On August 18, 2015, the Department of Education issued a Dear Colleague letter to reiterate the Department’s views on the limits that the Family Educational Rights and Privacy Act (“FERPA”) places on an institution’s ability to access and disclose a student’s medical records. Among other topics covered in the letter, the Department provided guidance on the disclosure of student medical records to university officials (including counsel) and courts in the context of litigation between the institution and the student, without first obtaining the student’s consent or a court order.
In short, the Department views FERPA protections for student medical records as similar to the protections provided to patient records under the Health Insurance Portability and Accountability Act (“HIPAA”) in cases of litigation between the medical provider and a patient. That is, absent the student’s consent or a court order, the Department would consider disclosure of student medical records to others, including to counsel or to a court, to be impermissible unless the litigation itself directly related to the underlying medical treatment and/or payment for such treatment. Further, even if disclosure were permitted under this exception, the institution may disclose only those medical records “relevant and necessary” in the litigation.
The Dear Colleague letter also reiterated that student consent is not required in cases of disclosure by an institution to “appropriate parties” if the student poses a threat to self or others.
Client Tip: Institutions should review and, as appropriate, update their policies on access to student medical records. Where litigation between an institution and a student occurs, the institution should continue to safeguard the confidentiality of the student’s medical records and avoid overbroad disclosures