College Rape Case Shows A Key Limit To Medical Privacy Law

The privacy of students who get care at university clinics is in doubt after the mental health records of a woman who says she was raped at the University of Oregon were used by the school in the course of defending itself against a lawsuit.

The unidentified student is suing the university for mishandling her assault. She says she was raped by three basketball players last year. The University of Oregon found the players responsible, and kicked them off the team and out of school.

But there was no court case. Nobody was found guilty of any crime. And it was only discovered later that one of the players had been suspended from a previous college team over allegations of sexual assault.

Those are some of the reasons the woman sued the university. Here's where the privacy issues surface:

The student suing the school got therapy at the university's health clinic. In preparing to defend itself against her complaint, the university got access to those records and sent them to its attorney.

Kelsey Jones, 21, is a student at the University of Oregon who works with the student-run Organization Against Sexual Assault. She says the case has shaken students' confidence in the mental health care they receive on campus; she, for one, won't seek care at the campus clinic.

"It's very concerning for a lot of people," Jones says. "It's ten times harder now to seek that help and feel safe and feel OK to share 100 percent of what you're feeling."

Two employees at the university's counseling center were also disturbed by the school's actions, and they fired off an open letter to the university community. One of the authors, therapist Jennifer Morlok, said her job was threatened and she felt the school was forcing her to violate her professional ethics.

The university administration would not talk on tape for this story. But in court papers, officials argued that since the student went to the school's health clinic, her health records belong to the school and therefore could be accessed. In addition, they argued that because the woman claimed emotional distress — a medical claim — the school was entitled to her medical records under a federal law known as the Family Educational Rights and Privacy Act.

Steve McDonald, an attorney for the Rhode Island School Of Design and a FERPA specialist, says the nation's medical privacy law, known as HIPAA, doesn't apply in this case, and the school is within its rights.

"I would think, in almost any case anywhere in the country, in a fear and emotional distress claim, those records would be relevant, and you would get them through some process," McDonald says.

Under FERPA, at a health clinic run by a university or college, the school has a legal right to get access to student medical records — if they're relevant for a legal defense. That may come as a surprise to anyone who assumes that doctor-patient privilege is the same regardless of where the care is received.

Gonzaga Law School professor Lynn Daggett, another FERPA specialist, agrees that the university is within its rights. The situation allows universities to avoid an important legal process, she says, simply because the therapist is a university employee.

"The way the school would access the records in the situation with a private therapist," Daggert says, "is that during discovery, before trial, they would ask her to voluntarily agree — or issue a subpoena for them. She would have every right to make a motion to the court to quash or modify the subpoena — have the court look at her medical records in camera, which means in secret in the judge's chambers — and have the court sort through what appropriately would be shared with the school and what would not be."

The issue has caused such a stir that Denise Horn, a U.S. Department of Education representative, weighed in on the need to protect confidentiality in a statement emailed to reporters.

"FERPA would permit the treatment records to be disclosed in litigation between the student and the institution," Horn wrote, "if the records are relevant for the institution to defend itself."

But the statement concludes: "The Department of Education urges higher education institutions to not only comply with FERPA, but also to respect the expectation of confidentiality that all Americans hold when talking to a counselor or therapist."

Back on campus, student Kelsey Jones remains unsatisfied with the legal explanations: "Whether it's legal or not legal, I think it's morally and ethically not right."

This story is part of NPR's reporting partnership with Oregon Public Broadcasting and Kaiser Health News.