Personal details given on need-to-know basis

University reviewing policies regarding protection of students’ private information

Rebecca Mezciems says Queen’s stores its students’ transcripts indefinitely.
Rebecca Mezciems says Queen’s stores its students’ transcripts indefinitely.
Photo: 

In the event of an incident like the shooting at Virginia Polytechnic Institute and State University in April, the police and the coroner’s office are the only people who have legal authority to ask Health, Counselling and Disability Services (HCDS) for personal information, said Dr. Mike Condra, director of HCDS. On Wednesday B.C. Privacy Commissioner David Loukidelis said B.C. law allows a university to share a student’s confidential medical records if there’s a perceived threat to public safety, regardless of the student’s age.

“Ontario does not have a ‘duty to warn’ law mandating reporting of clients perceived as a threat to others,” Condra said.

However, professionals are allowed to release information if in their opinion an individual’s behaviour indicates he or she is a threat to another’s life. Such a breach of confidentiality is seen as appropriate in order to better the life of another person or people, he said.

In a situation where a crime has already been committed, the police are permitted to ask for information from a personal file, but it’s only a request.

“The law recognizes that the professional involved may have a say in whether or not the information is released,” he said.

Students’ health records are maintained under the Regulated Health Professions Act (RHPA), which means that there’s already a retention schedule for health and counselling, Condra said.

Condra said clinical information about a student generally isn’t released to anybody without the individual’s written consent.

“The files are accessed only on a need-to-know basis,” he said.

The only person who has access to a student’s file is the student’s physician or counsellor, and sometimes a nurse will look at the file when the student comes in.

“All of our confidential student material is kept in locked files, except on the day that the file is taken out so that the student can be seen,” Condra said.

In addition, all HCDS staff and volunteers sign a confidentiality agreement recognizing that they cannot disclose any clinical information without the patient’s consent.

“I don’t think it’s possible to overprotect most clinical information,” Condra said.

If a clinician feels there’s an emergency, he said, there are circumstances in which HCDS doesn’t observe routine confidentiality—if a student is threatening to kill somebody, if a patient discloses information that suggests that a child may be at risk of harm, abuse or neglect, or if a patient reports that he or she has been abused, for example.

The registrar’s office may provide personal information about students to health and dental plan carriers and both personal and academic information to Statistics Canada.

The Blue Book, the University’s guide to registration and fees for the year, outlines the policy on use and disclosure of student information under “General Policies and Definitions.”

According to the policy, personal information including a student’s name, student number, e-mail address and program may be used by the AMS. The Physical Education Centre can use information including name, student number, gender, mailing address, e-mail address and the duration of a study period.

Personal information may also be used by Campus Security, the Office of Advancement, Queen’s University Residences and HCDS.

At the moment, no confidential information at HCDS is stored on computers.

“Currently they’re all paper files,” he said, adding that he thinks HCDS will move its record system to computers in the future.

“When it will happen, I couldn’t tell you,” he said. “But as you know, most physicians’ offices have moved now to electronic records.”

A computerized system would make many things more efficient, Condra said.

“For example, if the patient has a blood test and the sample is sent out to a laboratory, they can electronically submit the test results . . . when the physician opens your file on the screen, the test results will already be in.” Queen’s is re-evaluating the way it controls students’ academic records and personal information.

Rebecca Mezciems, assistant to the university registrar, said the University is in the process of implementing a records management program, the first part of which involves approving records retention schedules.

Once retention schedules are approved, records will then be dealt with according to the schedule.

“The schedules lay out in a chart what sort of records are kept and what office keeps them, how long they’re kept for, and how they’re destroyed,” she said.

Retention schedules clarifying the length of time records are kept in University databases will be posted on the University archives website, archives.queensu.ca.

“Some personal information is kept forever,” Mezciems said. A student’s academic record, for example, is stored by the University indefinitely.

Gillian Barlow, University Records Manager, said in the past there hasn’t been a formalized way to keep track of records. “Everybody has kept track of records themselves,” she said.

Because records are often kept for such a long time, some controls need to be put in place. In addition, Freedom of Information and Protection of Privacy legislation requires that retention schedules be applied to records, particularly the ones containing personal information.

“The principal passed the Records Management Policy in 2003, so we’re going around gradually to all the units across campus and we’re working on creating these retention schedules for everybody,” Barlow said.

Mezciems said the only people who see a student’s transcript are those who work behind the scenes, in the Registrar’s Office.

“It’s very clearly delineated who needs to see what information in order to do their job,” she said.

Students are the only ones permitted to see their actual transcript, and it’s up to them who else gets to see that information.

Mezciems said some employees at the registrar’s office are given access to marks, but not the more detailed transcripts.

“In essence, only people who need to see the information to do their job will see it. I don’t need to see students’ personal information to do my job, so I don’t have permission to access our student information system,” she said. “An academic advisor in a faculty or school, who meets with students to help them with their academic progress and plans at Queen’s, will need information on what classes the student has completed, what classes he or she is enrolled in and what their grades are, to do their job.”

A student awards officer will also need to see personal information, such as any money a student owes to the University and whether the student has been awarded scholarships, bursaries, or government assistance, she said.

The Student and Application Record Policy, available on the registrar’s website, says that, “unless compelled to do so by law, or authorized by the student in writing, the University does not disclose the contents of student records to any party outside the University unless it constitutes public information.”

“The whole privacy policy of the University is quite rigorous,” Mezciems said.

When commenting, be considerate and respectful of writers and fellow commenters. Try to stay on topic. Spam and comments that are hateful or discriminatory will be deleted. Our full commenting policy can be read here.