting University-managed drug screenings, a University unit must select and use a Lab.

8.1 Evaluate Potential Labs Contractors

To the extent possible, a University unit should select a Lab that:

  1. Is not part of, controlled by, or affiliated with a Host Site at which a student is placed;
  2. Poses the fewest financial and logistical burdens on students; and
  3. Has a medical review officer (or functionally equivalent role) to evaluate positive results by communication with a student to confirm legitimate substance use (such as attributing a positive result to a student’s prescribed medication).

8.2 Establish Expectations for Personal Data Processing

A Lab processes student personal data on a University unit’s behalf. As such, University units must incorporate the University’s Personal Data Processing Agreement into their underlying service agreement with a Lab. Further, a Lab may only provide results to a University unit upon a student’s written consent for release solicited by the Lab. Results provided to a University unit must exclude any breakdown of detected substances or any other information beyond a negative or positive indication.

Conduct University-managed Student Drug Screenings

University units that conduct University-managed drug screenings in connection with Host Site requirements must follow the process that appears on the University Privacy Office Managing Third-party Requirements for Drug Screening Students website. This process addresses initiation of a drug screening; student failures to complete a required drug screening; medical review officer evaluations of results; student consent for the release of results to a University unit; University unit personnel access to results; negative and positive result handling; retention; and limited access to and processing of student personal data.

Responsible Office and Additional Information

This Policy was developed by the University Privacy Office in collaboration with University units that require experiential learning at Host Sites with drug screening mandates. The policy is maintained by the University Privacy Office. For additional information relating to student privacy in connection with Host Sites’ drug screening requirements and/or the implementation and operationalization of this Policy, contact the University Privacy Office:

Website: UW Privacy Office
Email: uwprivacy@uw.edu
Phone: 206-616-1238