When Therapy Records Are Only As Private As A School Schedule, It’s Time To Update Federal Confidentiality Law
By Rebecca Gudeman
Introduction
After being sexually assaulted by three members of the school basketball team, a University of Oregon student sought counseling at her campus health center. For a time, the school seemingly did nothing about her sexual assault allegation. Several months later, after the basketball season ended, the school ultimately disciplined the assailants. The victim then found out that one of the assailants had been suspended from another school after being accused of sexual assault, prior to enrolling in the University of Oregon. She finally sued the school under Title IX for mishandling her case and failing to provide a safe learning environment.1 In preparing its defense, the school contacted the school health center, copied her therapy records and sent them to the school’s attorneys.2 When this breach came to light, it raised outrage, and many felt it violated the young woman’s privacy protections. It probably would have, had the records been subject to HIPAA — a law that controls access to health information. Instead the records were subject to FERPA — a law that controls access to educational files — and under FERPA, the school did nothing wrong.
Many assume that if you are seeing a licensed medical or mental health provider, you will have same privacy rights no matter who employs that provider or where they have their office. The case in Oregon brought to national attention the unfortunate truth that the therapist’s employer matters. The confidentiality protections that patients have when they seek mental health services from a therapist in the community may not apply when that same therapist provides services at a school. In fact, when students receive mental health counseling from a therapist who is a school employee, the therapist’s records are given no greater protections and treated no differently than any other mundane information in their school file, such as the students’ attendance records, schedule, or grades.
This conflict between the privacy expectations of patients and the legal reality of confidentiality law is not new, but few patients know about it. The Oregon case brought national attention to the issue for the first time. This could easily have a chilling effect on service delivery, as more students and families realize the limited protections that apply when services are provided at school.
This is particularly unfortunate because delivering mental health and counseling services at school sites is a promising strategy for bringing early referral and intervention to students at the elementary, secondary, and university level. Indeed, more and more mental health services are being provided at the school site and integrated into school programs. As the importance of these services is recognized and school based health services expand, it’s time to amend federal law so that patients can have the same confidentiality protections at school as they would anywhere else.
Confidentiality – What usually happens when you see a counselor
Typically, when a patient engages a health professional for mental health or counseling services, the information and records created are protected by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule and any applicable state laws. The individuals and agencies that must follow the HIPAA Privacy rule include health plans, health care clearinghouses, and health care providers who transmit health information in electronic form. Thedefinition of “health care providers” covered by HIPAA is quite broad and includes both individual providers such as physicians, clinical social workers, and other medical and mental health practitioners, as well as hospitals, clinics and other organizations that provide, bill for, or are paid for health care.3
As a general rule, HIPAA requires health care providers to protect the confidentiality of “individually identifiable health information”4 and prohibits them from disclosing it, or allowing others to access it, without signed permission from the patient or the patient’s personal representative.5 Recognizing the sensitive nature of mental health therapy records in particular, HIPAA provides even greater protection for what it terms “psychotherapy notes.”6 Psychotherapy notes are the notes a mental health clinician takes that document or analyze conversations that occur during counseling sessions.7
The protections found in HIPAA encapsulate a common law history that dates back as far as Hippocrates, of treating medical and mental health information as private and confidential. The HIPAA protections also generally align with the confidentiality standards found in the professional codes of ethics that many medical and mental health organizations have developed for their members.8 These standards reflect a common cultural understanding that the physician-patient and therapist-patient relationship should be treated as sacrosanct.
What protects records when services are provided on a school campus
So what happens when health and mental health services are provided by health professionals at a school? The HIPAA Privacy Rule explicitly states that its rules do not apply to health information held in an “education record” subject to the federal Family Educational Rights and Privacy Act (FERPA).9 In other words, if FERPA applies, the HIPAA Privacy Rules does not.
FERPA is a federal law that applies to “educational agencies or institutions”10 that receive federal funds under programs administered by the U.S. Secretary of Education. FERPA controls disclosure of student “education records” and the personally identifiable information contained in these records.11“Education records” are defined as records, files, documents and materials recorded in any format that contain information directly related to a student and are maintained by an educational agency or institution, or a person acting for such agency or institution.12
Student health records created or maintained by a licensed medical professional employed by or acting on behalf of a school or district are part of the education record because they (1) contain information related to a student and (2) were created and are being maintained by a school employee or agent.13 There are a few situations in which student health information maintained by a school employee would not be part of the “education record” subject to FERPA, but the exceptions are quite limited.14 This means the health records created by a school employee are subject to the same confidentiality protections — and limits on protection — as any other information in the student’s education file, including grades, attendance and class schedule.
Why it matters whether your therapy records are subject to HIPAA or FERPA
In some ways, HIPAA and FERPA are very similar. Both protect the confidentiality of records, limit access by ‘unauthorized’ individuals without written permission, and both, as a general rule, require signed permission from the parent or other authorized representative in order to access the records.15 Both have exceptions that allow or require disclosure without informing the owner of the information. For example, both include exceptions that allow or require release in health or safety emergencies, to comply with mandatory child abuse reporting laws or when there are lawfully issued subpoenas or court orders requiring their release.16
FERPA has a number of exceptions, however, that are not found in HIPAA. One example is the “school official” exception.17 FERPA allows schools and educational agencies to share information in a student’s education record with “school officials” who have a “legitimate educational interest” in the information. The term “school official” includes school staff, such as teachers, health staff, clerical staff, school police, and attorneys. 18 A school or district also may define this term more broadly so that it also includes the ability to share information with outside consultants, contractors, or volnteers to whom the school has outsourced a school function.19
The school official must have a “legitimate educational interest” in the information in order to access it under this exception. The U.S. Department of Education (DOE) has interpreted “legitimate educational interest” to mean that the official needs access in order to perform his or her professional duties.20 The DOE has stated that “FERPA vests institutions with significant discretion to make determinations about who is a school official, and what is a legitimate educational interest.”21 In the Oregon case, the attorneys for the school accessed the young woman’s therapy records using the “school official” exception. Arguably, they needed to access her records in order to perform their duty to defend the University.
This school official exception can be used by many types of “school officials” to access health records and use them in ways that harm the patient and are contrary to the goals of service provision. The following hypothetical illustrates:
James is 14 years old and in 8th grade at his local public middle school. Like more and more middle schools around the country, James’ school has an onsite student health center funded by the district that provides early intervention services and support for students. James, normally a very engaged student, has been having a hard time focusing in class recently, and his teacher refers him to the school health center. After meeting with the therapist several times and developing a relationship with her, James discloses that there is a lot of stress in his family because his father is out of work and an older brother recently was killed. His therapist asks James what strategies he has used to try to cope with stress. James tells his therapist that shortly after his brother’s death, he smoked marijuana a few times because his friends told him it would make him feel better, but he explains he didn’t really like it. They then talk about finding healthier alternatives. All of this information is recorded in the therapist’s notes.
Now let’s say the school law enforcement unit and principal hear a rumor about drug use and sales on campus. They believe that James might be involved. The principal and an officer go to the counselor’s office. They use the “school official” exception to access James’ records because they each believe they need the information to do their jobs. In their records review, they find James’ admitted marijuana use. The principal uses the information to start suspension proceedings against James. The law enforcement officer calls James in and threatens to arrest him. When James realizes where the officer and principal obtained information about him, he vows never to seek mental health services again.
The Chilling Effect
A lack of confidentiality in health information has a chilling effect on students’ willingness to seek care. Once the Oregon case came to light, student confidence in on-campus health was shaken, according to an NPR news report. One student interviewed by NPR said “It’s very concerning for a lot of people. It’s ten times harder now to seek that help and feel safe and feel OK to share 100 percent of what you’re feeling.”22
In order to restore student confidence after the records breach came to light, the University of Oregon promised to revise its health center confidentiality policies to provide better clarity regarding its confidentiality practices and commitment to confidentiality. In comparing the prior policies to the new ones, however, the Oregonian noted that many protections previously promised actually were eliminated. For instance, the current policies delete the previously included commitment that generally a client’s written permission will be sought before releasing personal health information and imply that broad sharing within the University is possible.
The new policies appear to be a more accurate portrayal of the protections, or lack of protection, that FERPA affords. After reviewing the new policies, students felt less assured than ever. The Oregonian quoted one student as saying “It makes me deeply uncomfortable…We deserve to have a counseling center where we can talk and feel safe and know that our information is kept in a confidential manner.”23
The situation also puts counselors who work at schools in an ethical bind. While HIPAA’s privacy provisions generally align with the professional codes of ethics that most providers operate under, many therapists feel that FERPA does not. Indeed, the therapist who was asked to make the Oregon student’s files available wrote an open “Letter of Concern” to University administrators and others, in which she says that she felt the request conflicted with her professional and ethical standards. Due to this conflict, she said she felt compelled to seek advice from the Oregon Board of Psychologist Examiners regarding her duties.24
The Value of School Based Care
This is particularly unfortunate because providing mental health services at the school site is a promising strategy for elementary and secondary schools seeking to support their students. According to the National Institute of Mental Health, half of all mental health disorders will exhibit before age 14.25 The federal Substance Abuse and Mental Health Services Administration (SAMHSA) found, in one study of young people ages 12-17, 39 percent reported having witnessed violence, 17 percent reported experiencing physical assault, and 8 percent reported having experienced sexual assault.26 Trauma, stress, and other adverse childhood experiences can increase the probability of mental health disturbances and lead to learning problems and behavior changes in school.27
School based mental health services are among the fastest growing types of school based health services.28 According to the American Academy of Pediatrics, schools are already the “primary providers of mental health services for many children.”29 School-based mental health services make sense on multiple levels. They allow for early identification and intervention for youth. They make services immediately accessible for children and families who may struggle to find care in their communities or to find the time to go to appointments. And they allow for collaboration between school staff and counselors – leading to better educational outcomes as well as better care.30 They only work, however, if students and families feel safe using them.
The case for amending FERPA
Even the U.S. Department of Education (DOE) now acknowledges that medical records should be treated differently than other information in an education file.
After the Oregon incident, Representative Suzanne Bonamici and Senator Ron Wyden, both of Oregon, asked the DOE to clarify the privacy protections available on school campuses.31 The Department responded to them and also issued a public “Dear Colleague” letter. The letter begins by recognizing the importance and many benefits of providing health services to students. The letter then says “these benefits cannot be fully realized in an environment where trust between students and the institution is undermined. Students should not be hesitant to use the Institution’s medical services out of fear that information they share with a medical professional will be inappropriately disclosed to others.”32
The DOE letter goes on to recommend that universities treat health records in line with HIPAA, but, as the letter acknowledges, this is not a mandate, because FERPA gives schools broad discretion to interpret FERPA. Thus, the only way to ensure schools treat such records in line with HIPAA is by addressing FERPA itself.
Possible Options for Amending FERPA
Currently, there are several bills pending in both the U.S. House of Representatives and Senate to amend FERPA or otherwise provide greater protection for student information.33 In September, Representative Bonamici and Senator Wyden jointly proposed language that would specifically address the problem of lawyers accessing health records using the “school official” exception.34 None of these proposals, however, addresses the core problem – that medical information in an education file is treated no differently, and receives no greater protection, than any other education record.
There are several possible strategies to amend FERPA to provide greater protections to medical information in a school file. One possibility is to exempt medical and mental health records altogether from the definition of “education record” in FERPA and put them entirely under the protections of HIPAA and applicable state medical confidentiality laws. Another possibility is to keep summary health information within the definition of education record (such as dates of treatment, diagnosis, and general progress notes) but exempt highly sensitive health information, such as the detailed notes a provider makes while treating a patient, from FERPA. In some ways, this approach is what HIPAA does in distinguishing “psychotherapy notes” from other health records.35 A third possibility is to keep medical records within the definition of education records subject to FERPA but provide them additional protections. These additional protections could include limiting who may access health records in an education file without written permission or a court order, or giving medical professionals the ability to overrule access by third parties when the medical professional believes access could harm the patient or would violate ethical standards of practice.
In crafting the best proposal, a broad array of stakeholders and experts should be consulted in order to make sure that health records are sufficiently protected but also that access is not restricted to such an extent that it impedes other important education and health goals, such as delivery of special education assessment and services, and collaboration between teams at school sites.
Conclusion
Since the time of Hippocrates, we have recognized the important role of confidentiality in the provision of health and mental health care. Yet, when health services are provided by professionals employed by a school, federal law grants these records no greater confidentiality protections than those afforded to attendance and other education records. As Congress is turning its attention to FERPA and school privacy issues, the time is right to raise and resolve the issue of health privacy in schools.
1 Jill Martina, Student Sues University of Oregon, Coach over Alleged Gang-Rape, CNN, (Jan. 9, 2015), available at: http://www.cnn.com/2015/01/09/justice/university-of-oregon-title-ix-lawsuit/
2 Kristian Foden-Vencil, College Rape Case Shows Key Limit to Medical Privacy Law, NPR, (March 9, 2015), available at: http://www.npr.org/sections/health-shots/2015/03/09/391876192/college-rape-case-shows-a-key-limit-to-medical-privacy-law
3 45 C.F.R. § 160.103 (“Health care provider means a provider of services … a provider of medical or health services … and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.”).
4 45 C.F.R. § 160.103 (“Health information means any information, whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. …Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) ! at identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual”).
5 See 45 C.F.R. §§ 164.502, 164.508.
6 See 45 C.F.R. § 164.508(a)(2).
7 45 C.F.R. § 165.501 (“Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.”).
8 See e.g. American Psychological Association, Code of Ethics, Standard 4, available at: http://www.apa.org/ethics/code/principles.pdf; see also American Association of Family Therapists, Code of Ethics, Standard II, available at: http://aamft.org/iMIS15/AAMFT/Content/Legal_Ethics/Code_of_Ethics.aspx
9 45 C.F.R. § 160.103 (“Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act…”).
10 34 C.F.R. § 99.1.
11 See 20 U.S.C. §§ 1232g(a),(b); 34 C.F.R. § 99.2.
12 20 U.S.C. § 1232g(a)(4)(A); 34 C.F.R. § 99.3(defining “education record”).
13 See 20 U.S.C. § 1232g(a)(4)(A); 34 C.F.R. § 99.3.
14 See e.g. 20 U.S.C. § 1232g(a)(4)(B); 34 C.F.R. § 99.3 (“’Education records’…(b) The term does not include: (1) Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the record. (2) Records of the law enforcement unit of an educational agency or institution, subject to the provisions of§ 99.8.…(4) Records on a student who is 18 years of age or older, or is attending an institution of postsecondary education, that are:(i) Made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assisting in a paraprofessional capacity;(ii) Made, maintained, or used only in connection with treatment of the student; and(iii) Disclosed only to individuals providing the treatment. For the purpose of this definition, “treatment” does not include remedial educational activities or activities that are part of the program of instruction at the agency or institution; and (5) Records created or received by an educational agency or institution after an individual is no longer a student in attendance and that are not directly related to the individual’s attendance as a student.(6) Grades on peer-graded papers before they are collected and recorded by a teacher.”).
15 See 45 C.F.R. §§ 164.502, 164.508; 20 U.S.C. §1232g(b); 34 C.F.R. § 99.30.
16 See 45 C.F.R. § 164.502; 34 C.F.R. § 99.31.
17 34 C.F.R. § 99.31(a)(1).
18 See 34 C.F.R. § 99.31(a)(1)(i)(A): See U.S. Dep’t of Education, FERPA General Guidance for Students (“Although the term ‘school official’ is not defined in the statute or regulations, this Office generally interprets the term to include parties such as: professors; instructors; administrators; health staff; counselors; attorneys; clerical staff; trustees; members of committees and disciplinary boards”), available at: http://www2.ed.gov/policy/gen/guid/fpco/ferpa/students.html
19 34 C.F.R. § 99.31(a)(1)(i)(B).
20 See U.S. Dep’t of Education, FERPA General Guidance for Students (“A school official generally has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.”), supra note 18.
21 See U.S. Dep’t of Education, Dear Colleague Letter to School Officials at Institutions of Higher Education, August 8, 2015 (“FERPA vests institutions with significant discretion to make determinations about who is a school official , and what is a legitimate educational interest. The Department has provided guidance that a school official would have a legitimate educational interest if the official needed to review an education record in order to fulfill his or her professional responsibility.”), available at: http://ptac.ed.gov/sites/default/files/DCL%20Final%20Signed-508.pdf
22 Kristian Foder-Vencil, College Rape Case Shows Key Limit to Medical Privacy Law, NPR, March 9, 2015, available at: http://www.npr.org/sections/health-shots/2015/03/09/391876192/college-rape-case-shows-a-key-limit-to-medical-privacy-law
23 Richard Read, UO quietly diminishes privacy protections at student counseling center, despite promises, The Oregonian, April 8, 2015, available at:http://www.oregonlive.com/education/index.ssf/2015/04/uo_quietly_diminishes_privacy.html
24 Jennifer Morlok and Karen Stokes, “Letter of Concern”, available at http://www.scribd.com/doc/255145466/Letter-of-Concern-University-of-Oregon
25 NIMH, Treatment of Children with Mental Illness, http://www.nimh.nih.gov/health/publications/treatment-of-children-with-mental-illness-fact-sheet/index.shtml
26 SAMHSA, Recognizing and Treating Child Traumatic Stress, available at http://www.samhsa.gov/child-trauma/recognizing-and-treating-child-traumatic-stress
27 id.
28 Jamie Chamberlin, Schools Expand Mental Health, Monitor, Vol. 40, No. 1, 64 (2009), http://www.apa.org/monitor/2009/01/school-clinics.aspx
29 American Academy of Pediatrics Committee on School Health, School Based Mental Health Services, Pediatrics, Vol. 113, No. 6 (June 1, 2004), available at: http://pediatrics.aappublications.org/content/113/6/1839.full?sid=9e02f286-9a8d-473c-a9b9-a45bf4a26386
30 Id.
31 See Tyler Kingkade, Federal Official ‘Concerned’ About Loophole in Privacy Law for Rape Victims, Huffington Post, June 11, 2015, available at: http://www.huffingtonpost.com/entry/college-sexual-assault-records_557a0b09e4b054f2de28f975
32 U.S. Dep’t of Education, Dear Colleague Letter to School Officials at Institutions of Higher Education, August 18, 2015, supra note 21.
33 See e.g. H.R. 3157 (Student Privacy Protection Act), 114th Congress (2015-2016), S. 1322 (Protecting Student Privacy Act of 2015), 114th Congress (2015-2016).
34 Wyden, Bonamici Release Draft Bill to Protect Student Privacy, Sept. 17, 2015, available at: https://bonamici.house.gov/press-release/wyden-bonamici-release-draft-bill-protect-student-privacy.
35 See 45 C.F.R. § 165.501 (defining “Psychotherapy notes” and excluding from the definition and thus additional protection “ medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.”).
