Dear Colleague Letter to School Officials at Institutions of Higher Education

Dear Ms. Styles,

Thank you for the opportunity to provide comments on the Department’s Dear Colleague Letter to School Officials at Institutions of Higher Education on behalf of the Center for Democracy & Technology (CDT). CDT is a nonpartisan, nonprofit technology policy organization dedicated to protecting civil liberties and human rights, including privacy, free speech and access to information. We’ve worked extensively on student privacy this year, including releasing a white paper on the subject in June, hosting a Hill briefing with members of Congress and various stakeholders, and working with Congressional staff on proposed federal legislation.

As noted in your letter, protecting the privacy of students’ medical records is critical to promoting campus safety and health. A student’s visit to campus health services should not result in highly sensitive information about them shared with parties who are not involved in their medical treatment. Unfortunately, FERPA and federal regulations do not explicitly prohibit such practices. We therefore welcome the Department’s guidance on sharing students’ medical records, and hope you will expand upon this guidance in coming months. Specifically, the Department should provide guidance on methods for limiting disclosures only to records that are “relevant and necessary” to litigation, and guidance that clarifies what constitutes a “health or safety emergency”. The Department should also provide similar guidance to K-12 and early childhood schools.

CDT agrees that FERPA’s school officials exception should be construed to offer
protections similar to HIPAA’s Privacy Rule when student medical records are shared for litigation. It makes sense to limit non-consensual or non-court-ordered medical record sharing to only those circumstances where litigation is directly related to medical treatment or payment, and in those cases only disclose records that are “relevant and necessary” to the litigation. To assist schools in carrying out this recommendation, the Department should consider publishing guidelines on partial sharing of medical records that discuss methods for limiting disclosures only to records that are relevant and necessary to litigation.

The Department should also offer further guidance on what constitutes a “health or
safety emergency” that warrants sharing medical records without consent or court order. Current federal regulation leaves much of this determination up to school officials [1], which could include non-employees with separate (and possibly contrary) interests from the school. For example, on campuses where state or local police officers are consideredschool officials, law enforcement could presumably access a student’s medical records without judicial review or patient consent to investigate incidents that arguably are not “health and safety emergencies”. This type of access could go unchallenged unless the campus is in a state that provides more stringent medical records privacy laws. The Department should offer examples of health and safety emergencies, as well as outline precautions schools should take in these cases to ensure medical records are not misused by those with access.

Additionally, K-12 and early childhood schools would benefit from a similar Dear
Colleague letter on sharing student medical records. In particular, this guidance should address cases where the student and parent interests are not aligned. Although it is not within the Department’s authority to deny a parent the right to consent to release of their students’ records, other state and federal laws or regulations may prohibit such sharing. The Department should therefore offer K-12 and early childhood schools direction on communicating with parents and complying with applicable laws when a minor-aged student objects to disclosure or it is determined that disclosure is not in the minor-aged student’s best interests.

Finally, the issue of student medical records disclosure highlights the need for updates to FERPA that better protect students’ and parents’ privacy rights. Parents and students over 18 have the right to access, review and challenge information in their educational record, however the only way to challenge an erroneous decision to share a student’s medical information is for the student or parent to submit complaints to the Department. Given the highly sensitive nature of health records, erroneous decisions to release these records could severely harm a student and potentially increase schools’ liability. We hope the Department will support efforts at the state and federal level to provide students and parents with additional remedies if medical records are mistakenly released.

Thank you again for the opportunity to weigh in on this important issue. Please do not hesitate to reach out for further input.

Respectfully submitted,

Alex Bradshaw
Ron Plesser Fellow
Center for Democracy & Technology
[email protected]