In January, a rape survivor sued the University of Oregon for mishandling her sexual-assault case. Through the campus judicial process, the university found the three male students responsible for gang-raping her (not the technical term). They were kicked off the varsity basketball team and eventually out of school. But there is a lot more to the story, including the ways that the university delayed the investigation of the students long enough so that they could finish up their basketball season.
The story is long, and it might destroy your faith in humanity, even if the university did drop its counterclaim against the survivor last week. In that counterclaim, Oregon had accused her of “creating a very real risk that survivors will wrongly be discouraged from reporting sexual assaults.”
But I want to focus on only one sliver of this case—one ugly, frightening sliver. I guess we can thank the university’s administration for shining some daylight on the legal quirk that I’m about to talk about, because otherwise it might have stayed hidden.
The Oregon administration accessed the rape survivor’s therapy records from its counseling center and handed them over to its general counsel’s office to help them defend against her lawsuit. They were using her own post-rape therapy records against her.
It was a senior staff therapist in the counseling unit who blew the whistle on the administration’s actions. In her public letter, she sounds horrified that the work she thought was protected by medical privilege could be violated in such a fashion.
The university came firing back, arguing that because the rape survivor had asserted a legal claim of emotional distress, Oregon was entitled under, of all things, the Family Educational Rights and Privacy Act to use her medical records to defend against her suit.
When I read the university’s defense of its actions, I had to laugh. Medical privacy typically can be breached in a lawsuit setting only when a patient sues a health-care provider for malpractice. In those instances, the medical records become material evidence to determine whether the provider had breached medical standards of care.
In the lawsuit, it appears that the rape survivor has not asserted any claim of malpractice against her therapist. Indeed, her therapist—and the entire department in which the therapist works—is standing up for the rights of the rape survivor.
How in the world could the university claim that it, as a party outside of this therapeutic relationship between the client (the rape survivor) and the therapist, have a right to access her medical records for litigation defense? That goes against everything I ever learned studying law, teaching law, and practicing in the malpractice courtroom.
However, after researching Oregon’s argument, I stopped laughing. Because it appears that the university was right. By an education-law loophole, it does have a right to her records under Ferpa. And that means everything has to change.
If you are a student and seek counseling at your college’s counseling center, your medical records are most likely not protected by the typical medical-privacy laws, otherwise known as the Health Insurance Portability and Accountability Act. Instead, they fall under the aegis of Ferpa, just as Oregon said. And compared with Hipaa, Ferpa is about as protective as cheesecloth.
When the university accessed the rape survivor’s medical records, not even her own therapist knew that the university’s actions were probably legal. That’s because the education laws and medical laws overlap in confusing ways.
The U.S. Education Department recognized this confusion and put out a frequently-asked-questions sheet on its website (latest update, 2008) to clarify matters. This document contains sections that address the very issue that arose at Oregon.
Now, you may know that Ferpa applies to most colleges and universities. What you might not know is that, as the FAQ states, Ferpa therefore applies to “the records on students at the campus health clinics of such institutions. These records will be either education records or treatment records under Ferpa, both of which are excluded from coverage under the Hipaa Privacy Rule.” In plain English, college medical records simply do not count as real medical records, at least for privacy purposes.
Although Ferpa provides a slightly different definition for “treatment records” than for “education records,” the difference is, shall we say, academic, because the same disclosure rules apply: "[A] school may disclose an eligible student’s treatment records for purposes other than the student’s treatment provided that the records are disclosed under one of [Ferpa’s] exceptions to written consent.” And one of those exceptions to disclosure with consent? When the student sues the institution.
The university is right, under the law. It can access the therapy records of a rape survivor in order to defend itself against a lawsuit that has nothing to do with therapy malpractice. That is the ugly truth of this case.
What does this ugly truth mean for you, if you are a student, or for your students, if you teach at an institution?
I’ve spent a lot of time thinking about the stigma and other challenges faced by rape survivors and by people with psychiatric disabilities (that is, mental illness). In other words, about the challenges faced by people who seek counseling.
My advice is simple.
Students: Don’t go to your college counseling center to seek therapy. Go to an off-site counseling center. If, God forbid, you’ve been sexually assaulted, try to find a rape-crisis center. It will have wonderful people to talk to, free of charge. (I know from personal experience.) You simply do not have adequate privacy protections if you go to a college-provided counselor. Sorry. (Or, in the University of Oregon’s case, sorry not sorry.)
Instructors: Don’t advise your students to seek counseling in the on-campus counseling center. There is no way that, in good conscience, I can ever give that advice again. If you have a student in crisis, help that student find support off campus.
The problem with my advice, of course, is one of money—serious money, in some instances. Many student-health plans will not pay for students to see a counselor who is not at the institution’s own counseling center.
In other words, a student’s insurance purchased through a college will pay only for a counseling benefit that lacks adequate medical-privacy protection from the very institution that sold the student the insurance. And a student-health plan is all many students can afford.
So for them, stuck between unaffordable therapy in a safe space and free therapy provided by an institution they are unsure they can trust, what then?
The University of Oregon has shown that when administrators are desperate, when they want to use ugly tactics to intimidate a student who is challenging the status quo, they will. And even if Oregon is an outlier, its initial action could well chill the desire of students to seek support at university counseling centers everywhere.
So my final piece of advice is directed to the U.S. Education Department: Fix this devastating privacy loophole.
Katie Rose Guest Pryal, a columnist for The Chronicle’s Vitae, is a former professor of law at the University of North Carolina at Chapel Hill who specializes in higher education, mental health, and social-justice issues.
