Student medical records should stay private with only a few, specific exceptions in cases where colleges that are sued need the information to defend themselves, according to draft guidance provided to colleges on Tuesday by the U.S. Department of Education.
The guidelines were issued in a blog post that sought to allay fears of what some observers called a privacy loophole that could make student counseling records vulnerable when cases go to trial.
The post, written by Kathleen M. Styles, chief privacy officer at the Education Department, was accompanied by a draft “Dear Colleague” letter that spells out when it would be permitted, or appropriate, for campus lawyers to pull such records. The department is giving colleges and privacy experts 45 days, until October 2, to comment on the proposed language.
Student-privacy protections became a hot-button national issue this year after a University of Oregon student who said she had been raped by three basketball players sued the university, claiming it violated her civil rights when university lawyers pulled her therapy records from a campus counseling center. That case has since been settled.
What remain unsettled are debates about the levels of privacy protections afforded to students who are treated in campus clinics and how they compare to protections patients receive when they’re treated off campus.
After the Oregon case was publicized, mental-health supporters and women’s advocates expressed outrage online and demanded clarification about what the Family Educational Rights and Privacy Act, known as Ferpa, allows colleges to do with students’ medical records. Ferpa is a federal law that provides privacy protections for student records, and colleges that violate it could lose their eligibility for federal student aid. It also provides assurance of confidentiality to students seeking support after a traumatic event.
Experts interviewed on Tuesday called the department’s approach a careful compromise that stops short of banning colleges from unfettered access to student records.
“It’s hard to say whether this will satisfy the concerns of people in the mental-health field who wanted the department to close the regulatory loophole completely,” said Peter F. Lake, director of the Center for Excellence in Higher Education Law and Policy at Stetson University.
“But what it does is clarify the narrow exceptions when medical records can be accessed and encourage lawyers to be very careful with records when they do use them.”
The Education Department said in March that Ferpa allows colleges that are sued to view records like those in the Oregon case to defend themselves, as long as no state laws prohibit that. Tuesday’s blog post made clear that colleges should do so only in very limited instances.
“Institutions of higher education have a strong interest in ensuring that students have uncompromised access to the support they need, without fear that the information they share will be disclosed inappropriately,” Ms. Styles wrote.
When lawsuits are filed, students should have the same basic privacy protections at an on-campus clinic that they would have in an off-campus hospital or clinic, she wrote. In other words, Ferpa protections should generally be comparable to those offered by the Health Insurance Portability and Accountability Act, or Hipaa.
“We want to set the expectation that, with respect to litigation between institutions of higher education and students, institutions generally should not share student medical records with school attorneys or courts, without a court order or written consent,” Ms. Styles wrote.
“The only exception is if the litigation in question relates directly to the medical treatment itself or the payment for that treatment, and even then institutions should only disclose those records that are relevant and necessary to the litigation.”
For example, if a student sued a college claiming the counseling services she received were inadequate, campus lawyers should be able to pull her counseling records without a court order.
But if the lawsuit concerned her eligibility to graduate, those records shouldn’t be turned over without a court order or consent. Nothing in the Education Department’s new guidance indicated that Oregon officials overstepped their authority in accessing the woman’s counseling records. However, its caution that colleges should pull such records only “in the rarest of circumstances,” such as when campus safety is threatened, raises questions about whether such a move was necessary.
Unintended Consequences
During the 45-day comment period, the department wants to learn whether its guidance will create any unintended consequences, like restricting the work of campus teams that assess whether accused students present a threat. It also asks whether there’s a way to mitigate the burden colleges will face if they have to get a court order or consent to access records.
Seeking input from the field before issuing formal guidance is “not unheard of, but unusual” for the department, said Daniel C. Swinton, managing partner of the Ncherm Group, a consulting and law firm that advises colleges.
“I appreciate that they’re opening this for public comment,” he said. “They’re really concerned about getting it right.”
Some experts would have liked to see stronger privacy protections that would ban colleges from accessing treatment records without a subpoena. That, said Mr. Swinton, would have hamstrung colleges that are sued over the treatment they provide students.
But he said he welcomed the fact that the department was urging institutions to be judicious about when they access records, and not to do it just because the law says they can.
“The feeling I got from this was, We’re trusting you to use your discretion to do the right thing,” Mr. Swinton said.
U.S. Sen. Ron Wyden and U.S. Rep. Suzanne Bonamici, two Oregon Democrats who had asked the Education Department to clarify the privacy protections for students, released a joint statement on Tuesday saying they were encouraged by the government’s response.
“All students deserve to be and feel safe at school,” Ms. Bonamici said. “The draft guidance acknowledges that personal information should stay private with very few, well-defined exceptions.”
Mr. Wyden said the Education Department “took an encouraging step” toward protecting the privacy of student medical records.
“Now, it’s critical that privacy experts and the higher-education community weigh in on the draft guidance to make sure colleges and universities are held to the highest possible standard when it comes to protecting student privacy.”
Katherine Mangan writes about community colleges, completion efforts, and job training, as well as other topics in daily news. Follow her on Twitter @KatherineMangan, or email her at katherine.mangan@chronicle.com.
