A troubling situation involving a University of Oregon student whose mental health records were given to the school’s attorneys to defend the university against her rape lawsuit highlights the need for revision of federal privacy laws to protect the confidentiality of students’ mental health counseling records. Senator Wyden has written to the US Education Department about this issue, as has Rep. Bonamici and Dr. Norman Anderson, the CEO of the American Psychological Association.
To provide some context: in 2008, and in the wake of a national concern following a massacre at Virginia Tech, the Family Educational Rights and Privacy Act (FERPA) was amended. In November, 2008 the U.S. Education Department and U.S. Department of Health & Human Services (HHS) issued a joint guidance (pdf) that attempted to address the myriad questions about when FERPA applies and when HIPAA applies to student records:
The purpose of this guidance is to explain the relationship between the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, and to address apparent confusion on the part of school administrators, health care professionals, and others as to how these two laws apply to records maintained on students. It also addresses certain disclosures that are allowed without consent or authorization under both laws, especially those related to health and safety emergency situations.
In my opinion, which I expressed at the time to anyone who might listen, the government seriously watered down mental health confidentiality protections when they declared most of these records “education records” or “treatment records” under FERPA instead of “protected health information” under HIPAA.
As a mental health professional who treats patients and who also serves as a consulting psychologist to schools, I’ve had plenty of experience with both HIPAA and FERPA. While HIPAA is far from perfect, it is much better than FERPA when we talk about sensitive information in mental health records because: (1) FERPA permits many more disclosures to a broad category known as “school officials,” (2) schools are not as invested in data security as HIPAA-covered entities, and (3) school personnel are not adequately trained in FERPA nor other federal and state laws protecting the confidentiality of student health information (such as the Individuals with Disabilities Education Act). Sadly, neither federal statute (FERPA or HIPAA) provides for a private cause of action for violations, but HHS has taken enforcement action against some entities for breaches whereas the U.S. Education Dept. and Family Policy Compliance Office (FPCO) have pretty much done nothing in the way of enforcement, as the FPCO’s response to EPIC’s FOIA request shows.
HHS and the US Education Department need to sit down at a table with patient privacy advocates, student privacy advocates, representatives of different mental health professions, school attorneys, and representatives of law enforcement to start discussing how to revise federal law to provide adequate privacy protections to those seeking mental health counseling in schools at both the k-12 and post-secondary level. I’d be happy to provide HHS and the US Education Dept. with suggestions as to specific people to invite to that table.
The sooner we address these concerns, the better, because as Richard Read of The Oregonian reports today – and as Dr. Deborah Peel and I have tried to warn people for years because we anticipated this happening – parents are beginning to caution their children about accessing mental health services on campus. Read reports:
As the reputation of the University Counseling & Testing Center hit new lows, some parents of UO students said they were telling their daughters and sons to avoid the clinic if they needed therapy or emergency help.
Requiring greater transparency about privacy policies and disclosures, as one Oregon legislator proposes, is important, but it is not sufficient. We need better protections that limit disclosures of students’ mental health counseling records. If we want to make counseling services a safe place for sexual assault victims, depressed students, or those dealing with substance abuse issues to seek help, we need to invest more in campus mental health services and we need to get privacy protections and exemptions right.
There is currently a bill in Congress to revise FERPA. It contains a provision on treatment records for students aged 18 or who are in a post-secondary institution, but it doesn’t go far enough, in my opinion, and it doesn’t address the bigger issue that we need more stringent protections for mental health records. We can write those protections into FERPA or we can put those records under HIPAA, but the former approach – amending FERPA or re-writing it from the ground up to include a separate section on counseling and treatment records – would probably be more likely to succeed.
Do nothing is not an option, even though Congress has generally been paralyzed by its own partisan stupidity. We need to create a safe environment for students to seek help, and to do that, we need stronger federal privacy and confidentiality protections. And we need it now – not after the next tragedy.