The accusations leveled this week against Harvard University — essentially, that it failed to protect students from a predatory professor — feel uncannily like a bad rerun. Here’s how the story goes:
A valuable higher-ed commodity (say, John Comaroff) is recruited from one institution to another (say, Harvard). The new institution ignores warnings that the recruit was previously accused of predatory behavior. Surprising no one, the recruit is later accused of continuing to harass and threaten students. Eventually, after navigating institutional hurdles, the students force the university to begin a sexual-misconduct investigation.
Then comes a very specific detail: The university unethically and perhaps unlawfully accesses a complainant’s mental-health records and uses them to discredit her. The end.
What kind of garbage B-movie is this? And why do we have to keep watching it?
Seven years ago, while whispers about Comaroff were already circulating at Harvard, the University of Oregon made the news for reasons it deeply regretted. A student who said she had suffered a brutal gang rape brought a lawsuit against the university, alleging that Oregon had recruited one of the accused, a basketball player, despite knowing that the player had been kicked off his prior team at another college while under investigation for gang-raping a student there. The plaintiff also alleged that the university had mishandled her on-campus complaint, and had, without her consent, taken her therapy records and handed them over to the general counsel’s office in anticipation of litigation. This was true — the records-grab came to light via a whistleblower in the counseling office.
Astonishingly, this move was legal. Here’s why: When students seek medical care, including mental-health care, on campus, their records are not nearly as well-protected as you might think. Rather than being covered by Hipaa (the Health Insurance Portability and Accountability Act), the law that protects medical privacy, the records of students who seek care at on-campus student-health centers are covered only by Ferpa (the Family Educational Rights and Privacy Act), the law that protects student privacy. As I wrote at the time, “compared with Hipaa, Ferpa is about as protective as cheesecloth.”
Ferpa allows on-campus health centers to release a student’s medical records, including mental-health records, to college officials under certain circumstances. One of those circumstances is when the student and the institution are involved in litigation. Were students’ treatment records protected by Hipaa, the bar for access would be much higher: The university could only get those records through the legal process of discovery, overseen by a judge.
The University of Oregon ultimately settled with the victim for $800,000, and the lawsuit helped tighten the Ferpa loophole for student medical records. I worked with Congresswoman Suzanne Bonamici of Oregon to try to correct the problem. Bonamici led the way to tighter laws protecting student records in Oregon. At the federal level, she pushed the Department of Education to release a “Dear Colleague” letter providing new, stricter guidance on Ferpa, treatment records, and litigation. (The letter is not law, but rather policy guidance on how existing law should be interpreted.)
The letter urges higher-education institutions to give student medical records greater protection, similar to that of Hipaa, particularly “in cases where litigation occurs between the institution and the student.” As a policy argument, the letter also points out that failing to protect student privacy “could deter students from taking advantage of critical campus resources.”
However, none of this advice changed Ferpa’s fundamental provisions. If a student sues her university, the university can still access that student’s campus mental-health records outside of normal litigation channels. The advice I gave in 2015 thus remains the same: If you’re raped on campus, don’t seek therapy through your college health center.
Now, a new lawsuit against Harvard University has apparently rendered my (at the time, radical) advice moot.
The case, brought by three graduate students in anthropology, accuses Harvard of a “decade-long failure to protect students from sexual abuse and career-ending retaliation” by the anthropology professor John Comaroff. Reporting in these pages and elsewhere has detailed the background to the accusations.
One of the most shocking allegations centers on the question of medical privacy. According to the complaint, Harvard managed to obtain the mental-health records of one of the plaintiffs, Lilia Kilburn, from an off-campus psychotherapist in the course of a campus investigation into Comaroff’s misconduct. Kilburn says she did not agree to this release: “In 2020, ODR [the Office for Dispute Resolution] contacted Ms. Kilburn’s psychotherapist, a private therapist unaffiliated with Harvard, and obtained the psychotherapy notes from her sessions with Ms. Kilburn. ODR did not obtain Ms. Kilburn’s consent for the release of those records.”
The complaint also alleges that after Harvard got Kilburn’s mental-health records, it made those records available to Comaroff and “anyone with access to the final report,” despite the plaintiff’s attempts to get the university to lock down access. Comaroff then allegedly used Kilburn’s medical records to claim that she “imagined that he sexually harassed her,” citing her diagnosis of post-traumatic stress disorder. (The complaint alleges that Kilburn developed PTSD because of Comaroff’s sexual harassment.)
These claims are shocking. The Ferpa medical-records exception allows for records-grabbing during litigation and only from institutionally affiliated professionals. Both of those conditions were met in the Oregon case. Neither is met here.
If the allegations in the complaint are true, then the therapist violated Hipaa, and the university was complicit in that violation. Harvard does nothing by halves, it seems.
Harvard denies taking the medical records without consent. In a statement, Nicole Merhill, director of the Office for Gender Equity and the university’s Title IX coordinator, writes that the office responsible for investigating sexual misconduct “does not contact a party’s medical care provider except when a party has indicated that the provider has relevant information that the party wants ODR to consider.” The office would acquire such information “only with the party’s consent.” In short, Merhill does not deny that Harvard got its hands on Kilburn’s mental-health records — but she asserts that any records-grab was done lawfully. Her words imply that Kilburn consented to the records’ release.
Merhill also expresses concern about the complaint’s “potential chilling effect” on students’ willingness to seek counseling. The chilling effect Merhill fears is real, but it isn’t new. Seven years ago, I wrote that, barring legal change, students should seek mental-health treatment off campus to protect their privacy. Now that an off-campus therapist is implicated, the situation is much worse.
You might hear some people say that treatment records that are relevant to a lawsuit such as this one will “just come out in discovery” — the information-gathering process that precedes trial — so it doesn’t matter if Oregon or Harvard or Petunia Community College takes them without permission. Those people would be wrong. Luke Honeycutt Everett, a clinical professor of law at the University of North Carolina at Chapel Hill, told me, “While lots of information changes hands in discovery, it’s not a free-for-all; it comes with safeguards.” A judge supervises what is released, to whom it is released, and what is made public and what is not. Lawyers can raise objections about what is relevant, and judges make rulings on those objections. To get information from a third party, a subpoena must be issued. When done properly, the process provides a measure of privacy protection.
And to get medical records through the discovery process, a case must make it to discovery in the first place. Cases that settle early might not reach discovery at all. As every lawyer knows, most cases settle.
If the therapist in the Harvard case was indeed not university-affiliated, and Kilburn indeed did not sign a release allowing the therapist to share the records with Harvard, then the only way Harvard should have been able to get its hands on the records is via subpoena in discovery — that is, during litigation. An on-campus adjudication is not litigation. Too many questions are left unanswered here.
Harvard doesn’t deny having Kilburn’s records, but it denies obtaining them unlawfully. So how did the university get them?
We just don’t know.
There’s a larger question here: Why bother going after a plaintiff’s mental-health records at all?
In cases where plaintiffs allege emotional distress, such as this one, mental-health records may help prove or disprove such a claim. That could be part of what’s going on here.
But something more insidious underlies records-grabs in sexual-harassment cases like this one. In our justice system, any mental-health issues damage witness credibility. This is especially true in cases of sexual assault. For example, police officers find sexual-violence victims with mental-health problems seven times less credible. Sexual-violence defendants and their proxies know that mental illness makes a victim less credible and use it to their advantage.
It’s no surprise, then, that any institution would hunt down the mental-health records of a woman bringing a sexual-misconduct complaint against one of its most decorated professors (or prized athletes). After all, the best way to diminish a victim of sexual violence is to argue that they’re hysterical. Ask Freud.
Attacks on victims’ credibility based on their mental health are persistent and widespread. They represent a rot at the core of our justice system. Harvard’s Title IX coordinator got one thing right: We need our students to trust counselors on and off campus — especially now, as the pandemic has pushed students’ mental health to the brink. Let’s not shatter students’ trust in the people who could help them most.
