FERPA Violation or Not?
A female student attending a public university in Oregon accused three players from the university basketball team of raping her in March 2015. One of her attackers had been suspended from a previous college team over similar allegations. The female student received counseling at the university’s counseling clinic. Nothing was done to the three athletes until May 2015 (well after basketball season), when university administration kicked them off the basketball team and expelled them from the university. When the female student learned that the coach had recruited one of the athletes despite his history of sexual assault, she filed a suit against the university for negligence and emotional distress. The university accessed the female student’s counseling records and sent them to its attorney. University officials contended that since the female student went to the health clinic, the records belonged to the university and further held that the claim of emotional distress (a medical condition) entitled the school to her medical records under FERPA.
1. Did the university violate FERPA or HIPAA?
2. What facets of this real-life case are operative in the decision of whether a violation has occurred?