By Robert Greim, Michael Hobbs, and Doug Swink, of the University of Missouri — Kansas City
This fall, two class action lawsuits have led many Division I athletics compliance officers to engage with their campus general counsel in response to requests for information. One case involves a subpoena requiring information related to current and former student-athlete health records while the other involves current and former student-athlete financial aid records. For many institutions, these requests have served as a valuable exercise revealing strengths and weaknesses of internal processes related to retention of student contact data, education processes and record handling.
Each August, compliance officers in Division I Athletics Departments across the country prepare packets and PowerPoint presentations for the annual Student-Athlete Orientation. Although there is no prescribed format, these meetings typically involve a greeting from university and department leadership, an introduction of department staff, rules education sessions, and the signing of many forms by new and retuning student-athletes.
Recently, the NCAA National Office has assisted compliance officers by making the required Student-Athlete Statement and NCAA Drug Testing Consent forms available to student-athletes online. While these advances assist with workflow and monitoring, institutions most likely still uphold their obligation to educate the student-athlete population about the implications of the documents they signed electronically.
While these orientation meetings assist student-athletes in understanding their rights regarding ownership of the information in their academic and health record, there is not a uniform companion approach to explaining and monitoring the obligation of ethical access to this information on the part of athletics department employees.
Coaches and athletics staff members share a uniquely-close relationship with college students considering the bond formed during multi-year recruiting process, the extreme number of hours spent in each other’s company related to team activities, and the emotional ups and downs experienced by both individuals over the course of each playing season. Although the second-half of the twentieth century saw institutions of higher education in the United States move away from the restrictive and intrusive tradition of Oxford-style in loco parentis (Sweeton & Davis, 2004), it is possible that administrators or coaches of college sports understandably still assume this pseudo-parental responsibility for the well-being of student-athletes.
The unique dynamic between student-athlete and athletic staff member can complicate the application of student privacy issues and challenge the institution’s duty in safekeeping student records. An athletics department should protect its employees from violating HIPPA and FERPA through education as it may seem like second-nature for a coach or administrator to discuss the academic shortcomings, physical health, or disciplinary issues of team members with a parent, instructor, or media outlet.
This article aims to reinforce the work of Bell, Ratzlaff, and Murray (2008) given the numerous challenges, white papers, and additional privacy research conducted in the eight years since the authors offered their review and considerations for HIPPA and FERPA in college athletics.
To begin this discussion, it is important to understand the scope and intent of HIPPA and FERPA, and why it is that these laws must be followed in the above described student-athlete scenario. This understanding will allow institutions and student-athletes alike to have a better grasp on the information that may be disclosed and that must be withheld, as well as any other protections that may be awarded to student-athletes.
The Family Educational Rights and Privacy Act (FERPA) was enacted in 1974 to protect the confidentiality of student records. (“Family Educational Rights and Privacy Act”, Epic.org, 2016). Prior to the passage of the Act, there was a growing concern among lawmakers that students had no privacy when it came to their personal information as academic records effectively went unmonitored (Shiley, 2003). In the context of student-athletes, this open nature of student records became a problem due their notoriety on campus and in the community. Recognition of student-athletes across campus led to increased interest by the public to know every detail about their favorite athletes. Curiosity of the public, and more specifically the media, left student-athletes’ student records exposed in a way that could be unwanted by any student. FERPA is vital to the protection of student-athletes so they may be provided a sense of normality that is essential to academic success.
At institutions that receive funding from the Department of Education, FERPA provides students total control of their academic records and by prohibits the institution from disclosing personal academic information without written consent of the student. (“Family Educational Rights and Privacy Act”, Epic.org, 2016; Shirley, 2003). The penalty for failing to comply with all of its provisions is a loss of governmental support. Accordingly, information within student-athlete records must remain confidential. Unless the student is under the age of eighteen, this confidentiality extends to the parents of the student, as well.
The Health Insurance Portability and Accountability Act (HIPPA) is another law in place to protect an individual’s right to privacy. Rather than being geared towards students, HIPPA encompasses a broader range of individuals in that it is meant to protect medical records of any individual regardless of age. (“Definition of HIPPA”, Medicine.net, 2016). While the area of medicine and medical records has a longer history or regulation than student academic records, the main intent of HIPPA is to give individuals a better sense of control with regards to their personal information (“HIPPA Privacy Program”, University of Chicago Medical Center, 2010).
There are five steps that HIPPA requires healthcare professionals to implement that ensure the privacy of a patient’s health information. (Bell, Ratzlaff, & Murray, April 2008). These steps include: 1) notify patients about their rights and inform them of how their information will be used, 2) adopt and implement privacy procedures, 3) train employees on privacy procedures, 4) designate an individual to be responsible for ensuring that privacy procedures are adopted and followed, and 5) ensure that patient records containing individual identifiable health information are secure.
The impact of HIPPA on college athletics can be harder to comprehend as it only applies to “any entity that is a health-care provider that conducts certain transactions in electronic form; or is a health-care clearinghouse; or is a health plan” (Bell, Ratzlaff, & Murray, 2008). As can be seen, it is somewhat murky if an athletic trainer or athletic training staff should be covered under the requirements of HIPPA. What does seem certain is that any campus physician, or doctor retained by the institution would be accountable to follow HIPPA. Because of this, it is essential that institutions become well versed in HIPPA and its requirements before attempting to receive, or make public any medical information for any of its student-athletes.
While some institutions have been found guilty of and fined for violating FERPA (United States v. The Miami University, and The Ohio State University, 91 F.Supp.2d 1132)(2000)), others have prevailed against claims of privacy violations (Chicago Tribune Co. v. University of Illinois Bd. Of Trustees, 781 F.Supp.2d 672)(2011)). In reality, the turning point in most FERPA cases is whether or not the court considers the information in question to be of educational purpose. In US v. Miami University, the court determined that information on student disciplinary proceedings was not of an educational purpose and therefore not protected by FERPA (91 F.Supp.2d 1132)(2000)). Alternatively, in the University of Illinois case, admission records were determined to be of an educational purpose and therefore protected by FERPA provisions. (781 F.Supp.2d 672)(2011). The adverse impact to an institution’s image from media coverage can be significant and can thus cause disagreement as how best to approach employee responsibilities surrounding student information (Kamenetz, 2015), regardless of legal outcome.
While it is clear that FERPA cases can be difficult to resolve, situations involving HIPPA violations can be less complex, and yet still leave room for questioning. HIPPA provisions make it clear that when a student-athlete signs with a university, the student-athlete gives their athletic trainer the right to provide health information to the coach of each athlete. What is also clear is that the same exception to HIPPA does not apply in allowing trainers or coaches to disburse information to the public. (James Blake Hike, 2009). Due to the popularity of college athletics and constant demand for information, it is unclear the level of injury detail that an athletic trainer or team doctor may release to the public. To avoid HIPPA violations a best practice for trainers would be to not release any specific information to the media, but rather only provide injury descriptions that could be seen with the naked eye of a reporter watching the contest. Should this be followed, administrators and staff will clearly fall within HIPPA guidelines.
HIPPA and FERPA protected records are generally treated as separate regulations except when the two records types become associated with each other through the collection of records from an office. This can happen when a petition is submitted to a Registrar’s Office and medical documentation is submitted along with the petition to support a student’s case. While the student may have been the one who consented to submit these medical documents with their appeal, these records are no longer considered only a HIPPA record, since the medical records have now been associated with a student’s file.
For some universities, there may be policies and procedures regarding the retention of such medical documents in conjunction with petitions. Reviewing and implementing retention policies can help in managing medical records that become a part of a student’s education record.
It is very important institutional employees understand all records cannot be released without the student’s consent. This means that any medical records that are submitted to a student education file fall under the protection of FERPA and releasing these records to a third party would be a breach of FERPA. Online trainings regarding HIPPA and FERPA can educate staff and coaches while safeguarding them against the well-intentioned, but impermissible disclosure of information from a student’s record.
Institutions should carefully exam their policies and procedures regarding student records and understand the blurred line between FERPA and HIPPA when medical records become associated with student records. In a case where an athletics department would like to obtain academic or medical information from a student file, the golden rule is to always have consent from the student which gives the student full control of who will have access to their records and to be clear with the student regarding with whom the information will be shared.
In the interest of an individual’s right to privacy, athletics departments should consider engaging key constituents when establishing internal policies for the handling of this information. The Registrar, General Counsel, Faculty Athletics Representative, chief compliance officer, Head Athletics Trainer, primary team physician, and Director of Athletics should review departmental policy regarding the handling of student medical and academic records annually.
Given recent advances to empowering student voices on campuses across the nation, athletics departments might strongly consider including the president of their Student-Athlete Advisory Committee in these conversations, as well. Moreover, the SAAC president and chief compliance officer might consider co-presenting a plain-language explanation of the practical application of the name, image, likeness, and record release documents which student-athletes sign during the annual Student-Athlete Orientation in the interest of education and transparency.
These efforts imparting an understanding of HIPPA and FERPA to the student-athlete population can be combined with a lesson explaining the difference in the beyond a reasonable doubt of criminal law and the preponderance of evidence standard of higher education, all of which might lead a department to navigate the contentious waters of campus policy. Intentionally and strategically educating students and staff becomes all the more important when internal disciplinary measures are implemented and coaches or teammates of those impacted wish to respond publicly.
With the increase of litigation involving athletics in higher education, a focus on increased collaboration during policy-making and enhanced communication between administrators, staff, coaches, and students can make for a clearer understanding of the law and more enjoyable experience for the student-athlete. While it is natural for coaches and athletics staff members to feel a natural sense of entitlement to disclosing student information, such reinforcement of policies and educational efforts can also protect the employees in performing their jobs and protect students while enhancing their college experience.
Dr. Greim is the chief compliance officer for athletics and Dr. Swink is the Registrar at the University of Missouri – Kansas City. Mr. Hobbs is a 3L student at the University of Missouri — Kansas City School of Law.
