The U.S. Department of Education confirmed in letters to Sen. Ron Wyden and Rep. Suzanne Bonamici, both Democrats of Oregon, that a university is allowed to access a students therapy or medical records if that student files a lawsuit against the school and obtained health services through the institution.

Further, an Education Department official said their office is concerned about how broadly the privacy law governing such records, the Family Educational Rights and Privacy Act, can be used when students enter litigation against their college.

The letters from Kathleen Styles, Chief Privacy Officer, dated June 8, were released by Wyden and Bonamicis offices on Thursday. Wyden and Bonamici wrote letters to the department following controversy over whether the University of Oregon violated a rape victims privacy by transferring their therapy records from the schools counseling center to the institutions general counsels office. The university has insisted it did not violate the law, and in March returned the records to the schools counseling center.

While both the [Health Insurance Portability and Accountability Act] Privacy Rule and FERPA provide important privacy protections, we are concerned about the possibility that FERPA may offer fewer confidentiality protections than the HIPAA Privacy Rule in the limited instances where institutions choose to share treatment records with their attorneys in conjunction with litigation between the student and the institution, Styles wrote to Wyden.

A covered entity can non-consensually disclose patient records to in-house counsel in the context of litigation, but only when it relates to the entitys health care operations, Styles wrote. However, under FERPA, she said a school is more broadly permitted to disclose records without a court order to in-house counsel in the context of litigation if the institution determines their attorney has a legitimate education interest in the records.

Styles said the department may release additional public guidance in the future.

All students should feel confident that they can see a doctor or report a sexual assault without their information being exposed or their privacy violated, Wyden and Bonamici said in a joint statement. The Department of Educations clarification of the federal protections students have is helpful. However, the response confirms a gap in privacy that could allow school officials to inappropriately access students personal health records without their consent. More must be done to protect students privacy and reinforce a safe college environment. We will continue to demand that the department use its authority to immediately address this gap.