The University of Oregon (UO) is under fire for using a student rape victim’s therapy records against her after she sued the campus for mishandling her sexual assault case. The student claimed the university purposefully delayed the discipline of her three accused rapists (who have since been suspended from school a minimum of four years) so they could complete their basketball season. But under the Family Education Rights and Privacy Act (FERPA), this is technically allowed.

FERPA is a federal law that protects the privacy of students' “education records.” These records refer to records directly related to a student, plus records “maintained by an educational agency or institution or by a party acting for the agency of institution,” the U.S Department of Education reported. While medical and psychological treatment records are not defined as education records at colleges and universities, “an eligible student’s treatment records may be disclosed for purpose other than the student’s treatment, provided the records are disclosed under one of the exceptions to written consent.” One such exception is a lawsuit.

“The university is right, under the law,” Katie Rose Guest Pryal, a former law professor at the University of North Carolina at Chapel Hill, explained in her column for The Chronicle of Higher Education. “It can access the therapy records of a rape survivor in order to defend itself against a lawsuit that has nothing to do with therapy malpractice. That is the ugly truth of this case.”

Many people assume FERPA works the same way as the Health Insurance Portability and Accountability Act of 1996 (HIPAA), but this is largely not the case. There may be some overlap, but the HIPAA privacy rule specifically excludes the same records FERPA protects. Thus, Pryal recommended, if financially possible, students seek counseling and therapy off-campus where they will have "adequate privacy."

Jennifer Morlok, a senior staff therapist at UO’s counseling center, not only accused the University of illegal and unethical behavior this past February, but she claimed the university threatened to fire her and another employee, Karen Stokes, for questioning said behavior. Morlok wrote the letter after UO filed a counterclaim against the student; this claim has since been dismissed.

"I was told to provide non-standard care for this student, which went against my ethical and professional standards," Morlok wrote in a letter obtained by The Huffington Post. "When I tried to seek appropriate and unbiased information as of how to best respond clinically for the student, I was scolded and my job was threatened. My job was threatened for two reasons: 1) As the clinician, I wrote a letter of summary for my client as per my client's request/needs/therapeutic support/ and standard care 2) I sought unbiased legal counsel outside the UO due to my ethical/legal concerns in this case."

In response to Morlok's letter, UO admitted to accessing the student's private records, lawfully. As governed by FERPA, Oregon can provide these records to their attorneys. And when the university dropped their counterclaim, Scott Coltrane, UO's interim president, said this action makes it clear they "never intended to seek costs, fees, or damages against our student."