Staying Confidential

In December, facing a possible lawsuit, the University of Oregon officials sought and received the campus therapy records of a student who said she was gang-raped by three Oregon basketball players. Her lawsuit alleging that the university mishandled her case was filed the next month. In the suit, the student also accused the university of violating her privacy by accessing those records without her consent.

That the university accessed her records isn't in dispute, but the consensus among student privacy experts is that the university did nothing illegal.

It is a detail that, seven months later, continues to worry victims’ advocates and some federal lawmakers, who have urged the U.S. Department of Education to close what even the department views as a gap in the privacy rights of students. 

“While spirited debate can engage the question of what the law allows, ethics must govern the question of what colleges and universities should do,” the National Center for Higher Education Risk Managementstatement is from the center, not an official there? -sj**yeah, they wanted it to be from the center in general -jn said in a statement. “Higher education insists that it is a bastion of the moral high ground. So, it must be. Victims need to know we are here for them.”

The female student is suing Oregon and its men's basketball coach over allegations that they recruited one of the players who allegedly assaulted her while knowing that he had previously been accused of sexual assault at Providence College. The suit also alleges that the university scrubbed the players' transcripts of any references to sexual misconduct, making it easier for them to transfer to play elsewhere after they were accused of misconduct at Oregon. The three students were suspended for up to 10 years, but all have since transferred to play basketball at other colleges.

As the lawsuit contends that the ordeal caused the student emotional distress, the university says it accessed her mental health records in order to prepare for the litigation. "Under Oregon law, a plaintiff who places her psychological state at issue by seeking damages for emotional distress waives any psychotherapist/patient privilege or doctor/patient privilege and is required to disclose counseling records related to her psychological state," Oregon's lawyers wrote in a since-dropped counter lawsuit against the student. The university returned the records in March.

In February, the two health center employees who interacted with the student after the assault argued that accessing the records was a violation of patient confidentiality laws -- or at least a violation of the institution’s own policy.

“I am disheartened to inform all of you that [we] had to report the potential illegal and unethical behavior of certain individuals in our department and those advising our department to the appropriate agencies and university higher management,” Jennifer Morlok, the student’s therapist, and Karen Stokes, an executive assistant at the campus health center, stated in an open letter.

In a statement, Frances Bronet, senior vice president and provost at Oregon, said that the university's lawyers scanned and preserved the records but did not actually read them before returning them to the health center. "I urge UO students to use our counseling and mental health services without fear that their counseling records will be disclosed to other parties or UO departments," Bronet stated.

The university’s confidentiality and privacy policy states that there are a number of exceptions to keeping a student’s records private. Those include if the student provides a written release saying information can be released; if there is an “imminent danger” to the student or others; and if a court orders the records released. According to a 2014 version of the policy available through the Internet Archive’s Wayback Machine, a court order was the only allowable exception related to legal action, and one was not made here.

But that policy has since changed. It now specifically states that an exception to confidentially can be made when a student’s “emotional condition is being used as a claim or defense in a legal situation.”

Its internal policies and ethics aside, most student privacy experts agree that what the university did was legal. The Family Educational Rights and Privacy Act does not explicitly allow for a student’s clinic or mental health records to be accessed by an institution being sued, but it does not bar such a move. Even so, six University of Oregon employees remain under investigation by the Oregon Board of Psychologist Examiners.

In a statement in March, Representative Suzanne Bonamici, an Oregon Democrat, referred to the exemption as “a loophole” that needed to be closed. She and Senator Ron Wyden, an Oregon Democrat, wrote letters to the U.S. Department of Education asking for clarification on the issue.

In June, Kathleen Styles, the department’s chief privacy officer, confirmed that under FERPA, a university is allowed to access a student’s therapy records. In letters to the two lawmakers, Styles said she found the exemption to be concerning, and that the department was considering releasing new guidance on the issue. Last week, a department spokeswoman said that such guidance was still likely, but there is no timetable for its release.

“The [Education Department’s] response confirms a gap in privacy that could allow school officials to inappropriately access students’ personal health records without their consent,” Wyden and Bonamici said in joint statement. “More must be done to protect students’ privacy and reinforce a safe college environment. We will continue to demand that the Department use its authority to immediately address this gap.”

While Education Department guidance might be forthcoming, legal experts said they don’t see the gap being closed by releasing new guidance.

“The fact of the matter is that the filing of a lawsuit is deemed a waiver, whether that access is provided directly or through some court process,” Steven McDonald, general counsel for the Rhode Island School of Design and an expert on FERPA, said. “That information is not sacrosanct. That information will come out.”

If lawmakers are serious about removing the loophole, McDonald said, then they may need to look outside of FERPA and the Education Department. In April, the Oregon House of Representatives unanimously passed a bill that ensures “confidential communications between a victim of sexual assault, domestic violence or stalking and victim advocates or services programs are to be kept confidential from disclosure, and by default will not be admissible in court.” Those service programs include campus health centers.

FERPA allows for situations like what occurred at Oregon simply because it does not specifically prohibit colleges from accessing mental health and other clinic records when preparing for lawsuits, McDonald said. Therefore, state and federal lawmakers can create legislation unrelated to FERPA that would close a privacy gap.

“FERPA in no way trumps other laws that could apply to particular records,” McDonald said.

Laura Dunn, founder and executive director of SurvJustice, said the Education Department should release its guidance sooner rather than later, as the Oregon case is causing a “chilling effect” on students who have been assaulted. Federal lawmakers, Dunn said, should also reconsider a lack of confidentially requirements in current sexual assault legislation, such as the Campus Accountability and Safety Act.

But, she added, state legislators shouldn't wait on changes to come from Washington.

“While there needs to be some federal efforts to prevent future violations of privacy and confidentiality regarding survivor support services on campus,” she said, “many states should follow suit with Oregon and provide confidentiality under state law to all survivors seeking assistance, especially those on campus.”