Back Away From Students' Medical Records, Feds Warn Colleges

A college facing off against a student in court should generally refrain from accessing that student's medical records without a court order or written consent from the student, the U.S. Department of Education said Tuesday. The department characterized that guidance as a clarification of existing federal privacy laws.

Schools have a limited authority to review a student's records from an on-campus service provider under the Family Educational Rights and Privacy Act (FERPA). But in a draft Dear Colleague letter  to schools nationwide, the Education Department said they should avoid doing so in most cases where there is litigation.

Without "a court order or written consent, institutions that are involved in litigation with a student should not share student medical records with the institution's attorneys or courts unless the litigation in question relates directly to the medical treatment itself or the payment for that treatment, and even then disclose only those records that are relevant and necessary to the litigation," wrote Kathleen Styles, the department's chief privacy officer. 

The department is seeking input  until Oct. 2 on its draft guidance.

The University of Oregon was recently the center of controversy when it was revealed that school officials had transferred  a student's medical records from the university's counseling center to its lawyer's office. The student was seeking treatment after she said she was gang-raped by three university basketball players  last year.

The school has maintained that it did nothing illegal and that it was merely acting in anticipation of a lawsuit  that the student filed against the university   in January. The suit was settled for $800,000  this month.

However, other universities have also asked students reporting sexual assaults to waive their federal privacy rights so that the schools can look through their therapy records. Those schools include the University of California, San Francisco , and the University of Kansas .

Styles warned that the benefits of on-campus medical services "cannot be fully realized in an environment where trust between students and the institution is undermined. Students should not be hesitant to use the institution's medical services out of fear that information they share with a medical professional will be inappropriately disclosed to others."

On its website, the Education Department elaborated on one situation  in which a school has more flexibility to review a student's medical records:

The only exception is if the litigation in question relates directly to the medical treatment itself or the payment for that treatment, and even then institutions should only disclose those records that are relevant and necessary to the litigation. To provide a clarifying example, if an institution provided counseling services to a student and the student subsequently sued the institution claiming that the services were inadequate, the school's attorneys should be able to access the student's treatment records to defend the school without obtaining a court order or consent. 

Sen. Ron Wyden (D-Ore.), who had prodded the department  earlier this year to clarify how student medical records should be treated under FERPA, called the new guidance "encouraging." 

"Now, it's critical that privacy experts and the higher education community weigh in on the draft guidance to make sure colleges and universities are held to the highest possible standard when it comes to protecting student privacy," Wyden said in a statement. 

Tyler Kingkade covers higher education and sexual violence, and is based in New York. You can contact him at tyler.kingkade@huffingtonpost.com or on Twitter: @tylerkingkade .