Ask university officials in the US why their hands are so often tied when they see a student beginning to spiral into disruptive madness and some will cite federal laws that prohibit discrimination against the mentally ill. Others will mention procedural obstacles that can make it hard to expel a youngster over anything short of a serious crime. But nearly all will circle around at some point to the extraordinary set of laws we have enacted in the name of privacy, prohibiting the sharing of personal information about individuals.

One of these laws – FERPA, otherwise known as the Buckley Amendment – is unique to students and universities. But perhaps equally far-reaching in its implications is HIPAA, the four-year-old health-privacy law, which covers the medical records not just of students but of Americans generally.

Under HIPAA, it would have been unlawful for the psychiatric hospital that treated student Cho Seung-Hui, who shot 32 people at Virginia Tech university this week, to compare notes on his therapeutic progress, or lack thereof, with his counselors or dean. So effectively did the various privacy laws bottle up information that even a Virginia Tech official tasked with the monitoring of problem students is said to have known little or nothing about Cho’s lurid history of psychotic symptoms until after the fact.

Under HIPAA’s terms, doctors and other covered persons who improperly release information about identifiable persons’ health care are subject to fines and even prison terms of up to ten years. That a disclosure is well-meaning rather than malicious is no defence: disclosures to patients’ own parents or roommates, as well as disclosures to other medical or custodial institutions, can very much trigger liability; and the exact scope of what is deemed proper disclosure is by no means precisely defined.

Unintended consequences soon blossomed, in large quantity. Frantic family members dialed emergency rooms in vain seeking confirmation that their unconscious loved ones were there. Preferring to play it safe, some hospitals removed patients’ names from doors. Clergy were ordered not to drop in on ill parishioners unless on specific request. Wider areas within clinics were closed off to unescorted visitors; Santa Claus could drop by only with a proper release form on hand for each ailing child.

Infringement of medical privacy is a lamentable thing, but experience soon suggested that other things can be even worse. After a Washington, D. C. pedestrian was fatally struck by a car, his family learned nothing of it for two weeks until a $17,000 hospital bill arrived in the mail. In rural Colorado, where ambulance dispatchers had been casually accustomed to naming the family whose home needed a run (get over to the Wilson ranch, Vern is having chest pains) it was thought advisable to rely on unfamiliar street addresses instead, leaving drivers to fumble.

Much social collaboration with the aim of better care has become legally hazardous. Doctors have been reported hesitant to draw relatives aside with advice that elderly parents need help with pill-taking or ought to stop driving. Opinions differ on whether a doctor can safely ring up other practitioners to check whether a new patient reporting unverifiable pain is known for a pattern of narcotic-seeking.

Some common sense was restored after Washington issued directives making clear that a wide range of “incidental” disclosures, as well as those given in the course of care, are okay: thus attendants need have no fear of calling patients’ names aloud in waiting rooms, family members can pick up each other’s prescriptions at the pharmacist, and nurses can give each other quick run-downs on a transferred patient’s situation (at least on a “need to know” basis).

Above all, medical professionals are now trained to shove release forms into patients’ trembling hands on first contact - hence the nickname Huge Increase in Paperwork and Aggravation Act. But of course some patients refuse to sign any consent form, and the law provides that they cannot be denied care on that account. And while the right to conceal one’s medical adventures from scrutiny can be of value to many of us, it has particular value to the problem or antisocial patient.

HIPAA also deprives researchers and the general public of much information of legitimate interest. When flu epidemics hit, state officials now sometimes refuse to divulge which localities have been affected, whether fatal cases were infants or elderly or had taken their shots, and so forth. Research into the history of medicine has hit a block because so many source materials, such as top physicians’ private papers, are laced with references to individually identifiable patients (there is no time limit on protected privacy). “To strictly follow HIPAA we’d have to close our photograph collection entirely,” frets Columbia University’s head of medical archiving.

Even after Tuesday’s massacre, institutions have declined to make Cho’s medical records public, because his HIPAA rights do not end with death. Kafkaesque indeed.

Walter Olson edits Overlawyered.com and PointOfLaw.com and is a senior fellow at the Manhattan Institute

Explore Law

• Corporate Law

• Public Law

• Columnists

• Law Panel

• Student Law

• Law Reports

Times Recommends

• HM Revenue sued over pension scheme tax
• Farepak liquidators to sue former directors
• McCartney and Mills: it's finally over