Colleges struggle with privacy laws

NEW YORK — In the year since a mentally disturbed student went on a shooting rampage at Virginia Tech, federal regulators, educators and legal experts have tried to reach a new understanding of the complex web of privacy laws that came under heavy criticism as one of the reasons no one acted in time to prevent the tragedy.

New regulations, information campaigns and legislation are all part of the effort to make sure college and university officials realize that in cases of imminent threats, the safety of students trumps legal barriers that otherwise would prevent officials from discussing a student's mental state or revealing student records.

"The bottom line is that you'd always rather have a privacy lawsuit than a death lawsuit," said Robert Smith, a Boston lawyer who specializes in advising colleges and universities. "That's my advice to colleges."

By the time Seung-Hui Cho opened fire on his fellow students a year ago today, many on the Virginia Tech campus — from roommates to administrators to mental-health counselors — had already picked up warning signals from his bizarre behavior that he was a threat to himself and others.

But the failure to put all the pieces together resulted in a shooting spree in which Cho killed 32 people before he shot himself, setting off nationwide reverberations as campuses reconsidered security measures and their treatment of mentally ill students.

In February, the Virginia Tech tragedy found a deadly echo at Northern Illinois University when a mentally disturbed former student killed five people and himself. And on Friday, officials at St. Xavier University in Chicago closed the campus after threatening graffiti was found in a bathroom in a freshman coed dormitory.

In the past year, colleges have dramatically expanded efforts to catch dangerous students in a safety net before they crash and take innocent victims down with them, school officials say.

"It's a different world since Virginia Tech," says Gwendolyn Dungy, executive director of the National Association of Student Personnel Administrators.

Colleges are trying to reduce the chances of violence by creating or beefing up "risk assessment" teams that typically include faculty, residence advisers, psychologists, administrators and police, college administrators say. The teams meet often to review reports on students who seem disturbed. The reports are submitted from professors, residence advisers, police and other students.

About 20 percent of colleges had teams before the Virginia Tech shootings, says Keith Anderson, a veteran counselor at Rensselaer Polytechnic Institute in Troy, N.Y. "Now I don't know any college that hasn't either created a team or strengthened the one they had," Dungy says.

But after investigating Virginia Tech's response to the massacre and the events that led up to it, a state panel concluded there was "widespread confusion about what federal and state privacy laws allow."

Virginia Tech officials were hardly alone in not knowing what the law does and does not allow in the case of troubled students, according to many higher-education experts.

"A hands-off approach is often seen as the safest method of dealing with these students," University of Virginia law professor Richard Bonnie said at a recent Columbia University conference on campus violence. "Many colleges are using the uncertainties about the law as an excuse to do nothing."

The law at the center of the privacy debate is the Family Educational Rights and Privacy Act, a 1974 statute known as FERPA. For minors, the law prohibits schools from disclosing a student's educational records without consent from the student's parents. At age 18, that right transfers to the students.

In addition to FERPA, a host of other federal and state laws, plus regulations and court rulings, govern the disclosure of educational and health records.

But several experts said what college administrators often don't realize is that FERPA and other privacy laws have provisions that allow for the disclosure of a student's records in case of an emergency. A flier that the U.S. Department of Education sent to colleges and universities last year said the law "permits school officials to disclose without student consent education records, including personally identifiable information from those records, to protect the health and safety of students or other individuals."

That came as no surprise to Jan Walbert, vice president for student affairs at Arcadia University in Glenside, Pa. She says the law has never stopped her from taking whatever action she thought necessary to help a troubled student.

"I do think there's this perception that elements of FERPA limit us from doing the right thing," said Walbert, a former president of the National Association of Student Personnel Administrators. "The issue is that you need to do everything you can do to make sure that everyone is on the same page."

Information from USA Today is included in this report.