Congresswoman 'Troubled' By Privacy Loophole On Student Health Records Confronts Education Department

Rep. Suzanne Bonamici (D-Ore.) on Wednesday sent a letter to the U.S. Department of Education expressing concern that current federal law may permit universities to review a student's medical records without their permission.

"I am troubled that there appears to be a loophole in federal privacy law that allows the personal and private conversations a student has after a traumatic experience to be released by a university under the laws governing educational records," Bonamici said in a statement. "Students who seek treatment on campus deserve the same level of privacy as other patients, whose medical records are protected under federal health law."

The letter follows a controversy at the University of Oregon, where a student who said she was gang raped by three basketball players claims the school inappropriately accessed her medical records prior to her filing a federal lawsuit against the institution. Employees of the university's counseling center have backed up the student's claim, writing in a January letter obtained by The Huffington Post that the school accessed her clinical records "without the client's permission or consent and without proper authorization prior to any litigation occurring."

The university has maintained it did not review her records, and that transferring them to the general counsel's office was done lawfully under the Family Educational Rights and Privacy Act. Katie Rose Guest Pryal, a former University of North Carolina-Chapel Hill law professor, wrote earlier this month that the university is right -- however disconcerting that may be.

"If you are a student and seek counseling at your college's counseling center, your medical records are most likely not protected by the typical medical-privacy laws, otherwise known as the Health Insurance Portability and Accountability Act," Guest Pryal wrote in the Chronicle of Higher Education. "Instead, they fall under the aegis of FERPA, just as Oregon said. And compared with HIPAA, FERPA is about as protective as cheesecloth."

But Bonamici said she wanted this confusion to be explained. She asked the Education Department if federal regulation or guidance blocks a school from sharing students' treatment records with "other offices of an institution that are not involved in students' treatment" and if there's any law limiting "whether an institution may declare that a treatment record is being used for a non-treatment purpose."

Bonamici's office told HuffPost they'll wait to see how the Education Department responds, but aren't ruling out drafting legislation if they believe there's a loophole in FERPA that needs closed.

A school's general counsel would be able to access a student's treatment records if they had "a legitimate educational interest in those records," an Education Department official told HuffPost, meaning if the general counsel needed access to the records in order to perform their job duties. The official declined to explain further on the record.

A representative for the Education Department said it has "received the letter and looks forward to responding."