Lawsuit against University of Oregon highlights problems with FERPA

A lawsuit filed against the University of Oregon by a victim of sexual assault has brought to light a little remarked upon exception to students' medical confidentiality rights, the Chronicle of Higher Education reported on March 2.

The University of Oregon asserted in its defense that it had a legal right to usestudents' college counseling center records against them.Princeton University is also currently facing a lawsuit in federal court from a student whoalleges in part that the University violated his medical confidentiality.

The alleged exception to the Family Educational Rights and Privacy Act could apply to students nationwide, including at the University, if upheld as a valid interpretation of the law.

The Chronicle of Higher Education wrote that the University of Oregon's defense appears to be correct.

The Department of Education has concluded universities can disclose educational records to courts without a court order or student consent because institutions should not have to subpoena their own records and should not be powerless to defend themselves, department guidelines say.

Counseling and Psychological Services is bound not only by FERPA but also by its own policies and the laws that govern licensure for its personnel, University spokesperson Martin Mbugua noted.

CPS guidelines say that the exceptions to requiring student consent for disclosure of medical records are rare and include certain circumstances, such as under court order, as required by law, in an emergency or life-threatening situations and in order to assure continuity of care for students with psychological andphysical conditions, among other situations.

The ethical policies of both the American Counseling Association and the American Psychological Association require that a therapist's records can only be disclosed to a court under a court order, so insofar as an educational institution respects those guidelines, a student's records are not at risk.

However, in the University of Oregon case, the records appear to have been disclosed legally without the student's and therapist's consent, since the ACA and APA guidelines are not binding and the University of Oregon maintained ultimate control of medical records at its counseling center.

Education records refers to any record about a student that is “personally identifiable,”Steve McDonald,general counsel at the Rhode Island School of Design and a well-known expert on FERPA, explained.

A financial aid record, an exam score or a medical treatment record are all considered educational records, he said.

“FERPA becomes questionable with records that are only vaguely educational records — for instance, mental health records,” Bill Koski, a litigator and law professor at Stanford University, said.

Get the best of ‘the Prince’ delivered straight to your inbox. Subscribe now »

FERPA is not all bad in that it gives students the right to control the disclosure of their education records to others, inspect and review their own education records, and seek amendment of their education records, Koski said.

To ensure safety for students, universities require more access to student records in terms of mental health issues than in a normal patient-therapist relationship, Ann Bartow, a professor at the Pace Law School and amember of the advisory of the Electronic Privacy Information Center, said.

“I don’t think theyneed quite so much [as given under FERPA],” she said.“I think the law can be re-written in a way that gives the university the access it needs to keep students safe but still is a little more reasonable and gives students some privacy."

The case at the University of Oregon has since brought up many issues regarding FERPA.

“I think this case is appalling,” Bartow said. “Students are very exposed.”

Dahlia Kaki ’18 said she thinks it is definitely a violation of a student’s privacy when a university accesses mental health records without the student’s consent, adding the limitations to the protection offered by FERPA would make her reconsider seeking treatment from CPS.

Molly Strabley ’17 also said that she feels less inclined to seek help at CPS for fear that her own private records could be made public or used against her in a courtroom.

“I find it concerning,” Strabley said.

The law is not always clear enough about when a student's records can be shared, and FERPA inexplicably overrides patient confidentiality in the case of college students, Koski said.

The patient confidentiality law in Oregon may also be at fault, McDonald said.

“FERPA was never meant to provide medical record protection," he said. “The real issue with the Oregon case is the patient confidentiality law of Oregon. This is not something FERPA was really meant to protect.”

Normally, theHealth Insurance Portability and Accountability Act provides protection for patient medical records, but according to Department of Education guidelines, HIPAA does not usually apply to college students obtaining treatment at college-run medical centers.

When asked how protective FERPA was for students’ records on a scale of one to ten with ten being the best, Bartow said, “Three at the most.”

She added that students should try to clarify with their universities their exact policy in relation to FERPA and attempt to spark change as necessary.