Confusing laws keep information confidential on college campuses

A college football game illustrates the strange interpretations of HIPAA. The star quarterback is sacked during a play and 50,000 spectators and a national TV audience see his leg snap. But the coach will not talk about the player's injury because he thinks HIPAA prevents him.

In reporting on universities -- whether the topic is football or campus crime -- journalists are finding the Health Insurance Portability and Accountability Act an obstacle to gaining records and information.

One of the HIPAA challenges unique to university coverage is that certain student records have long been considered confidential under a different federal law, the Family Educational Rights and Privacy Act, known as FERPA or the Buckley Amendment.

This can lead to confusion on everyone's part about which law applies and why, particularly because one department might withhold information under FERPA, while another can cite HIPAA in holding the same information confidential.

For example, health records kept by the student health center are student records covered under FERPA. If those records are disclosed to an athletic coach, FERPA controls what the coach can discuss publicly.

However, the same student health information at a university hospital might be controlled by HIPAA but not FERPA, said Jerry Woods, an attorney with Kilpatrick Stockton in Georgia and former counsel for the Medical College of Georgia.

"A lot of universities are very concerned because they're dealing with two different laws and they're trying to administer these laws," Woods said.

Even when FERPA does not apply, two schools can be subject to very different rules about the release of information because agencies have flexibility in the way they set themselves up under HIPAA.

Universities can make their entire organizations subject to HIPAA, or they can be "hybrid entities" with HIPAA-compliant health care components and non-health components that are free from the regulation.

For instance, the University of Kentucky has defined its athletic training facility and employees as part of the non-health care unit of the university, so it does not have to comply with the same regulations as the health care component.

If an athletic department is not considered part of the health care component, its employees are not subject to HIPAA -- even when they get information from a health care provider who is covered, Woods said.

HIPAA does not control the coach once that information has been disclosed, in the same way it does not control a journalist who has the information. But the coaches might think it does.

"They believe in good faith they can't disclose the information, and they may get legal advice to that effect," Woods said.

But in the other scenario -- if a university made no distinction between the athletic department and other health care services for HIPAA purposes -- a coach may be prohibited by HIPAA rules from disclosing certain information about players.

'Our hands are tied'

With those complicated rules, it is not surprising that HIPAA can be as confusing for college officials as it is for journalists.

A 2003 Associated Press story reported that officials at some schools, such as Kansas State University, thought HIPAA applied to them, but other universities did not.

For example, an August 2005 article in The (Baton Rouge) Advocate reported that Louisiana State University sports information director Michael Bonnette would not discuss a football player's knee injury.

"He's got a knee injury, and that's all we're saying," he told the newspaper. "Due to these new medical laws, our hands are tied."

To Keith Webster, the head athletic trainer at the University of Kentucky and former chairman of the government committee for the National Athletic Trainers Association, these types of responses are frustrating.

"I hate the term 'I can't release it because of HIPAA.' The reason you can't release it is because the patient or player refused to authorize the release," Webster said.

When someone invokes HIPAA, he wants to know the precise reason. "What are you really saying? Are you hiding behind it, or did the athlete refuse to release that information, or is it a policy?" Webster said.

Finding other ways

Mark Goodman, executive director of the Student Press Law Center, said the center would advise reporters to always argue that HIPAA does not apply to information about an athlete's injury.

"But in all honesty, we would recognize that interpretation of the law is suspect," he said.

Goodman is not particularly anxious to push the issue in court for fear it might lead to bad precedent -- especially since many reporters "are finding other ways to get the information," Goodman said.

Journalists, for instance, can inquire if universities have obtained permission from students through release forms, which many universities require of student athletes as a condition of participating in college sports.

While a university will require the student to allow the information to be released to coaches, schools will sometimes refuse to release that information to the media if the student wishes, Webster said.

But if college officials do end up speaking to reporters, waivers such as those used at Kentucky can protect school administrators.

"If we did release information to the media and the athlete complained about it, we can always fall back on that document," Webster said.

At the University of Texas in Austin, a university official told reporters for the student newspaper The Daily Texan not to print the names of students who were possible victims in a ricin poison scare because of HIPAA.

The reporters already had the names from other sources, said Richard Finnell, the newspaper's adviser, and they were able to go to another university official to resolve the HIPAA conflict -- a practice that has become popular as many reporters seek alternative sources after running into dead ends with university officials.

"We tell our reporters to kind of deal with it -- smile at them and say, 'yeah,' and then do what you have to do," Finnell said.