Confidentiality Guaranteed (Unless You Sue The School)
March 5, 2015 8:15 AM   Subscribe

When a female student sued the University of Oregon over their manipulation of the punishment of three basketball players for gangraping her in order to allow them to compete in the NCAA Tournament, the university came up with a novel defense strategy: they released her records from the campus health center from when she sought therapy after the rape to their legal team. Without either consent from the student or a legal order opening the records to discovery. The scariest part: they may very well be in the legal clear.

The issue ultimately stems from the interaction between two laws - HIPAA, which governs the privacy of medical records; and FERPA, which governs the privacy of school records. Oregon's assertion is that:

* Campus health centers fall under an exemption to HIPAA in FERPA, meaning that the latter governs them.
* FERPA allows for confidentiality of these records to be breached without consent in a few cases.
* One of those cases is when the student sues the school.

Needless to say, this is an incredibly dangerous position for a Oregon to take. Not just for rape victims, who already have a number of reasons to avoid on-campus support structures, but also for any student who may be seeking mental health services, and cannot afford to see anyone off-campus.

Deadspin has more on the case, including an allegation by one of the senior therapists on staff at the UO clinic that she was pushed by senior officials to provide the woman with "non-standard care".

(H/T to gingerest, who posted about this in this prior thread. )
posted by NoxAeternum (67 comments total) 20 users marked this as a favorite
 
...I'm scared to try and click the links and read the articles my head will explode I can already feel the pounding screaming rage starting
posted by instead of three wishes at 8:18 AM on March 5, 2015 [20 favorites]


This is unbelievable and so infuriating. The women (and men!) of Oregon should stage some sort of civil protest. And there should be mass transfers.
posted by (Arsenio) Hall and (Warren) Oates at 8:18 AM on March 5, 2015 [2 favorites]


But they'll hide behind FERPA in a heartbeat to conceal a parking ticket an athlete got. Nuke Division 1 Men's Basketball and Football from orbit now.
posted by marxchivist at 8:20 AM on March 5, 2015 [22 favorites]


A legal system is a society's alternative to unchecked violence.

A broken legal system is not.
posted by Naberius at 8:23 AM on March 5, 2015 [18 favorites]


So depressing.
posted by spitbull at 8:24 AM on March 5, 2015


What
The
Fuck
Oregan.
posted by Samuel Farrow at 8:25 AM on March 5, 2015


For more outrage, note that the university filed a counterclaim against the rape vicitim (which they recently dropped after much public outcry) where they claimed that "the publication of false allegations about Oregon’s handling of a report of an alleged sexual assault creates a very real risk that other survivors will wrongly be discouraged from reporting sexual assault and sexual harassment to Oregon."
posted by bassooner at 8:25 AM on March 5, 2015 [10 favorites]


What the motherfucking fucking fuck. I'm not allowed to email a student about their grades in case my email gets hacked because of FERPA, but you fuckers think you're in the clear to post a rape victim's medical records?!?!
posted by sciatrix at 8:27 AM on March 5, 2015 [56 favorites]


This article makes it sound like medical records are routinely protected from discovery in lawsuits, but is that really true? I know it's not true in federal court. Wouldn't this information have been discoverable in the lawsuit regardless?
posted by eugenen at 8:29 AM on March 5, 2015 [2 favorites]


University of Oregon should have their NCAA revoked for a minimum of five years in response to this, and everyone involved (in any capacity) with the decision to pull this stunt should serve jail time and have a civil suit leveled against them.
posted by Old'n'Busted at 8:33 AM on March 5, 2015 [36 favorites]


This article makes it sound like medical records are routinely protected from discovery in lawsuits, but is that really true? I know it's not true in federal court. Wouldn't this information have been discoverable in the lawsuit regardless?

Possibly, but even in that case the argument has to be made in court that the records are relevant to the case, and the other side has the opportunity to rebut that argument.

What Oregon said is "since you're suing us, we can release your own medical records to our legal team without either your written permission or a legal discovery order, because FERPA." Which is incredibly dangerous.
posted by NoxAeternum at 8:33 AM on March 5, 2015 [21 favorites]


In the first link:
> And even if Oregon is an outlier, its initial action could well chill the desire of students to seek support at university counseling centers everywhere

But is U. Oregon really an outlier? Can anyone comment on this?
posted by seawallrunner at 8:36 AM on March 5, 2015


What confuses me in this and similar cases of rape allegations on university campuses is that they are handled by committees at the university level, not the proper public legal system for criminal laws. Why is that? The only reason I can think of is that the situation is too murky to convict the alleged perpetrator as a rapist. But in this case, I find it very inappropriate to talk about a "rape". When I read something like

"Through the campus judicial process, the university found the three male students responsible for gang-raping her (not the technical term)."

I am just puzzled. If they gang-raped someone, shouldn't they get multi-year prison sentences? What's going on? This is an honest question.
posted by tecg at 8:39 AM on March 5, 2015 [5 favorites]


Yowza. Ferpa is one messed up law.
posted by Tell Me No Lies at 8:41 AM on March 5, 2015


What Oregon said is "since you're suing us, we can release your own medical records to our legal team without either your written permission or a legal discovery order, because FERPA." Which is incredibly dangerous.

Agreed, but the outrage is that Oregon didn't perceive it as being dangerous to them to do so. It should be made so.
posted by Gelatin at 8:43 AM on March 5, 2015 [2 favorites]


As for the countersuit, there's this lovely turd from the interim UO president:

Coltrane, however, criticized the online petition that characterized the UO as having filed a lawsuit against the victim, as opposed to responding to an existing lawsuit. He said he was advised by attorneys that it’s routine to counter a suit.

“Their suit would have us pay legal fees, and I was told it’s typical when you respond” to also file a counterclaim, he said.


How does he even think that is a defense? Methinks the interim president needs to become an outerim president, posthaste.
posted by NoxAeternum at 8:44 AM on March 5, 2015 [2 favorites]


I am just puzzled. If they gang-raped someone, shouldn't they get multi-year prison sentences? What's going on? This is an honest question.

It's simple: the DA refused to prosecute.

Happens All. The. Fucking. Time.
posted by NoxAeternum at 8:47 AM on March 5, 2015 [38 favorites]


"Through the campus judicial process, the university found the three male students responsible for gang-raping her (not the technical term)."

I am just puzzled. If they gang-raped someone, shouldn't they get multi-year prison sentences? What's going on? This is an honest question.


Not an expert, but often universities will review alleged sexual assaults as relates to violation of university policies or codes. This is (at least should be) separate from any criminal investigation that goes on. At best, the university is able to expel the student found responsible, even if no criminal charges are filed. At worst, the university uses this system to protect and shield students who have committed sexual assault.
posted by Existential Dread at 8:47 AM on March 5, 2015 [1 favorite]


And by often, I mean it's part of the requirements of Title IX to have an established procedure for handling complaints of sexual violence.
posted by Existential Dread at 8:50 AM on March 5, 2015


What confuses me in this and similar cases of rape allegations on university campuses is that they are handled by committees at the university level, not the proper public legal system for criminal laws. Why is that?

Because federal law requires universities and colleges that receive federal funds to have a process in place for handling sexual assault and harassment complaints. It is called Title IX.
posted by rtha at 8:52 AM on March 5, 2015 [1 favorite]


This article makes it sound like medical records are routinely protected from discovery in lawsuits, but is that really true? I know it's not true in federal court. Wouldn't this information have been discoverable in the lawsuit regardless?

To the best of my knowledge - no. Under HIPAA, protected information can be disclosed for certain purposes, one of which is "health care operations." "Health care operations" are deemed to include litigation defense.

So, it's not as though FERPA is the problem here - the school could have done the same under HIPAA.

I suspect that had the victim gone to a third party therapist, the records would have been subpoena'd anyway, and I don't think she'd have any room to quash it.
posted by Pogo_Fuzzybutt at 8:53 AM on March 5, 2015 [2 favorites]


Just a couple of weeks ago, there was an incident at my alma mater in which a member of the men's basketball team was alleged to have participated with two other men in the rape and sexual assault of two women. He was kicked off the team.

Notwithstanding that the player had been a key factor in the team's victory earlier that same day.

That's how you do it, Oregon.
posted by Gelatin at 8:55 AM on March 5, 2015 [10 favorites]


Women should be leaving universities and colleges that screw them over. We have at least that financial leverage.
posted by theora55 at 8:56 AM on March 5, 2015 [1 favorite]


Campus judicial proceedings don't preempt criminal or civil actions. They're just different. Despite arguments that colleges and universities should have nothing whatsoever to do with issues related to student conduct (e.g., allegations of sexual assault), the reality is that institutions have to do *something* when credible accusations are made. Unless you think it's okay for colleges and universities to adopt blanket policies e.g., all students accused of sexual assault are suspended or expelled, nothing happens to students accused of sexual assault unless they are found guilty in a criminal court. Reasonable people can disagree on the details of exactly what and how institutions do in these situations but I don't think that most people would agree that "nothing" is valid answer.

On the topic of the original article(s), it's always been my impression in my interactions with colleagues in counseling that they take the privacy of their clients extremely seriously much as many social science researchers who work with human subjects. I've never investigated but I've always assumed that medical and counseling records are in completely separate data systems that are inaccessible to those of us who otherwise have access to student data in large part to address this very issue. That may be a naive assumption but it's certainly how I would design such as system.

To me, the issue isn't so much that this university accessed the student's counseling records but in how it was done and what was done with them. I'm not a legal expert but it seems fair that a defendant be allowed to access those materials once they're made part of legal proceedings (and I assume that the same materials would be made available to the plaintiff). I'm much more interested in and concerned about how and when the materials were accessed as this definitely seems like it could be an instance in which the institution had the legal authority to do something but perhaps not the moral impetus or it could at least have gone about this differently.

The whole "medical records morph into educational records so they leave HIPPAland and enter FERPAland" is just weird.
posted by ElKevbo at 8:57 AM on March 5, 2015 [2 favorites]


University of Oregon should have their NCAA revoked for a minimum of five years in response to this, and everyone involved (in any capacity) with the decision to pull this stunt should serve jail time and have a civil suit leveled against them.

Or, y'know...burned to the ground. Earth salted.
posted by sexyrobot at 8:57 AM on March 5, 2015 [7 favorites]


To the best of my knowledge - no. Under HIPAA, protected information can be disclosed for certain purposes, one of which is "health care operations." "Health care operations" are deemed to include litigation defense.

So, it's not as though FERPA is the problem here - the school could have done the same under HIPAA.


Except that is a rather limited exception - the idea is that if you sue your doctor over malpractice, the medical care is at the heart of the matter, so it's understandable that the doctor's lawyer needs to see those records.

What Oregon is arguing for is much more broad, and I doubt it would be covered under HIPAA. At the very least, they would need to get a discovery order.
posted by NoxAeternum at 9:02 AM on March 5, 2015 [9 favorites]


this definitely seems like it could be an instance in which the institution had the legal authority to do something but perhaps not the moral impetus or it could at least have gone about this differently.

Right, and to pre-empt the usual "why do you hate due process?" admonishments, I think we can probably stipulate from the outset that what Oregon did is legal by the letter of the law, and that the real outrage isn't what's illegal, but what's legal. Firewalls between different units of the same organization aren't unprecedented, and in a case where the University is both the entity that administers counseling services and also the entity being sued for how they handled a sexual assault investigation, it's probably best to focus on what we want the law to be, not what it is now.

Under normal circumstances, the University's attempts to gather the record would be done in full view of the legal system, where a judge could rule on whether those particular records are germane to the legal defense of the University. These are clearly not normal circumstances, and the idea that the University's legal counsel can simply use a lawsuit as a carte blanche to access whatever records the University happens to be custodians of without any rules governing how they do so seems like something we need to fix.
posted by tonycpsu at 9:07 AM on March 5, 2015 [10 favorites]


It seems like a large part of the problem here is that the interim president is just giving his legal team carte blanche instead of actually assessing what they're asking to do. Look at his "defense" for the countersuit.
posted by NoxAeternum at 9:09 AM on March 5, 2015 [1 favorite]


This is absolutely terrifying.
posted by Hermione Granger at 9:15 AM on March 5, 2015


This is absolutely terrifying.

Agreed, and I think it's worth pointing out that this does not only impact rape victims (though they are some of the most impacted people by this.) Any student who is seeking confidential mental health assistance on campus now has to weigh that against the possibility that they may wind up involved in a lawsuit against the school, and that would open their records up.
posted by NoxAeternum at 9:19 AM on March 5, 2015 [17 favorites]


Mod note: Drinky Die, sio42, this isn't really a great place to talk about the crime, the thread is more about the privacy of victims and the university's response after the fact.
posted by mathowie (staff) at 9:21 AM on March 5, 2015 [5 favorites]


The University of Oregon's health clinic has a statement of its privacy practices [pdf] on its website. Interestingly, they seem to be under the impression that their operations are covered by HIPAA and the publication is drafted by the HIPAA Compliance Officer.

Perhaps there's some sort of claim for failure to provide adequate notice and/or intentionally(?) misleading student-patients as to the privacy of their health records.
posted by melissasaurus at 9:42 AM on March 5, 2015 [3 favorites]


:'(

Depressing. Disturbing.

:(
posted by Neekee at 9:43 AM on March 5, 2015


Just going to throw my What The Fuck hat into the ring. Apologies. Looks a bit battered of late.
posted by alexordave at 9:43 AM on March 5, 2015 [3 favorites]


My guess, by the way, on what the "nonstandard care" stuff is about - it is actually perfectly normal and routinely happens that clients of therapists ask for documentation of their seeking therapeutic services, without significant details, as evidence of trauma or of incident. So the therapist would be within norms to write something like, "I have been seeing Jane Doe since X date, she has been seeking therapy for violent gang rape, she has presented with the following symptoms during my length of care." But I could definitely see the university saying "no don't write that that leaves us liable."
posted by corb at 9:46 AM on March 5, 2015


I am shaking with anger right now as a current mental health practitioner and a former victim of assault while attending a different school in Oregon. I can't even freaking imagine.
posted by Bacon Bit at 9:48 AM on March 5, 2015 [6 favorites]


For more outrage, note that the university filed a counterclaim against the rape vicitim (which they recently dropped after much public outcry) where they claimed that "the publication of false allegations about Oregon’s handling of a report of an alleged sexual assault creates a very real risk that other survivors will wrongly be discouraged from reporting sexual assault and sexual harassment to Oregon."

Luckily, a countersuit against a rape victim would absolutely in no way discourage survivors. Good thinking!
posted by jeather at 9:50 AM on March 5, 2015 [15 favorites]


In plain English, college medical records simply do not count as real medical records, at least for privacy purposes.

American mefites: if this is what the Family Educational Rights and Privacy Act says, is FERPA unconstitutional? To what degree might the right to privacy interpretation of the 4th amendment provide grounds to condemn opening medical records without due process?

If this student has a good lawyer, might this invasion of privacy be a whole new cause of action against the school?
posted by justsomebodythatyouusedtoknow at 10:01 AM on March 5, 2015 [1 favorite]


American mefites: if this is what the Family Educational Rights and Privacy Act says, is FERPA unconstitutional? To what degree might the right to privacy interpretation of the 4th amendment provide grounds to condemn opening medical records without due process?

In addition I'd like to ask what us regular people can do to help rectify this nonsense. Is it a matter of writing to our local overlords? I'm filled with too much rage over this to do nothing.
posted by erratic meatsack at 10:10 AM on March 5, 2015 [1 favorite]


University of Oregon should have their NCAA revoked for a minimum of five years in response to this, and everyone involved (in any capacity) with the decision to pull this stunt should serve jail time and have a civil suit leveled against them.

Or, y'know...burned to the ground. Earth salted.

I grew up in a town where college sports basically ruled everything, and I think nothing short of extreme sanctions will bring about concrete and lasting changes. With this case, the recent scandal with the quarterback at FSU, or even in a (relatively) less egregious scenario*, UNC enrolling students in fake classes, it's clear that this is out of control.

Personally, I think Penn State should have had their college football program permanently terminated. In this Oregon case, I don't know what exactly would be a fitting response, and obviously it's made murkier by the legal grey areas with FERPA and HIPAA. Still, if the NCAA and outside law enforcement started doling out punishments that amounted to more than just a slap on the wrist, I bet schools would suddenly become way more inclined to police their own students and coaches/administrators if they feared serious retribution.

Burn the programs to the ground and put the fear of god in them. I think that's the only way to institute lasting changes.

Granted, I know that a lot of the issues with colleges handling rape cases don't overlap with school sports at all, but it's a place to start.

*An institute of higher education enrolling students in fake classes is in fact egregious, but I just can't put it on the same level as protecting rapists and harming students who are victims of rape.
posted by litera scripta manet at 10:17 AM on March 5, 2015 [4 favorites]


gee... so maybe the legal system isn't actually going to change rape culture on campus. these are the same campus officials who are going to enforce your "affirmative consent" rules.
posted by ennui.bz at 10:24 AM on March 5, 2015 [1 favorite]


Women should be leaving universities and colleges that screw them over. We have at least that financial leverage.
It's the flagship state university, though, and if you're an in-state student, you can't necessarily just go somewhere else without either going to a worse school or paying significantly more.
posted by ArbitraryAndCapricious at 10:55 AM on March 5, 2015 [5 favorites]


I've always been confused with the intersection of FERPA and HIPPA. I never really understood how health centers didn't have to comply with HIPPA regulations about student health records but I guess they are simply FERPA data.
posted by vuron at 11:00 AM on March 5, 2015


A friend of mine runs a website where she researches and posts the most recent C-section rates per hospital in each state, as a way of helping women decide where they want to give birth.

Perhaps we need something like that for rape and colleges. If I were trying to figure out where to apply, or my kid was, I'd sure as hell want to know whatever I could.

Of course, colleges don't exactly make such information easy to find.
posted by emjaybee at 11:07 AM on March 5, 2015 [4 favorites]


Nuke the NCAA.

Time for college students to be amateur athletes like any other kind.
posted by ocschwar at 11:21 AM on March 5, 2015 [1 favorite]


Women should be leaving universities and colleges that screw them over. We have at least that financial leverage.

It's the flagship state university, though, and if you're an in-state student, you can't necessarily just go somewhere else without either going to a worse school or paying significantly more.


Yep. That would be me. The UO gave me a future, academically speaking. I could barely afford it as it was, what with having fabulously crappy parents who claimed me as a dependent, torpedoing the best chances I had at financial aid, and then they refused to help out financially.

People need to remember, systemic abuses are indeed part of a multi-faceted system. Women can't up and boycott universities. We can't, because, like in my case, it might be the only thing, or an important facet, that can give us a chance at independent life. Because the whole goddamned fucking system is rigged. Life as a woman is often choosing between horrendous, terrible, bad, and less bad. (I feel like I've died and gone to heaven this year, because for once in my life, the first time I can ever recall, I was able to choose between bad, less bad, and good. I chose the good, and got it!! Pinch me. I'm 38.) And for the larger debate about whether or not a university degree in itself is even needed? At least in my case, I studied French, and went on an exchange program in France that was mostly funded by an academic scholarship I earned at the UO. I now live and work in France. It's cut-and-dry: my degree is the foundation of the life I have now.

As always, it's the people in positions of responsibility who need to be held responsible. There are mechanisms for that; those mechanisms are being circumvented.

Speaking only for myself: I experienced quite a few things at the UO that have made me careful of how I choose to speak of my alma mater. I had wonderful professors. My experience as a woman in close contact with the athletics department, however (I played tenor sax in the marching and bari sax in the basketball band), left a very great deal to be desired, and I refuse to praise them. The misogyny was overt, openly supported, and pervasive. The crap I put up with for my love of music, especially in athletics but also in other music groups, was unbearable and directly led to my decision not to become a professional musician. (And yes, I could have. My original major was piano performance – I was the only one accepted into the program in my year. I earned money playing in local pro bands on the side, too. Straight A piano major until I quit to focus on French.)
posted by fraula at 11:32 AM on March 5, 2015 [28 favorites]


I have long despised UofO for the shallowest of reasons. Their logo. I don't know how you make a single o so phallic, dominating and indifferent human suffering but somehow they did. Every time a see one plastered on the back windscreen I want a brick. Strange.
posted by Pembquist at 11:45 AM on March 5, 2015


The University of Oregon has a history of rather heavy handed legal measures/threats. When its grad students went on strike recently, it threatened to deport international students if they joined.
posted by congen at 11:45 AM on March 5, 2015 [1 favorite]


I have never heard of FERPA overriding HIPAA in any campus medical setting. Students always have to sign consents for information release when the two institutions overlap at my university. This is bizarro.
posted by Think_Long at 12:04 PM on March 5, 2015


Yeah, not surprised that Coltrane's name is attached to the intimidation effort as well. He's striking me as the sort of administrator who thinks that the solution to a problem is to make it Go Away quickly, and who would be clearly out of his depth in a puddle. The smart thing for the UO board to do now would be to remove him for gross incompetence - and since he's just a caretaker, that shouldn't be hard.
posted by NoxAeternum at 12:05 PM on March 5, 2015


People need to remember, systemic abuses are indeed part of a multi-faceted system. Women can't up and boycott universities. We can't, because, like in my case, it might be the only thing, or an important facet, that can give us a chance at independent life. Because the whole goddamned fucking system is rigged.

Double Duck (undergrad and law school), and I just wanted to high five fraula for the entirety of the excellent comment above. I was a bit ahead of you in undergrad, and although the academics I encountered in humanities were remarkable people with deep insights into (ironically) race, class, & gender issues in society, the counterexamples were everywhere. Including, notably, some of the hard sciences, with research profs being some of the worst examples of academic machismo I've ever witnessed.

I also have a hard time believing that the administration just "took the advice of counsel" as to whether or not to counterclaim. The client drives the strategy. Given that the Oregon DOJ is likely in the mix somewhere (I would assume that they're outsourcing litigation but advising on what to do), it's small surprise that they're being - ahem - obstinate.
posted by lawduck at 12:52 PM on March 5, 2015 [2 favorites]


I have never heard of FERPA overriding HIPAA in any campus medical setting. Students always have to sign consents for information release when the two institutions overlap at my university.

If they treat any non-students, then HIPAA still applies to those patients (and only those patients.) I wouldn't be surprised if they are having students fill out an information release that is completely useless, just for consistency.
posted by smackfu at 1:39 PM on March 5, 2015




But they'll hide behind FERPA in a heartbeat to conceal a parking ticket an athlete got.

Hiding behind/being terrified of FERPA is an institutional obsession. It's pretty insane, actually, since punitively FERPA is a near toothless law. It was determined not to be privately actionable, so if the school were to violate your privacy under FERPA you can't use it as a basis to sue. Only the Department of Education can punish the institution and the maximum they could do is cut off all the school's federal funds. Which in the decades of the law they have never once done.
posted by phearlez at 1:46 PM on March 5, 2015 [2 favorites]


This is disgusting. What utter scumbags these people are.
posted by homunculus at 2:01 PM on March 5, 2015


Fraula, I totally understand. Financial aid, location, in-state status, degree availability, etc., determine the choices for many students. But students who do have a choice should choose, and should make their choice known.
posted by theora55 at 3:47 PM on March 5, 2015


emjaybee, what you're looking for at any college is the "Clery Report", which is required by law. You'll probably find it in the Campus Police or Campus Security part of a college's website.

And actually, with a bit of searching (because I couldn't remember how "Clery" was spelled) I found this central repository on a Department of Education site: http://ope.ed.gov/security/.
posted by epersonae at 4:21 PM on March 5, 2015 [1 favorite]


But more to the actual post: I saw the story a couple of days ago. I used my college's counseling center quite a bit in college. I'd go so far as to say that the therapists there probably saved my life when I was going through severe depression. I read the article in The Chronicle and I was nauseous. Just overwhelmed.

I too would like to know what one can do about this.

(U of O grads, it might not do much, but you might consider writing to the alumni office, office of development, etc.: whoever sends you fundraising letters. Fundraisers care about things that threaten the college's pocketbook, and with state funding down, that means donors of one sort or another.)
posted by epersonae at 4:32 PM on March 5, 2015 [5 favorites]


You know, I hadn't realized that student counseling services were covered by FERPA, not HIPAA, and that freaks me right out, because FERPA is not exactly an airtight guarantee of privacy. There are tons and tons and tons of exceptions. For instance, we don't exactly publicize this, but universities are legally allowed to release students' records to parents if the student is a dependent for tax purposes, and most traditionally-aged college students are. So basically, while I don't believe that a university counseling service would ever call up someone's parents and tell them that their daughter was a lesbian or their son was freaking out because he thought he might be an atheist, in most cases they could do that without violating FERPA. That's totally disturbing.
posted by ArbitraryAndCapricious at 5:32 PM on March 5, 2015 [3 favorites]


So...college=rape, then? That's the impression I'm getting from all the news lately. Seriously.
posted by ostranenie at 5:48 PM on March 5, 2015


I'm not sure the Chronicle is right here about this hole in FERPA. They say that FERPA does distinguish between types of records and they're right:

The actual FERPA text about what is and isn't an educational record:
The term “education records” does not include—
(iv) records on a student who is eighteen years of age or older, or is attending an institution of postsecondary education, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice.
There's a fairly good reason for this carve-out - schools make (and are legally required to make) accommodations for student medical needs. I myself, back when dinosaurs roamed the earth, once got an allowance made for me based on my depression issues. If there was not some allowance for this sort of fact to be used and recorded in non-medical records then my request for late withdraw from that class would have become a medical record. So we get this "no, if it's about the educational process and not treatment then it's educational."

But the Chronicle article says the fact that these records weren't educational was irrelevant because they can release for lawsuit purposes. But that doesn't seem to jibe with the regs. Disclosures in Response to Legal Actions (Sec. 99.31(a)(9)(iii))

emphasis here is mine.
(B) If a parent or eligible student initiates legal action against an educational agency or institution, the educational agency or institution may disclose to the court, without a court order or subpoena, the student's education records that are relevant for the educational agency or institution to defend itself.
Unfortunately that still leaves this as a FERPA matter and subject only to the toothless attentions of DoE, but then again I don't think anyone has managed to create any privately actionable uses for HIPAA either.
posted by phearlez at 8:41 PM on March 5, 2015


NoxAeternum: "The smart thing for the UO board to do now would be to remove him for gross incompetence - and since he's just a caretaker, that shouldn't be hard."

Lets just say that Oregon university politics has become complicated in the past few years.

UofO has gone through four presidents in five years. They can fire Coltrane at any time by basically finishing the hiring process for his replacement. And that's part of the problem -- interim appointments tend to avoid risk because their position is tenuous.

But is the board even in control? UofO basically unraveled the Oregon University System in favor of boards of trustees just last year. Those boards have a union rep, a student rep and a faculty rep, but I'm not sure where the rest are recruited. Large donors probably. I know there's a former Nike exec and Ballmer's wife on the board. Still, they're pretty new, and are fairly pro-sports.

The more conspiratorial assume that Phil Knight, Chairman of Nike with $22billion to his name, and donor to the PAC created to create the board in the first place, carries substantial weight on campus as well. He was certainly nominated to the board by UofO. It's unknown why he requested the governor withdraw his nomination. Perhaps he felt he'd have more power dangling a few billion in front of the board than in a more formal role where students could protest his influence?
posted by pwnguin at 9:23 PM on March 5, 2015


This story fills me with rage on several levels. Really, that's all I got.
posted by Alterscape at 9:24 PM on March 5, 2015


Did anyone notice this point in one of the articles?

"Earlier this month, an employee in the UO Counseling and Testing Center notified state officials that she believed UO administrators had improperly looked at an unnamed student's clinical files to help prepare for a lawsuit they believed the student was close to filing."

(Here's the source . )

If that was reported correctly, the student had not yet filed the lawsuit when they accessed her records. Everything I've seen discussing this case claims the FERPA exemption exists because she had filed a lawsuit. But what about accessing the records before a suit is filed? Is there any way that's legal?
posted by pippipanda at 10:02 PM on March 5, 2015 [5 favorites]


But that doesn't seem to jibe with the regs. Disclosures in Response to Legal Actions (Sec. 99.31(a)(9)(iii))

The DoE says:
However, it is important to note, that a school may disclose an eligible student’s treatment records for purposes other than the student’s treatment provided that the records are disclosed under one of the exceptions to written consent under 34 CFR § 99.31(a) or with the student’s written consent under 34 CFR § 99.30. If a school discloses an eligible student’s treatment records for purposes other than treatment, the treatment records are no longer excluded from the definition of “education records” and are subject to all other FERPA requirements, including the right of the eligible student to inspect and review the records.
I can't figure out where it says that in the regulations or law, but that's what they say.
posted by smackfu at 5:57 AM on March 6, 2015


I don't think it does say that anywhere in the regs; I think their FAQ is wrong, and when rubber meets the road it's going to be the published regulations which count. Those are what were written and published in the federal register. This FAQ - who the hell knows who wrote it? It's not the only place that gets this wrong; as I said, I found a similarly wrong HHS page on this issue.
The individual’s health records would be considered “education records” protected under FERPA and, thus, excluded from coverage under the HIPAA Privacy Rule. FERPA defines “education records” as records that are directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution. 34 CFR § 99.3 (“education records”).
That's just flat out not correct, as I quoted above in the exemption.

It's not impossible there's some case law on this - that's above my Jr Internet Detective Lawyer pay grade. But the simplest explanation is that whatever committee or employee who wrote these faqs was no more qualified to interpret law than I am and just wrote it wrong.

This is why we have lawyers.

That said, the problem is always going to be here that the DoE is the only people who get to decide what is and isn't a FERPA violation and what sort of typically-weak-sauce response they're going to take when one is reported. So if these same sort of people are using this flawed interpretation of the regs to decide what is and isn't okay.... *shrug*
posted by phearlez at 7:29 AM on March 6, 2015


And Oregon continues to compound their problems with this issue, by firing the health center employee who blew the whistle on their actions.
posted by NoxAeternum at 3:49 PM on March 26, 2015 [1 favorite]


« Older "I have to admit I've tasted it from time to time....   |   cronch cronch snort cronch nom nom cronch snort... Newer »


This thread has been archived and is closed to new comments