As the school year begins across the country, I want to sound a warning to students about HIPAA and student privacy. If you are considering seeking counseling from university health services, then you definitely should. But know not that HIPAA might not protect your privacy. Students should consult their university’s policies in regards to student health records and how they might and might not be used by the university.
In sounding this warning, I have had to weigh the ethical implications of issuing this warning. I need to emphasize that it is a much greater risk to the mental health of a student to avoid help altogether than the risk from unethical disclosure of health records. Don’t let the fear for your privacy keep you from seeking help. But know your rights and know your options.
What few people realize is that in most cases, student medical records at universities are covered by FERPA, the Family Educational Rights and Privacy Act of 1974, (FERPA), not the Health Insurance Portability and Accountability Act of 1996 (HIPAA). FERPA governs the rights of students and parents in regards to the sharing of educational records. In a joint guidance document put out by the U.S. Department of Education and the Department of Health and Human Services (most recently in December 2019), the agencies explicitly said, “FERPA applies to most public and private postsecondary institutions and, thus, to the records on students maintained by the campus health clinics and other health care facilities operated by such institutions. These records will be either education records or treatment records under FERPA, both of which are excluded from coverage under the HIPAA Rules, even if the school is a HIPAA covered entity.”
University of Oregon case
(A content warning: this article touches on allegations of sexual assault. If you don’t want to read about it, skip to the next section.)
The potential implications of the impact on HIPAA and student policy were brought into the public spotlight in 2015 with the University of Oregon. The student sued the university over allegations that they mishandled her complaint about being sexually assaulted by three U of O basketball players. She alleged that the University knew about previous accusations of sexual misconduct against one of the basketball players but recruited him anyway.
In preparing for its defense, the University gained access to the student’s therapy records and sent them to their attorney. One of the student’s counselors said she was threatened with losing her job if she didn’t cooperate in turning over the records and felt that the school was violating her professional ethics. But experts say that as shockingly immoral such an action is, it’s also legal under current Federal law.
Don’t avoid counseling if you need it
University counseling services can be very helpful services for students struggling with adjusting to university life or dealing . I would urge students to seek help as needed and university mental health services would be a natural first step because they usually provide free or the most affordable care. The quality of university mental health supports varies as widely as it does in the private sector. My undergraduate university’s supports were very good, while I had a poor experience with the university where I got my graduate degree (though the individuals behind that poor experience are no longer employed there).
If you are considering seeking mental health services from your university, I would urge you to take a look at the complete written text of your university’s privacy policy in regards to student health records, to see if they implement any protections over and above what FERPA requires. (Don’t rely on a written summary as the devil can be in the details.) Some universities may have implemented policies to avoid debacles like what happened to the University of Oregon case.
Another option is to find more affordable mental health care through the Open Path Psychotherapy Collective. This non-profit lists therapists willing to take clients for between $30 and $70 per session.
Despite these concerns about HIPAA and student privacy at educational institutions it is critical that students seek mental health help when they need it. Once again, this article should not be seen as a deterrent to that. It’s worth noting that cases like what happened with the University of Oregon are extremely rare. But I also want students to be informed consumers and to make the right choices for themselves