Assignment for U.S. colleges: privacy laws 101

By Nora Lockwood Tooher

Jolted by the Virginia Tech shootings in April 2007 and a state panel’s report critiquing the university’s response, colleges are re-examining how to deal with troubled students, while maintaining students’ privacy rights.

The panel’s report by a state panel, which was released in late summer, said there is “widespread confusion about what federal and state privacy laws allow.”

A maze of federal and state privacy laws currently govern the release of student records. The Family Educational Rights and Privacy Act (FERPA) applies to educational records, while HIPAA governs medical records.

State laws and professional ethics also control what information can be disclosed without a student’s consent.

“There is a great deal of confusion in the administrative suites on college campuses right now – both about the extent to which the federal rules in either HIPAA, FERPA or both apply to student health records, and about the balance between the responsibility of a college to protect the student body in general and its obligations toward individual students,” said Dr. Paul S. Appelbaum, director of the division of psychiatry law and ethics at Columbia University’s psychiatry department in New York.

FERPA and HIPAA allow disclosures if a student is deemed to be a risk to himself or others. But Janet E. Walbert, vice president for student affairs at Arcadia University in Glenside, Pa., and president of the National Association of Student Personnel Administrators, said administrators and staff are often confronted with gray areas in determining whether to disclose confidential records.

“If a counselor knows a student acts out under the influence of alcohol, but doesn’t know if the student will drink that night, is there an imminent threat?” she asked.

Robert B. Smith, head of the college and university practice group at Nelson, Kinder, Mosseau & Saturley in Boston, and former associate general counsel for Boston University, said that because the exceptions are ill-defined, college administrators are wary about disclosing information.

“You still have to have someone on the campus make a judgment, and, of course, in the litigious society we live in, administrators are concerned and constrained from doing that,” he said.

Confusion reigns

Gary Pavela, director of judicial programs at the University of Maryland, contended, however, that problems related to privacy laws and student confidentiality “appear to [stem from a] lack of information about the laws, not the laws themselves.”

Federal privacy laws are “really not an obstruction to sharing information with parents or releasing information to law enforcement,” he said.

But the Virginia panel’s review of student privacy laws cited a “widespread lack of understanding, conflicting practice and laws that were poorly designed to accomplish their goals.”

In addition to exemptions for “health or safety” emergencies, FERPA allows the release of information to parents if the student is under 21 and has had a drug or alcohol violation, or if parents claim the student as a dependent for tax purposes.

But few parents or colleges are aware of the loopholes, several experts said.

Some colleges also offer waivers student can sign, authorizing the release of records to their parents. But the forms do not require the schools to release information, and many schools withhold academic and health records even after students sign the waivers, according to privacy law experts.

While much of the state panel’s report was aimed at clarifying student privacy laws, some of its findings may have actually increased confusion.

For example, Appelbaum noted, it had been assumed that student health records were not covered under FERPA because they aren’t educational records. But the panel’s report included two letters from the Department of Education indicating that such records are covered under the Act.

The education department letters “also contained some confusing analysis as to why FERPA applies and what the limits on disclosure are,” he added. “I suspect will be hearing calls for still greater clarification from DOE and perhaps for reconsideration of some of the conclusions they reached.”

ADA issues

Fueling the legal and ethical dilemmas surrounding students’ mental health records is the growing number of college students who suffer from depression.

According to the 2006 National College Health Assessment, 44 percent of almost 95,000 students surveyed said they “felt so depressed it was difficult to function” during the past year; 9.3 percent had seriously considered suicide during the year.

Several experts said they fear that colleges – in their haste to lower the risk of student suicides and violence – may trample student rights.

“The tendency of some campuses to want to exclude students as soon as they manifest any kind of behavioral or emotional problems runs a strong risk of violating student rights under the ADA,” Appelbaum said.

Concerned about liability, some colleges in the past several years have expelled students with mental health problems. (See “Suicide suits put universities in a tight spot,” Lawyers USA, May 22, 2007. Search terms for Lawyers USA Archives: Gertner and Broe).

George Washington University in Washington was sued after it forced a student to leave who had sought help for depression at the university’s counseling center. The case was settled last year.

Hunter College in New York settled a similar lawsuit last year for $65,000. The suit had been brought by a student who had been locked out of her dorm room by campus security after she was hospitalized for a suicide attempt.

“My concern is that schools will over-react even more, and because of Virginia Tech, will stereotype students with mental illness,” said Karen Bower, a senior staff attorney with the Bazelon Center for Mental Health law in Washington, which represented the students.

Bower said she fears that campus counselors will be pressured to disclose confidential information to college administrators.

“Confidentiality is very, very important. If there’s no confidentiality students will be discouraged from getting treatment,” she said. “But the other piece is I would hope there would be an environment where you could go to the dean and say you are feeling suicidal and the dean would get you help and not kick you off campus.”

Last year, before the Virginia Tech shootings, Virginia became the first state to pass legislation barring public colleges and universities from punishing or expelling students “solely for attempting to commit suicide, or seeking mental-health treatment for suicidal thoughts or behaviors.”

Erring on safety’s side

According to Karen-Ann Broe, senior risk analyst for United Educators, an educational insurance company in Chevy Chase, Md., most colleges are in the process of setting guidelines for sharing information with non-health personnel on campus, such as campus affairs, public safety and student affairs; non-campus agencies, such as police and mental health centers; and parents.

“I think there has been a reluctance to share information internally within campuses about at-risk students – those that have some increased risk of violence to themselves or others – and that’s been because of a misunderstanding of the legal requirements and out of deference to student privacy and not wanting to stigmatize students,” she said.

While those concerns are legitimate, colleges’ reluctance to identify and deal with at-risk students may have gone too far, she said.

“Colleges realize they’ve got to balance student privacy with student safety,” Broe commented.

Smith said he advises college administrators: “If you are caught between a rock and a hard place in terms of someone’s privacy concerns and your legitimate concerns that they are going to hurt themselves or others, you’d much rather have the privacy lawsuit than the death lawsuit.”

Panel recommends revising privacy laws

A report by a state panel studying issues related to the Virginia Tech shootings has recommended overhauling student privacy laws to better share information about at-risk students.

The panel’s recommendations include:

Revising privacy laws to include “safe harbor” provisions that insulate colleges from liability for disclosing records based on a good-faith belief that the disclosure was necessary to protect the health and safety of the person involved or the general public.

Amending the Family Educational Rights and Privacy Act (FERPA) to explicitly explain how it applies to medical records, and whether it preempts state law regarding medical records.

Creating an exception under FERPA for disclosing treatment records from university clinics to off-campus health care providers.

Allowing more flexibility in interpreting FERPA’s emergency exception. The regulations currently allow the release of records when disclosure is needed to protect the health or safety of

either the student or other people. The panel said the limitations on what constitutes an “emergency” feed the perception that non-disclosure is a safer choice.

The panel also recommended that universities give college law enforcement, medical providers and others who assist troubled students the authority to share student records.

Questions or comments can be directed to the writer at:

© 2007 Lawyers Weekly Inc., All Rights Reserved. Redistributed with permission. Internal Use Only.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s