Policies and Procedures Regarding the Protection of Student-Athletes’ Confidential Information

Title

Policies and Procedures Regarding the Protection of Student-Athletes’ Confidential Information

UNC Department of Athletics Policy Number: 00089186

A. Purpose

1. This Policy is intended to supplement the protections afforded to UNC student-athletes by federal law, state law, and University policies. In the event of any perceived conflict between this Policy and any state or federal law, please contact a member of the Department of Athletics Executive Team.
2. This Policy has been jointly adopted by the Department of Athletics, Department of Sports Medicine, and ASPSA. It shall apply to all staff members of such units, whether paid or unpaid, as well as to all UNC student-athletes. It shall also apply to any individual affiliated in any way with the University who accesses any student-athlete information protected by state or federal law or University policies.
3. The provisions of this Policy restricting access to and usage of Confidential Information and any other student-athlete information protected by state or federal law or shall remain in effect even after an individual’s official affiliation with the University ceases.
4. This Policy shall supersede the University of North Carolina at Chapel Hill Policy and Procedures for Communication about Injuries to Student-Athletes.

B. Definitions

For purposes of this Policy, the definitions below shall apply.

1. ““ASPSA” shall mean the University’s Academic Support Program for Student-Athletes.
2. “Campus Health Services” shall mean the University’s Campus Health Services unit.
3. “Confidential Information” shall include PHI and PII of a student-athlete which does not constitute Directory Information, as well as any other information protected by the University’s Family Educational Rights and Privacy Act Policy or other state or federal law. This includes, but is not limited to, the following: financial Records (including Social Security Numbers and credit card numbers), health Records, contracts, research data, alumni Records, donor Records, personnel Records other than an individual’s own personnel Records, University financial data, computer passwords, and University proprietary information or data.
4. “Department of Athletics” shall mean the Department of Athletics of UNC.
5. “Department of Sports Medicine” shall mean the Department of Sports Medicine within Campus Health Services.
6. “Directory Information” shall include a student-athlete's name, local and billing addresses, student email address, local and billing telephone numbers, date and place of birth, major field of study, class, enrollment status, personal identification number (“PID”), anticipated graduation date, participation in officially recognized activities and sports, height and weight, dates of University attendance, degrees and awards received, the most recent previous educational agency or institution attended by the student, and the county, state and/or United States territory from which the student-athlete entered the University.
7. “Disclose” or “Disclosing” shall mean the act of Disclosure as defined below.
8. “Disclosure” shall mean the act of communicating, permitting access to, releasing, transferring, or otherwise facilitating or allowing any other provision of any Confidential Information to any party by any means including, but not limited to: oral, written, or electronic forms of communication.
   1. This definition shall exclude any sharing or communication of Confidential Information to other internal individuals within the University who have a legitimate need to know such Confidential Information. The “legitimate need to know” such Confidential Information shall be directly related to the provision of support or care for the individual student-athlete who is the subject matter of such Confidential Information.
   2. This definition shall also exclude any sharing or communication of Confidential Information of or related to a student-athlete when such sharing or communication of such Confidential Information is done by the applicable student-athlete.
   3. This definition shall be limited to Disclosures made by the Department of Athletics, ASPSA, and the Department of Sports Medicine. Disclosures made by other units within the University shall be governed by the University’s Policies and Procedures Under the Family Educational Rights and Privacy Act of 1974.
9. “Education Records” shall mean all Records other than Directory Information which contain information directly related to a student-athlete and which are maintained by the Department of Athletics, Department of Sports Medicine, ASPSA, or other University unit or by a party acting for the University. For information about what Records this term does not include, see the provisions in the University’s Policies and Procedures Under the Family Educational Rights and Privacy Act of 1974 which are related to Education Records maintained by the University or a party acting for the University.
10. “Employee” shall mean any individual employed by the Department of Athletics, ASPSA, or Department of Sports Medicine.
11. “Executive Team” shall mean the executive leadership of the Department of Athletics, as determined by the Director of Athletics.
12. “FERPA” shall mean the Family Educational Rights and Privacy Act of 1974.
13. “HIPAA” shall mean the Health Insurance Portability and Accountability Act of 1996, as modified by the Health Information Technology for Economic Clinical Health Act of 2009.
14. “Personally Identifiable Information” or “PII” shall mean information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual by context. This information may include a person’s name, address, Social Security Number, PID, or the name of a person’s parents or family members.
15. “Policy” shall mean these Policies and Procedures Regarding the Protection of Student-Athletes’ Confidential Information.
16. “Protected Health Information” or “PHI” shall include any information about the past, present, or future physical or mental health condition(s) of an individual. PHI shall also include information related to the past, present, or future provision(s) of health care to an individual or the past, present, or future payment(s) for the provision of health care to an individual. (This definition shall exclude information related to health conditions, provisions of health care, or payments for the provision of health care from Campus Health Services when such information is maintained by the University during the time of an individual’s enrollment at UNC, though such information is still considered Confidential Information and protected under FERPA.) PHI is protected under HIPAA.
17. A “Record” shall mean information maintained in any format including, but not limited to: audio tape, computer media, film, handwriting, microfilm, microfiche, print, electronic or digital file, and video tape.
18. “Research Study” shall mean any investigation which uses, analyzes, references, or otherwise involves any UNC student-athlete’s Confidential Information or in which any UNC student-athlete is a subject or participant, including research development, testing, evaluation, or any other similar activity which is intended or designed to develop or contribute to generalizable knowledge, understandings, data, perspectives, representations, presentations, or conclusions. This definition shall exclude any analysis of a student-athlete’s respective Confidential Information which:
    1. Is performed by appropriate medical-related personnel of or engaged by the University;
    2. Is performed solely for medical purposes related to assessment and/or treatment of such student-athlete; and
    3. Will not be disclosed to any external party outside of those involved in the provision of such medical care and those at the University with a legitimate need to know such Confidential Information.
19. “UNC” or “University” shall mean the University of North Carolina at Chapel Hill.
20. “UNC ITS” shall mean the University’s Department of Information Technology Services.

C. Student-Athlete Confidential Information

1. General

1. Much of the language in this Section has been adapted from the University’s Policies and Procedures Under the Family Educational Rights and Privacy Act of 1974. This Section is merely intended to provide an overview of certain matters involving this important statute as it relates specifically to student-athletes and their protected information. This Section also sets forth standards to ensure that the Department of Athletics, Department of Sports Medicine, and ASPSA act in accordance with the statute. For more information about FERPA, individuals may contact the Office of the Registrar, review the University’s Policies and Procedures Under the Family Educational Rights and Privacy Act of 1974, and review the statute itself at 34 C.F.R. pt. 99 et. seq.
2. Generally, FERPA provides each student-athlete with the right to inspect, correct, amend, and limit Disclosure of his or her Education Records. Additionally, FERPA provides guidelines about when a student-athlete’s PII may or may not be released from his or her Education Records.

2. Protected Information

With limited exceptions, the University and its Department of Athletics, Department of Sports Medicine, and ASPSA are committed to protecting each student-athlete’s PII within their respective Education Records. The University and its Department of Athletics, Department of Sports Medicine, and ASPSA are also committed to protecting information about each student-athlete which does not constitute PII, but which still constitutes Confidential Information.

3. Maintaining Student Education Records

Education Records may be maintained by many University offices and school officials. The University offices and school officials that are most likely to maintain Education Records include, but are not limited to: academic departments and schools, the Department of Athletics, ASPSA, faculty members in their roles as advisors and teachers, the Office of the University Registrar, graduate schools, and University administrative and business offices.

4. Access, Use, and Disclosure by School Officials

Access to a student-athlete’s Education Records by school officials is restricted to the portion of any such Record necessary for the discharge of official assigned duties. Any unauthorized Disclosure of PII or other Confidential Information from the Education Records of a student-athlete is strictly prohibited.

5. Disclosure of Directory Information

1. The Department of Athletics, Department of Sports Medicine, or ASPSA may Disclose a student-athlete’s PII from his or her Education Records without the student-athlete’s prior written consent if such information constitutes Directory Information. Student-athletes shall be informed regarding the existence of Directory Information and allowed a reasonable amount of time to request that the University (including the Department of Athletics, Department of Sports Medicine, and ASPSA) not Disclose such Directory Information.

D. Requesting Non-Disclosure of Directory Information

A student-athlete who desires non-Disclosure of any or all Directory Information should consult with the Director of ASPSA and the Department of Athletics Executive Team member with oversight of Communications to discuss what Disclosure limits may be placed on Directory Information. Due to a student-athlete’s role as a representative of the University, certain portions of a student-athlete’s PII must remain Directory Information, such as a student-athlete’s name and participation on a team.

1. Requirement for Authorization Prior to Disclosure of Confidential Information

1. With certain exceptions, the Department of Athletics, ASPSA, and Department of Sports Medicine will not Disclose PII or other Confidential Information that does not constitute Directory Information from a student-athlete’s Education Records without the student-athlete’s prior written consent. To review Disclosures that may be made without consent, please consult the University’s Policies and Procedures Under the Family Educational Rights and Privacy Act of 1974.
2. Furthermore, other than pursuant to exceptions set forth in University policies or this Policy, or otherwise as permitted by law, all Disclosures of any student-athlete’s Confidential Information must be authorized in writing in advance by the applicable student-athlete. This shall mean that appropriate authorization must be obtained from each applicable student-athlete prior to Disclosures of Confidential Information including, but not limited to:
   1. Disclosure of an injury to a student-athlete or other medical information related to a student-athlete to the media, an individual affiliated with a professional sports team or league, a sports agent or other professional representative, or any other recipient to whom such a Disclosure is prohibited by applicable legislation; and
   2. Disclosure of a student-athlete’s Education Records or other non-Directory Information PII to the media, an individual affiliated with a professional sports team or league, a sports agent or other professional representative, or any other recipient to whom such a Disclosure is prohibited by applicable legislation.
3. The preferred forms for student-athletes to provide such required consent are attached as appendices to this Policy and are discussed further below in this Policy.

2. Authorizations for Disclosure of Confidential Information

a. Consent for Release of Confidential Information Form

Student-athletes may periodically be asked to sign a form authorizing certain Disclosures of Confidential Information by members of ASPSA, Campus Health Services and the Department of Sports Medicine, and the Department of Athletics. This form is attached to this Policy as Appendix A. Any such authorization for Disclosure provided by a student-athlete shall be effective until revoked by means of written notice provided by the applicable student-athlete to the University in accordance with the provisions of this Policy.

b. Additional Forms by which Student-Athletes May Consent to Disclosure of Confidential Information

1. In addition, student-athletes may periodically be asked to sign a Student-Athlete Consent for Release of Medical Information form. By completing this form, a student-athlete consents to the Disclosure of specific types of Confidential Information to the NCAA, its affiliated individuals, and certain other recipients. This information includes, among other things, Confidential Information about injuries, illnesses, treatments, and involvement in activities related to or affecting training for and participation in intercollegiate athletics. Any such authorization for Disclosure provided by a student-athlete shall be effective until revoked by means of written notice provided by the applicable student-athlete to the University in accordance with the provisions of this Policy.
2. Student-athletes may also periodically be asked to sign other forms authorizing certain Disclosures of Confidential Information to various external constituents. Examples of some of these forms are included in the appendices to this Policy. Any such authorization for Disclosure provided by a student-athlete shall be effective until revoked by means of written notice provided by the applicable student-athlete to the University in accordance with the provisions of this Policy.

3. Additional Prior Approval Required for Certain Disclosures of Confidential Information

1. In addition to the prior approval from each applicable student-athlete that should typically be obtained prior to any Disclosure of any such student-athlete’s Confidential Information, approval must also be obtained from the individuals set forth below prior to any Employee’s Disclosure of a student-athlete’s Confidential Information.
   1. Any Disclosure of Confidential Information which is academic in nature must be preapproved by (1) the Director of ASPSA; (2) the Department of Athletics Compliance Office; and (3) either the Director of Athletics or the Department of Athletics Executive Team member with oversight of Risk Management.
   2. Any Disclosure of Confidential Information which is medical in nature must be preapproved by the Director of Sports Medicine or his designee.
      1. Notwithstanding the foregoing, due to the time sensitivity of certain situations (primarily during intercollegiate competition), appropriate Department of Athletics Head Coaches and Communications Office personnel shall be permitted to use their discretion in deciding whether to Disclose certain medically-related Confidential Information to the media or other broad audiences, provided that each applicable student-athlete whose Confidential Information will be Disclosed has previously executed the Consent for Release of Confidential Information form (or other similar form). In such situations, Disclosure of Confidential Information should be limited to general injury information about the applicable student-athlete and a timeframe for such student-athlete’s return to athletic participation.
      2. Whenever practical in situations other than the in-game situations described above, each applicable student-athlete whose medically-related Confidential Information will be Disclosed should also be given an opportunity to review such information in advance of Disclosure. Among other things, this means that any student-athlete whose Confidential Information will be Disclosed in a press release or similar manner should have an opportunity to review the language of such document prior to Disclosure whenever such review is feasible.
   3. Any Disclosure of Confidential Information related to an ongoing investigation must be preapproved by (1) the Department of Athletics Compliance Office and (2) either the Director of Athletics or the Department of Athletics Executive Team member with oversight of Risk Management.
   4. Any other Disclosure(s) of Confidential Information must be preapproved by (1) the Department of Athletics Compliance Office and (2) either the Director of Athletics or the Department of Athletics Executive Team member with oversight of Risk Management.

E. Termination of Employment, Service, or Work for the University

Upon the conclusion of any individual’s employment by, service to, or other paid or unpaid work for the University, such individual shall promptly return all original versions and reproductions of any kind of any and all Records in such individual’s possession which contain Confidential Information about or related to any current, prospective, or former student-athlete of the University. Any such Records shall be returned by such individual to the Department of Athletics, Department of Sports Medicine, or ASPSA (as appropriate). Each such individual shall also relinquish all further access to and cease all use of any and all Confidential Information involving any current, prospective, or former UNC student-athlete.

F. Procedures for Communication about a Student-Athlete’s Injury to the Media and Other Broad Audiences

Some Head Coaches may direct medically-related Confidential Information about student-athletes on their respective team not to be Disclosed. If a Head Coach permits such medically-related Confidential Information to be Disclosed, the applicable student-athlete has appropriately authorized Disclosure of Confidential Information related to an injury he or she has sustained, and the Director of Sports Medicine or his designee has also approved Disclosure of such Confidential Information, the University shall adhere to the provisions below regarding the Disclosure of medically-related Confidential Information about such student-athlete to members of the media and other broad audiences.

1. A UNC Athletic Trainer or Team Physician must be consulted for an official injury report before any medically-related Confidential Information about a student-athlete is released to the media.
   1. If an injury to a student-athlete occurs during competition, a member of the Department of Sports Medicine, when appropriate, will provide a coach and/or a representative from the Department of Athletics Communications Office with basic information about the injury. This information may include specification of the injured body part(s) and the probability of the student-athlete returning to participation in the competition.
   2. If an injury to a student-athlete, regardless of when it occurs, is likely to result in the student-athlete missing the next competition, the applicable Athletic Trainer for the student-athlete’s sport should notify the designated representative of the Department of Athletics Communication Office.
2. The only individuals authorized to provide information to the media about a student-athlete’s injury are the applicable student-athlete’s Head Coach (or his or her designee if the applicable Head Coach is unavailable), appropriate members of the Department of Sports Medicine, and designated representatives of the Department of Athletics Communications Office.
3. Comments about an injured student-athlete made by such student-athlete’s Head Coach and Department of Athletics Communications Office staff members should be restricted to general injury information and “return to participation” timelines when appropriate. If necessary, more specific information or details may be provided by a member of the Department of Sports Medicine staff, who may choose to communicate this information either directly to the media, through the student-athlete’s Head Coach, or through a representative of the Department of Athletics Communication Office

G. Revocation

Any student-athlete who wishes to revoke (in whole or in part) any authorization for Disclosure of any Confidential Information shall communicate such revocation of authorization in writing to the Department of Athletics Executive Team member with oversight of Communications, the Director of ASPSA, and the Director of Sports Medicine.

H. Reminder for Student Athletes

Student-athletes should be careful not to directly or indirectly Disclose Confidential Information about or related to another student-athlete. This restriction applies to interviews with the media, comments on social media, photos taken of or around another student-athlete who is receiving medical treatment, and any other manner of Disclosure of such Confidential Information.

1. Each Head Coach and appropriate Department of Sports Medicine personnel should instruct and periodically remind the student-athletes with whom they work that student-athletes are not authorized to comment on or otherwise Disclose Confidential Information about a fellow student-athlete including, but not limited to, information about a fellow student-athlete’s injury or playing status due to injury.

I. Storage of Confidential Information

1. When in the possession of ASPSA, Department of Sports Medicine, or Department of Athletics staff, Confidential Information of or related to UNC student-athletes should always be stored in a secure manner and consistent with UNC ITS policies to appropriately safeguard against security breaches, unauthorized access, and improper use.
2. Any known or suspected improper access to or Disclosure of any Confidential Information of or related to any UNC student-athlete(s) should immediately be reported to the Director of Athletics, the Director of ASPSA, the Director of Sports Medicine, and/or the Campus Health Services Privacy Officer (as appropriate).

J. Student-Athletes’ Disclosure of Disabilities, Food Allergies, and Other Relevant Conditions

1. Each student-athlete is expected to promptly Disclose to the Director of Sports Medicine any food allergy, learning disability, or other medical condition which may impact health, safety, or the ability to perform academically or athletically. Such Disclosure should be made immediately upon a student-athlete’s enrollment at UNC or upon a current UNC student-athlete’s learning that he or she has such a condition.
2. Upon receipt of such information from a student-athlete, the Director of Sports Medicine or his or her designee shall communicate the information to appropriate staff members in the Department of Sports Medicine, ASPSA, and the Department of Athletics so that proper accommodations may be provided to support the student-athlete.

K. Research Studies

1. Purpose

This Section of the Policy is intended to work in conjunction with applicable legislation and University policies to help protect the rights of student-athletes who may choose to become participants in any Research Study.

2. Organizations Not Affiliated with the University

Due to the significant interests the University has in protecting student-athletes’ well-being, time, and privacy, the Department of Athletics typically does not grant requests for student-athletes to participate in Research Studies conducted by organizations that are not affiliated with the University. Similarly, the Department of Athletics typically does not permit student-athletes’ Confidential Information to be used in such activities.

3. Organizations Affiliated with the University

Only on rare occasions will student-athletes be permitted to participate in Research Studies conducted by organizations or individuals affiliated with the University.

4. Prerequisites

The prerequisites below must be met for any student-athlete to be permitted to participate in a Research Study.

1. The University’s Institutional Review Board must provide advance approval of any Research Study which will involve any student-athlete or the Confidential Information of any student-athlete. This requirement shall apply even in cases when such Confidential Information has been de-identified or used in a generalized manner, provided such Confidential Information was acquired by means related to an individual’s employment at the University.
2. Advance written approval must also be provided by the Director of Athletics or his designee, the Department of Athletics Compliance Office, and the Head Coach(es) of any student-athlete(s) involved in a Research Study or whose Confidential Information will be involved in a Research Study.

5. Student-Athlete Participation

1. Any and all student-athlete involvement in any Research Study must be completely voluntary.
2. Each student-athlete who will be involved in a Research Study or whose Confidential Information will be involved in a Research Study must provide the conductor(s) of the Research Study advance written consent to their participation and/or use of their Confidential Information before the commencement of such Research Study.
3. All information about the Research Study must be provided to each applicable student-athlete by the conductor(s) of the Research Study before obtaining each student-athlete’s consent to participation or use of their Confidential Information in the Research Study. This information provided to each student-athlete must include, at a minimum:
   1. the method(s) of the Research Study;
   2. the purpose(s) of the Research Study;
   3. any risks involved in the Research Study;
   4. the extent of the participation requested from the specific student-athlete;
   5. how any information, including any Confidential Information, obtained will be used; and
   6. the person(s) who will have access to data or Confidential Information involved with, developed by, or aggregated in the Research Study.
4. Any student-athlete who is involved or whose Confidential Information is involved in a Research Study must be immediately informed and provide additional written consent to their inclusion or use of their Confidential Information in the Research Study if there is any change whatsoever to the information about the Research Study initially Disclosed to the student-athlete as required above in this Policy.
5. Any student-athlete who is approached by any organization or individual about participating in a Research Study should direct the requesting individual(s) to the Director of Athletics.

6. Student-Athletes Conducting Research Studies

Any student-athlete who wishes to conduct a Research Study and desires to have other student-athlete(s) participate in such Research Study must comply with the procedures set forth in this Policy.

7. Strict Compliance Required

Any Research Study as herein defined must also strictly comply with FERPA, HIPAA, any other applicable legislation, and all University and Department of Athletics policies and procedures.

L. Policy Violation and Reporting of Concerns

1. A violation of this Policy may result in disciplinary action (including, but not limited to, suspension or termination of employment), possible criminal prosecution, and any other remedies available under the laws of the United States or the State of North Carolina.
2. Any potential violation of this Policy should be communicated immediately to Risk Management personnel in the Department of Athletics.
   1. Any potential violation of this Policy involving Confidential Information which is academic in nature should also be communicated immediately to the Director of ASPSA.
   2. Any potential violation of this Policy involving Confidential Information which is medical in nature should also be communicated immediately to the Director of Sports Medicine.
3. Any potential violation of NCAA legislation should be immediately reported to the Department of Athletics Compliance Office. Any other concerns about inappropriate conduct should be promptly reported in accordance with standard University protocols.

M. Access to Confidential Information by the Director of Athletics

This Policy shall not be construed in any way to restrict access to Confidential Information by the Director of Athletics.

N. Further Assistance and Questions

Any questions regarding this Policy should be communicated in a timely manner to Risk Management personnel in the Department of Athletics.

Related Requirements

External Regulations and Consequences

• Family Educational Rights and Privacy Act (FERPA)
• Health Insurance Portability and Accountability Act of 1996
• U.S. Department of Health and Human Services - Summary of the HIPAA Privacy Rule

University Policies, Standards, and Procedures

• UNC Policies and Procedures Under the Family Educational Rights and Privacy Act of 1974 (“FERPA”)
• UNC Privacy of Protected Health Information Policy
• UNC Standard on HIPAA Sanctions
• UNC Policy on Records Management
• UNC Information Technology Acceptable Use Policy
• UNC Information Classification Standard
• UNC Transmission of Sensitive Information Standard
• UNC IRB and Human Research Ethics Policies