Blog

When FERPA Meets HIPAA

Posted by On Wednesday, March 18, 2015

Last week, we wrote about the dramatic rise in mental health issues among college students and the shortage of counseling services at some schools to meet this increased demand. This post looks at another potential barrier to students accessing mental health care created by the recent revelation that the University of Oregon accessed a student’s counseling records and gave them to its attorneys to help defend itself against the student’s lawsuit, which accused the school of mishandling her sexual assault complaint.

In its response to the student’s lawsuit, UOregon states that “governing laws permit and encourage collecting [counseling] records” to investigate the student’s claim that the school’s actions and inaction caused her emotional distress.

This argument raises the question: doesn’t HIPAA (Health Insurance Portability and Accountability Act) protect the confidentiality of these records? The answer is no. Under HIPAA’s regulations, student education records are not “protected health information” if they are covered by FERPA (Family Educational Rights and Privacy Act). [45 CFR § 160.103]

The Departments of Education and Health and Human Services anticipated the next question, “does FERPA or HIPAA apply to records at health clinics run by postsecondary institutions?” and provided an answer in their 2008 Joint Guidance document:

FERPA applies to most public and private postsecondary institutions and, thus, to the records on students at the campus health clinics of such institutions.

If FERPA protects the confidentiality of education records, doesn’t UOregon need the student’s consent before accessing and sharing a student’s education records? According to federal regulations, the answer is no if the records help the institution defend itself against the student’s lawsuit:

If a parent or eligible student initiates legal action against an educational agency or institution, the educational agency or institution may disclose to the court, without a court order or subpoena, the student’s education records that are relevant for the educational agency or institution to defend itself. [34 CFR § 99.31(a)(9)(iii)(B)]

However, we should point out that this rule doesn’t apply if the therapist doesn’t work for the university. In that instance, the student would be able to ask the court to look at the records and decide what was relevant before they were disclosed to the university, according to Gonzaga law professor Lynn Daggett.

A letter of concern from a UOregon Senior Staff Therapist first revealed that the student’s clinical records were accessed by the university without the student’s consent. To fulfill her professional duty to protect a client’s clinical information to the best of her ability, the UOregon therapist reported the disclosure of student records to the Oregon Board of Psychologist Examiners as “prohibited or unprofessional conduct.”

In response to the Letter of Concern, former law professor Katie Rose Guest Pryal researched the university’s right to use the student’s post-rape therapy records to defend against her lawsuit and discovered the “ugly truth” that FERPA allows schools to access records kept by the school’s mental health counselors. Pryal ends her piece with this advice for the Department of Education: “Fix this devastating privacy loophole” because UOregon’s action “could well chill the desire of students to seek support at university counseling centers everywhere.”

However, the Joint Guidance is clear that the disclosure by UOregon does not require student consent:

If the institution chooses to do so, a disclosure may be made to any party with a prior written consent from the eligible student (see 34 CFR § 99.30) or under any of the disclosures permitted without consent in 34 CFR § 99.31 of FERPA.

In response to the outcry over UOregon providing a student’s treatment records to its attorneys, the Department urged “higher education institutions to not only comply with FERPA, but also to respect the expectation of confidentiality that all Americans hold when talking to a counselor or therapist.”

This debate occurs at a time when a sexual assault victim’s confidentiality is a central issue in creating a safe and supportive environment to encourage victims to come forward. Moreover, the expectation of confidentiality is not just a concern for victims but also should concern students accused of sexual assault who have sued schools, claiming their due process rights were violated.

Title IX guidance says topics covered in student prevention training should include “reporting options, including formal reporting and confidential disclosure options …” In addition, schools need to make sure that their “professional counselors, pastoral counselors, and non-professional counselors or advocates also understand the extent to which they may keep a report confidential.”

Last week, UOregon’s interim general counsel told the school’s Senate committee, “in hindsight, he would have acted differently before requesting copies of a student’s confidential therapy records.” Unfortunately, a UOregon law professor, who is also a member of the committee, has already seen the chilling effect of this action, “Students now have a perception that their records are not safe . . . I have seen it in my work, and it is devastating.”

Now UOregon’s committee is drafting a policy to prohibit attorneys or school administrators from accessing a student’s counseling or therapy records without the student’s consent. To avoid the devastating effects of silencing students who need help, other schools may want to consider adopting similar policies to reassure students that their confidential resources really are confidential.

Talk About It!Share on Google+Tweet about this on TwitterShare on FacebookShare on LinkedInShare on TumblrEmail this to someone