In a recent draft “Dear Colleague Letter,” the U.S. Department of Education explained that the Family Educational Rights and Privacy Act requires institutions to weigh competing interests before disclosing student health records in litigation between the student and the college, and even then to disclose only those portions of the confidential records directly relevant to the litigation.
Understand the background
Under FERPA, colleges generally may not disclose a student’s education records without the parent’s or student’s consent. There are, however, exceptions justifying disclosure, including: (1) where the records are relevant to litigation between the college and the student, (2) where college officials have a legitimate educational interest in the records, or (3) where the student poses a clear and significant threat to self or others.
Student health records usually education records protected by FERPA
FERPA defines “education records” to include records directly related to a student and maintained by the college or a party acting for it. Student health records usually fall under that definition.
Although FERPA excludes “treatment records” from the definition of education records, this distinction often proves illusory. For example, FERPA allows treatment records to be disclosed under the same circumstances that education records may be disclosed.
Moreover, the definition of treatment records is narrow, extending only to records made or maintained by professional treatment providers, such as doctors, made or used only in connection with treating the student, and shared with no one other than the treatment provider or other appropriate professionals of the student’s choice. Therefore, if treatment records are shared with anyone — including the student — then the records cease to qualify as treatment records and instead become education records.
The practical impact from the college’s perspective is this: If one of the applicable FERPA exceptions applies, then student health records may usually be disclosed subject to the terms, conditions and limitations of the particular exception and the DCL guidance discussed below.
What about HIPAA?
The Privacy Rule under the Health Insurance Portability and Accountability Act imposes no separate bar to disclosure, because FERPA education records are expressly excluded by the HIPAA Privacy Rule. Even before the DCL, the ED and the U.S. Department of Health and Human Services issued joint guidance further explaining this and other aspects of the relationship between FERPA and HIPAA (www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/hipaaferpajointguide.pdf).
Understand DCL’s impact
The DCL claims neither to expand nor to contract the requirements of FERPA and its regulations. However, it does clarify the ED’s views on when student health records may be accessed without consent in connection with litigation.
The DCL explains that the college should treat disclosure of student health records with heightened sensitivity. Therefore, the DCL encourages colleges to weigh not only what FERPA allows colleges to do, but also the student’s reasonable expectations that the records be kept private, the impact of sharing such records, and the necessity of the disclosure.
In litigation between a student and a college, the DCL also suggests that the FERPA consent exceptions should be construed to offer protections similar to those provided under the HIPAA Privacy Rule in litigation between a health care provider and patient.
The ED appears to be saying the college may disclose student health records only if the lawsuit relates directly to the medical treatment or the payment for such treatment. The DCL offers the following example: If an institution provided counseling services to a student who later sues the institution claiming the counseling services were inadequate, the institution could disclose the counseling records without consent.
The example, however, leaves many questions unanswered. For instance, what if the student were to file a personal injury lawsuit against an institution and allege emotional distress damages? Counseling records could be relevant and admissible to prove the nature and extent of the student’s alleged emotional distress, even though the lawsuit doesn’t directly relate to the counseling.
Or, what if the student were to sue the college for alleged disability discrimination? The student’s medical records might well be relevant and admissible on the issue of the student’s actual or perceived disability, even though again the lawsuit doesn’t relate directly to the medical treatment.
Review practical advice
In short, although the DCL doesn’t claim to expand or contract the exceptions allowing disclosure of student health records, it does urge institutions to exercise heightened discretion and judgment when deciding whether to disclose such records without consent in connection with litigation between the college and the student or parent. And where the institution does decide disclosure is appropriate, it should disclose only such information that’s relevant and necessary to the litigation.
Colleges should bear in mind that applicable state law may provide more strict privacy protections than FERPA, in which case FERPA won’t pre-empt state law.
Finally, because the public comment period on the draft DCL closed on Oct. 2, colleges should continue to monitor the ED’s actions, which could include issuance of a final DCL or even standard rule-making.