The University of Oregon is under scrutiny for their retrieval of a student’s therapy records without express consent.
In a recent Register-Guard article, UO Explains Handling of Student’s Confidential Therapy Records, Doug Park, the University of Oregon’s interim general counsel, explained to the UO Senate committee that he was following a legal demand sent to him from the woman’s (student’s) attorney to collect all documents that related to then-pending federal civil rights lawsuit against the UO. Parks indicated that at the time he felt he had to follow the demand letter and had to collect the therapy records.
According to the Register-Guard article, the “litigation hold” that Park received on August 6 required the UO to “produce and secure” all documents relevant to the lawsuit. Parks was concerned about the consequences of “failing to obey a litigation hold.”
Important Lessons – Balancing Duty to Preserve vs Respecting Privacy Laws
This story brings up some very important questions for organizations to consider when dealing with the duty of preservation and when confidential information is in the mix. It is true that when an organization is subject to a litigation hold, it has a duty to preserve relevant information. However, despite the duty to preserve, it is also important that organizations exercise caution with the process, and are vigilant about adhering to privacy laws.
Two privacy laws relevant to this case are: The Health Insurance Portability and Accountability Act of 1996 (HIPAA), which prohibits the disclosure of personably identifiable information without express written consent, and the Family Educational Rights and Privacy Act of 1974 (FERPA), which establishes students’ rights and institutions’ responsibilities regarding the privacy of education records. U of O’s policy for keeping records complies with FERPA.
The university’s action of retrieving the student’s confidential therapy records in response to a litigation hold, but without the express written consent, has undermined the confidence of the student body regarding the privacy of their own records. This situation highlights the importance of establishing policies to guide appropriate action. It also showcases the need for regular policy education programs so that meeting the duty to preserve is not in violation of privacy laws protecting confidential information.