(888) 407-0224
Univ. of Oregon’s Dana Altman (image credit: wikipedia)
Previously, we blogged about how the University of Oregon accessed a student sexual assault survivor’s therapy records in December of 2014, prior to the victim’s filing a lawsuit against the school and men’s basketball coach Dana Altman. The survivor, known only as Jane Doe, filed suit in January 2015, alleging that the school mishandled the inquiry into her rape by three basketball players, one of whom was known to have sexually assaulted another student at his prior college.
Jane Doe also alleged that the University illegally accessed her school therapy records without her permission, in violation of federal law. In a January 2015 letter, the student’s therapist, along with other counseling center staff, blew the whistle on the school’s actions, confirming that the university did in fact access the victim’s clinical records “without the client’s permission or consent and without proper authorization prior to any litigation occurring.”
UO counter-sued the victim in February 2015, but dropped the suit in response to public outcry against the absurdity of their claim. However, the school continues to defend the suit, and maintains its position that accessing Jane Doe’s therapy records was legal under the federal Family Educational Rights and Privacy Act (FERPA).
Terrifyingly, the university may be right, at least as to the legality of accessing the victim’s medical counseling records.
Generally, medical record privacy is guaranteed by the federal Health Insurance Portability and Accountability Act (HIPAA). HIPAA’s strict protections prohibit unauthorized disclosure of such records without express consent by the patient. Furthermore, therapy records are included under HIPAA’s broad definition of “medical records,” and are therefore protected.
Typically, medical privacy can only be breached in certain legal settings, such as when a plaintiff files a lawsuit alleging emotional distress damages or where a patient sues a health-care provider for malpractice. In those instances, the medical/therapy records become material evidence to determine the extent of the plaintiff’s actual emotional damages, or to determine whether the medical provider had breached the applicable standard of care.
Common sense would therefore indicate that student therapy records would be protected from disclosure under HIPAA, unless and until the student files suit and places the content of those records in issue. Here, the University of Oregon accessed Jane Doe’s medical records without her permission and prior to her filing any kind of lawsuit (much less one that placed her therapy records in issue), and so the University’s actions appeared to be illegal. So thought the victim’s lawyers, her own therapist, and the victim herself – thus, Jane Doe alleged that the school had violated her rights under HIPAA.
The University fired back, arguing that its actions in accessing Jane Doe’s therapy records was not in violation of HIPAA, and was in fact legal under FERPA. Although this argument at first seemed tenuous, it turns out that the school may be right. This is because the education laws and medical laws overlap in confusing ways.
The federal Family Educational Rights and Privacy Act (FERPA) applies to most colleges and universities, and prohibits educational institutions from disclosing students’ education records to third parties without consent. While the law does provide some enforcement mechanisms, those protections are not nearly as strong as HIPAA’s.
RELATED NEWS: Woman Recounts Rape by Four Men near OSU Campus
Furthermore, whatever safeguards FERPA may afford, those protections do not appear to extend to inter-organizational access of educational records, such as when university staff or employees access the student’s educational records, as opposed to instances where those records are provided to an unauthorized third party.
Most importantly, however, a loophole in the law provides that “the records on students at the campus health clinics of such institutions” are not considered medical records. Instead, such records are considered educational or treatment records, and are excluded from the HIPAA Privacy Rule. In other words, college medical records apparently do not count as “real” medical records, at least for privacy purposes.
The difference between “treatment” and “educational” records likewise provides no additional protections for students such as Jane Doe, because the same disclosure rules apply. Specifically, “[A] school may disclose an eligible student’s treatment records for purposes other than the student’s treatment provided that the records are disclosed under one of [FERPA’s] exceptions to written consent.” Of those exceptions, one explicitly pertains to instances where the student threatens or announces their intent to file a lawsuit against the school.
Thus, contrary to a plain reading of medical privacy laws, the University of Oregon can lawfully access the therapy records of a rape survivor in order to defend itself from a potential but unfilled lawsuit by a victim who has not yet alleged emotional or psychological damages and which has nothing to do with therapy or medical malpractice.
In light of the extreme stigma, shame, social and legal challenges, and victim-blaming that survivors of sexual assault are forced to face on a regular basis, this result is – to put it bluntly – absolutely horrifying. This loophole has wide ranging and devastating implications for victims of sexual violence, including intimidating survivors from reporting their assault, discouraging them from seeking medical care, therapy and counseling, and generally instilling an even greater sense of distrust of institutions purporting to care for the lives and health of those they are ostensibly designed to protect.
These concerns are exacerbated when one considers the fact that many college attendees can only afford student health insurance, and such policies generally do not cover the costs of visiting a therapist or mental health provider outside of the university’s network. Due to this unfortunate reality, many sexual assault victims will be forced to choose between seeking free medical assistance from their school but not protected by federal privacy laws, or foregoing any such treatment as simply too cost-prohibitive.
In response to the alarming consequences of such a law, on Wednesday, March 11, 2015, Representative Suzanne Bonamici (D-Ore.) issued a letter to the U.S. Department of Education in which she expressed concern that the current federal law permits universities to review a student’s medical records without their permission. In particular, Rep. Bonamici said that she is “troubled that there appears to be a loophole in federal privacy law that allows the personal and private conversations a student has after a traumatic experience to be released by a university under the laws governing educational records,” and noted that “students who seek treatment on campus deserve the same level of privacy as other patients, whose medical records are protected under federal health law.”
Rep. Bonamici inquired as to whether any federal law or guidance prevents a school from sharing students’ medical records with “other offices of an institution that are not involved in students’ treatment” and if there’s any law limiting “whether an institution may declare that a treatment record is being used for a non-treatment purpose.”
Similarly, on March 12, Senator Ron Wyden (D-Ore.) also issued a letter to Education Secretary Arne Duncan, in which he expressed concern about rules that govern medical information collected by campus health facilities, particularly in cases of sexual assault.
Although neither Sen. Wyden nor Rep. Bonamici has yet received a response from the Department of Education, both congress members are currently considering drafting legislation amending FERPA and/or HIPAA to remedy this serious loophole. Such a law would be both welcome and necessary to protect the privacy rights of victims of sexual abuse on campus.
If you are interested in writing to your Congressional Representative(s) to demonstrate your support for a law protecting student privacy, you may follow this link to look up his or her contact information.
In addition, if you or someone you know would like to speak with someone on a confidential basis, you may call us toll free at 1-888-407-0224 or email us at info@oandc.com.
