Perilous privacy at Virginia Tech

A state commission finds colleges and universities misunderstand privacy laws – to their potential detriment.

Colleges didn't need last week's report on the Virginia Tech shootings to address a key finding: a faster alert during the crisis may have saved lives. Many colleges have already set blast-notice plans. But here's what needs careful study: the report's conclusions about privacy.

Privacy is a huge issue on campuses. Colleges and universities are dealing with young people who have just become legal adults, but who may still require supervision and even intervention.

That was the case with Seung-Hui Cho, the student who killed 32 people and then himself on April 16. According to the report, which was commissioned by Virginia Gov. Timothy Kaine, this troubled student's behavior raised serious questions about his mental stability while he was at VT, yet no one contacted his parents, and communication about his case broke down among school, law-enforcement, and mental-health officials.

A big reason? A "widespread perception" that privacy laws make it difficult to respond to troubled students, according to the report. But this is "only partly correct."

Lack of understanding about federal and state laws is a major obstacle to helping such students, according to the report. The legal complexity, as well as concerns about liability, can easily push teachers, administrators, police, and mental-health workers into a "default" position of withholding information, the report found.

There's no evidence that VT officials consciously decided not to inform Mr. Cho's parents. But the university's lawyer told the panel investigating Cho's case that privacy laws prevent sharing information such as that relating to Cho.

That's simply not true. The report listed several steps that could quite legally have been taken:

The Virginia Tech police, for instance, could have shared with Cho's parents that he was temporarily detained, pending a hearing to commit him involuntarily to a mental-health institution, because that information was public.

And teachers and administrators could have called Cho's parents to notify them of his difficulties, because only student records – not personal observations or conversations – are shielded by the federal privacy law that covers most secondary schools.

Notifying Cho's parents was intuitively the right course. Indeed, his middle school contacted his parents to get him help, and they cooperated. His high school also made special arrangements. He improved.

The report points out that the main federal privacy laws that apply to a college student's health and campus records recognize exceptions for information sharing in emergencies that affect public health and safety.

Privacy is a bedrock of American law and values. In a mental-health case, it gives a patient the security to express innermost thoughts, and protects that person from discrimination. But the federal law, at least, does recognize a balance between privacy and public safety, even when colleges can't, or won't.

The report is to be commended for pointing out this disconnect, and for calling for greater clarification of privacy laws and school policies.

Perhaps now, common sense can match up with legal obligations so both privacy and public safety can be served.