HIGHLIGHTS:
- Through a Dear Colleague Letter addressed to the higher education community, the U.S. Department of Education has released "significant guidance" on the application of the Family Educational Rights and Privacy Act (FERPA) to the release of student medical records generally, and specifically in the context of litigation.
- When evaluating whether to disclose student medical records pursuant to a relevant FERPA exception, institutions of higher education must consider how to protect to the greatest extent possible student health, safety and privacy interests in order to encourage students to access campus medical services.
- Institutions must apply the FERPA privacy lens to the obligation to maintain and produce documents potentially relevant to litigation.
The Family Policy Compliance Office at the U.S. Department of Education (the Department) recently released "significant guidance" on the application of the Family Educational Rights and Privacy Act (FERPA) to the release of student medical records generally, and specifically in the context of litigation. The guidance comes in the form of a Dear Colleague Letter addressed to the higher education community. The Department issued a draft version last year and solicited public comment. While Dear Colleague Letters are not law, they are strong indications of how the government will enforce the laws within its purview.
This alert summarizes the Dear Colleague Letter and provides practical guidance for institutions and their counsel in connection with the release of student medical records.
FERPA and Medical Records
FERPA is a federal law that protects student privacy by requiring an institution to obtain consent before releasing information in an "education record," absent an applicable exception that permits disclosure without consent. Education records are broadly defined as records that are 1) directly related to a student and 2) maintained by an educational agency or institution or by a party acting for the agency or institution.
The Dear Colleague Letter clarifies that student medical records must generally be viewed as education records, except when the record fits into a "narrow" exception that excludes "treatment records" from the FERPA-protected education record. Treatment records are records directly related to a student 18 years of age or older, made or maintained by a medical professional, and made, maintained or used only in connection with the student's treatment. A treatment record cannot be disclosed to anyone (including the student) other than the professionals providing treatment, except that it can be personally reviewed by another medical professional of the student's choice. Once the treatment record is disclosed for any other purpose, it becomes part of the FERPA-protected education record.
Institutions Should Encourage Student Access to Campus Medical Services
The Dear Colleague Letter recognizes that campus medical services serve an important purpose in helping to promote campus safety and health, improve academic achievement and assist students who experience violence and harassment. The Department concludes that students have a reasonable expectation that their conversations with campus medical professionals are confidential and also that institutions must avoid any chilling effect on student access to campus medical services that would occur if students fear that their medical records will be shared inappropriately. Thus, throughout the Dear Colleague Letter, the Department urges institutions to be mindful of the private nature of medical records and to take reasonable measures to limit disclosure.
Clarifying the Scope of FERPA Exceptions that Permit Disclosure of Student Medical Records Without Consent
The Department cautions that while institutions may choose to disclose FERPA-protected medical records pursuant to applicable exceptions, "great weight" must be given to student expectation that such records "generally will not be shared, or will be shared only in the rarest of circumstances, and only to further important purposes, such as assuring campus safety."
The Dear Colleague Letter addresses the scope of several FERPA exceptions:
Disclosure to School Officials with a Legitimate Education Interest
Medical records may be disclosed, without prior consent, to school officials whom the institution has determined have a legitimate education interest in the records. The Dear Colleague Letter affirms past guidance that institutions have "significant discretion" to determine who is a school official and that a school official may have a legitimate educational interest if the official needs to review the record to fulfill his or her work functions. This exception does not confer a blanket right to review all documents in an education record. Institutions must look to an individual's job functions to determine whether there is a legitimate interest in a particular record.
Importantly, the Dear Colleague Letter does not limit the extent to which student medical records may be shared with members of a threat assessment team. The Department encourages institutions to implement a threat assessment program, which typically relies on a team composed of a variety of school officials to assess whether a health or safety emergency exists. Preventing and responding to campus violence requires the sharing of relevant student information to make threat assessments effective.
Disclosure in a Health and Safety Emergency
An institution may disclose medical records to appropriate authorities if a student is determined to pose an "articulable and significant threat to self or the health or safety of other individuals." This exception permits disclosure not only to school officials but to any person whose knowledge of information from the records will assist in protecting the student or others from the threat, such as law enforcement, medical personnel, attorneys representing the institution and parents. The scope of disclosure should be limited to only the information necessary to protect the health or safety of the student or other individuals.
The Department advises that providing "actual records, such as a counselor's session notes," is generally not necessary. Rather, "a counselor's summative statement" of the relevant and necessary information from medical records will generally suffice "in most cases."
Disclosure in Litigation
Institutions may disclose to a court those records that are relevant for the institution to proceed with a legal action against a student or defend against a legal action brought by a student. However, when medical records or counseling records are involved, this exception must be understood in the context of the "special sensitivity" of the records and the importance of avoiding chilling effects on student access to timely on-campus medical treatment. To address these concerns, the Department adopts a standard similar to the HIPAA Privacy Rule pertaining to litigation between a covered healthcare provider and a patient: The litigation exception to disclose student medical records should be used only if the lawsuit relates directly to the medical treatment or payment for the treatment. The Department further advises that when disclosing medical records, institutions must limit disclosure without consent "to only those records that are, in fact relevant and necessary to the litigation" (emphasis added). In other situations, medical records may be disclosed only with consent or when subject to an appropriate protective order signed by the court.
Disclosure of Medical Records to Attorneys to Prepare a Case
The Dear Colleague Letter offers guidance about the scope of disclosure of medical records to attorneys representing an institution in legal proceedings. Generally, such attorneys function as school officials to whom disclosure of records may be made pursuant to the school official exception. However, the Department advises that medical records should generally not be disclosed to attorneys for the purpose of helping to prepare a case without a court order or the student's written consent, unless the litigation "relates directly to the medical treatment itself or the payment for the treatment." This guidance strongly protects student expectation of privacy in medical records by strictly limiting an attorney's use of campus medical records to prepare a case, unless there is a signed protective order or prior written consent.
Legal Holds
The Dear Colleague Letter clarifies that it does not override the legal requirement for institutions to preserve documents relevant to anticipated or actual legal proceedings ("legal holds" or "litigation holds"). To comply with document preservation obligations, institutions should generally instruct a treatment provider to preserve medical records, but the institution may electronically capture or take physical custody of the records when deemed necessary to comply with legal obligations.
Practical Considerations
Institutions should consider the following measures to respond to the Dear Colleague Letter:
- Review campus medical treatment policies. Campus treatment policies should clearly notify students of the institution's information-sharing practices with regard to medical records. The Department considers it best practice to notify students of the privacy of their medical records at the time they receive treatment.
- Establish information-sharing protocols. Evaluate how the institution shares information under the school officials exception and establish protocols to limit an official's access to only those records necessary to perform job functions. Review or adopt protocols that address how information is shared in a health or safety emergency, including a process for treatment providers to draft a summary of relevant information in a medical record rather than providing copies of the records themselves.
- Train school officials. Provide training on the Department's guidance with regard to access to medical records and the institution's information-sharing protocols.
- Update litigation hold practices. Evaluate the institution's practice with regard to gathering information in response to pending or threatened litigation. When possible, preserve medical records without disclosing their content unless the litigation relates directly to treatment or involves payment.
- Comply with state law governing privacy of medical records. The Department's guidance does not preempt state laws that may provide additional privacy protection for medical records.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
