On September 14, 2016, the Department of Education (DOE) issued a “Dear Colleague Letter” to provide guidance on the application of the Family Educational Rights and Privacy Act (FERPA) to the disclosure of student medical records in the context of litigation.
FERPA generally prohibits a school from disclosing personally identifiable information from a student’s education records without consent, unless an exception applies. Education records are defined as records that: (1) directly relate to the student, and (2) are maintained by an educational agency or institution or by a party acting for the agency or institution. Medical records (including mental health counseling records) are generally considered to be included in the definition of education records.
Exceptions under which medical records may be disclosed without student consent under FERPA include:
A. School Officials with a Legitimate Educational Interest
FERPA allows school officials, including professors, administrators, and legal counsel, to access education records, including medical records, without consent if the school has determined that the official has a legitimate educational interest in the records. A school official has a legitimate educational interest if the official needs to review an educational record in order to fulfill his or her professional responsibility.
Under FERPA, attorneys representing institutions in legal proceedings generally function as school officials. However, institutions should not conclude that their attorneys have a legitimate educational interest in accessing those records, without a court order or the student’s written consent, unless the litigation at issue directly relates to the medical treatment itself or payment for that treatment. DOE analogizes this exception to the HIPAA Privacy Rule concerning litigation between a covered health care provider and a patient.
B. Disclosure to a Court without Court Order or Subpoena
FERPA regulations generally permit a school to disclose to a court education records that are relevant to its case against a student. DOE indicates, however, that this general rule should be “read in light of the special sensitivity of [medical or counseling records] and the importance of students being able to obtain timely on-campus medical treatment.” Similar to the exception for a legitimate educational interest, DOE analogizes this exception to the standard articulated in HIPAA guidance, and states that schools should use the litigation exception to disclose education records only if the lawsuit directly relates to medical treatment or payment for such treatment.
DOE also advises that if a student’s medical records are likely to be relevant to a reasonably anticipated, threatened, or pending lawsuit, an institution and its counsel may have a legal duty to place a “litigation hold” on the student’s medical records. DOE advises that an institution or its counsel should instruct the treatment provider to preserve the student’s medical records and, if necessary, electronically capture or take physical custody of those records.
C. Health or Safety Emergency
FERPA permits a school to disclose a student’s education records to appropriate parties if the student poses an “articulable and significant threat” to themselves or others. A school official should be able to explain their reasonable belief as to why the student met this standard. The education records, including medical records, can be disclosed to any person whose knowledge of the information from the records will assist in protecting the student or others. However, school officials must also take care to disclose only the information from education records that is necessary. DOE advises that in many cases providing the actual records is not necessary or critical when a counselor’s summary of the relevant and necessary information from those records is sufficient.
DOE notes that it has long encouraged institutions to implement a threat assessment program and that none of the guidance in this “Dear Colleague letter” diminishes the sharing of records and information allowed under FERPA to prevent or respond to violence on campus.