The report from the panel  -- formed by Virginia Gov. Tim Kaine after a shooting rampage by Cho, a Virginia Tech senior, left 32 students and faculty dead -- places blame squarely on the university for failing to issue a timely campus-wide notification of the threat. The death toll, the report argues, could have been lower if the administration had acted more quickly. The report also criticizes the state’s “flawed” mental health laws and “inadequate” services, and exposes a loophole in Virginia law (temporarily corrected under a Kaine executive order) that kept Cho’s name out a database used to check the criminal backgrounds of would-be gun owners (despite the fact that under federal law, his mental health history rendered him ineligible to purchase the weapons).
While much of the attention in the coming weeks will probably focus on the specifics of Virginia Tech's initial response -- when the university sent out the notification, why it didn't happen sooner, when police arrived where and why -- many of the implications for higher education policy lie in the circumstances that led up to the April attack. The report exposes a critical failure to share information, due to widespread misinterpretation of privacy laws and records that got (and frequently get) lost in the gulf between high school and college. These failures point to a delicate balance between privacy and protection that tends, the report suggests, to tip too often in favor of privacy.
“There was an intense awareness within Cho’s family, counselors and the Fairfax County [Va.] school system that he was troubled, had contemplated violence, and needed some fairly intense services to be able to function,” Kaine said in a statement  Thursday. “The system surrounded him with those services, and he succeeded. However, despite serious concerns about whether he would be able to continue to succeed at Virginia Tech, the university never received any information about his challenges and the strategies that had enabled him to succeed up to that point in his life.”
Privacy and Protection
The report’s finding that misunderstandings of privacy laws contributed to the failure to share information (despite the fact, the report notes, that “federal laws and their state counterparts afford ample leeway to share information in potentially dangerous situations”), in many ways echoes an earlier federal report on the shootings . The report notes that not only does the Family Educational Rights and Privacy Act  include an emergency exception, the law itself pertains only to student records, not personal observations or conversations.
So observations from concerned faculty members (which became public in spades in the aftermath of the shootings) would actually fall outside the purview of the law. “FERPA is not an information statute, it’s a record statute,” said Steven J. McDonald, general counsel at the Rhode Island School of Design. Many in higher education, he said, fail to understand that distinction.
Plus, the report notes that FERPA “generally authorizes the release of information to institutional officials who have been determined to have a legitimate educational interest in receiving the information.” And, as McDonald pointed out, the Education Department’s own model letter  for notifying students of the law defines individuals with legitimate education interests broadly: “A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibilities for the University.” Under that definition, McDonald said, law enforcement and medical staff could be included among those who could be kept informed -- consistent with one of the panel’s recommendations on privacy laws.
The panel also recommends that a number of clarifications to FERPA be considered, including its applicability to treatment records at college clinics, and the inclusion of “safe harbor provisions” intended to encourage good faith disclosures of information for health or safety reasons without fear of liability.
But it goes beyond that to point out that Virginia Tech never even had access to some crucial information: the elementary and secondary school records chronicling Cho’s mental history.
The panel does not make a recommendation on the records gap between high school and college, perhaps realizing that this ground is too thorny to tread on. “But the panel hopes that this issue begins to be debated fully in the public realm,” the report reads. “Perhaps students should be required to submit records of emotional or mental disturbance and any communicable diseases after they have been admitted but before they enroll at a college or university, with assurance that the records will not be accessed unless the institution’s threat assessment team … judges a student to pose a potential threat to self or others.”
Alternatively, the panelists note, the institution could request information about a student's history of emotional or mental disturbance from a student’s family or high school only after identifying a student as a threat.
“This is a system that’s broken. We have a huge history, including homicidal tendencies on the part of Cho, that were never transferred out of his high school,” said Brett A. Sokolow, president of the National Center for Higher Education Risk Management.  “There’s no mechanism for legal transmission. One of the things that I hope that this panel report provokes is a debate on the circumstances … in which [colleges] can reach into a student’s past." (Although Sokolow suggested a third mechanism for obtaining that information: If the public is really serious about colleges entering the threat assessment business, he said, colleges should be able to ask students identified as possible threats to consent to a release of their K-12 records -- and suspend them if they don’t sign off).
“If our society is going to place the responsibility on colleges to assess threats, give us the information we need to do so," Sokolow said.
But Jerald Kay, chair of the psychiatry department at Wright State University and chair of the American Psychiatric Association’s College Mental Health Committee, said he’d be wary of any move toward requiring the disclosure of the K-12 mental health records. It’s a “slippery slope,” he said, noting the potential for abuse and the fear of discouraging students from seeking treatment. “I would tread carefully.”
“Some say the 'system' -- the continuum of support from childhood through college -- failed this student,” Virginia Tech President Charles W. Steger said in his response to the report  Thursday, in which he pointed out that the "system" requires the student to request help. “Some aspects of ‘the system’ worked -- broadly speaking. It simply wasn't asked to do enough."
“In Cho's case,” Steger said later in his remarks, “no one at this university had any foreknowledge of his mental health problems that seemed dominant throughout his life before college. Colleges need feedback loops in order to identify, assess, and help students at risk. We need some way of understanding a student's life before college, if there are aspects that would prevent that student from success or, in the extreme, could create problems for others."
“Indeed, the information about his earlier mental health problems and special education programs would have been invaluable not only in a general sense in assisting him as a student, but when he had his one encounter with the public mental health system in 2005.”
And perhaps that full debate the panel was hoping for can begin.