The US Department of Education (DoE) released draft Family Educational Rights and Privacy Act (FERPA) guidance for higher education institutions to address how student medical records (and student mental health records) can be disclosed in the event that there is a lawsuit or other legal action with a student. The guidance comes after a recent case where a student filed a lawsuit against a university because of how it handled an assault complaint.

The university came under fire over how it handled the student’s mental health records in reaction to the complaint and lawsuit. When a review of the incident found that FERPA appears to allow for such disclosures, there were loud calls by Congress and privacy advocates to increase the privacy protections that higher education institutions are required to use for the health care information of students.

The new draft guidance issued by Kathleen Styles, Chief Privacy Officer for DoE, is in a “Dear Colleague Letter” and starts with the premise that students should not be hesitant to use the institution’s health or counseling services out of fear that information shared with a professional will be inappropriately disclosed to others. The guidance then outlines how colleges and universities should handle the privacy of student medical records under FERPA and how it should be in a manner similar to the way healthcare providers are required to handle a patient’s records under the HIPAA Privacy Rule.

The guidance specifically expresses that if there is litigation between a higher education institution and a student, the institution should not provide medical records to the school’s attorneys or courts, unless there is a court order or if the student has provided authorization to allow it. The DoE guidance points out one exception is if the student’s legal action directly relates to health care treatment provided by the college or university or payment for those services. In that event, the medical records should be limited to only relevant or necessary people involved in the litigation. 

To clarify, the guidance uses the example of, “If an institution provided counseling services to a student and the student subsequently sued the institution claiming that the services were inadequate, the school’s attorneys should be able to access the student’s treatment records without obtaining a court order or consent. However, if instead the litigation between the institution and the student concerned the student’s eligibility to graduate, the school should not access the student’s treatment records without first obtaining a court order or consent.”

DoE is asking for input up until October 2, 2015, on the development of final guidance. All comments can be emailed to FERPA.comments@ed.gov. Click here to download the draft FERPA guidance.