by now I’m sure this link to the Virginia Tech shooting investigation report has made the rounds.
Below is a summary of chapter V, entitled “Information Privacy Laws” which provides an overview of the privacy laws affecting records involved in the incident and recommendations for improvement.
The key finding is that University policy should recognize that law enforcement, medical providers, and others who assist troubled students have an educational interest in sharing records. When confirmed by policy, privacy laws should not present a barrier to these entities sharing information with each other. Privacy laws need only minor tweaking but guidance and training will need augmenting.
In this case, the privacy laws contained provisions that allowed information about Cho to be shared but this information was not shared since non-disclosure was perceived to be the safer choice. Cho’s parents, his suitemates, and their parents were never informed that he had been temporarily detained, put through a commitment hearing for involuntary admission, and found to be a danger to himself. Efforts to share this information was impeded by laws about privacy of information. The report says that, “Indeed, the university’s attorney, during one of the panel’s open hearings and in private meetings, told the panel that the university could not share this information due to privacy laws.” So the report suggests that the first major problem is the lack of understanding about the laws but that the next problem is inconsistent use of discretion under the laws. It is this “discretion” that improved guidance, i.e. training and awareness, would remedy.
The second recommendation of the report is worth noting: Privacy laws should be revised to include “safe harbor” provisions. The provisions should insulate a person or organization from liability (or loss of funding) for making a disclosure with a good faith belief that the disclosure was necessary to protect the health, safety, or welfare of the person involved or members of the general public. Laws protecting good-faith disclosure for health, safety, and welfare can help combat any bias toward nondisclosure.
Key takeaways:
-The unknown variable is how entities will choose to exercise their discretion when the law gives them a choice on whether to share or withhold information. For example, the Family Educational Rights and Privacy Act (FERPA) currently allows schools to release information in their records to parents who claim adult students as dependents for tax purposes or when the student has violated alcohol or drug laws and is under 21. Schools are not, however, required to release that information. Yet, if a university adopts a policy against release to parents, it cuts off a vital source of information.
-Medical privacy laws such as the Health Insurance Portability and Accountability Act (HIPAA) apply to all information—written or oral—gained in the course of treatment. FERPA applies only to recorded information in student records. Personal observations and conversations with a student fall outside FERPA. Since personal observations and conversations with a student fall outside FERPA, teachers or administrators who witness students acting strangely are not restricted by FERPA from telling anyone—school officials, law enforcement, parents, or any other person or organization. In this case, several of Cho’s professors and the Residence Life staff observed conduct by him that raised their concern. They would have been authorized to call Cho’s parents to report the behavior they witnessed.
-Many records kept by university law enforcement agencies also fall outside of FERPA. For example, it does not apply to records created and maintained by campus law enforcement for law enforcement purposes. If campus law enforcement officers share a record with the school, however, the copy that is shared becomes subject to FERPA. For example, in fall 2005, Virginia Tech Police Department (VTPD) received complaints from female students about Cho’s behavior. Their records of investigation were created for the law enforcement purpose of investigating a potential crime. Accordingly, the police could have told Cho’s parents of the incident. When the university’s Office of Judicial Affairs requested the records, FERPA rules applied to the copies held in that office but not to any record retained by the VTPD.
-Law enforcement performs various other functions that promote public order and safety. For example, law enforcement officers are usually responsible for transporting people who are under temporary detention orders to mental health facilities. No privacy laws apply to this law enforcement function. In the Cho case, the VTPD was not prohibited from contacting the university administration or Cho’s parents to inform them that Cho was under a temporary detention order and had been transported to Carilion St. Albans Behavioral Health.