300h_IMG_1529

Third-Party Requests for University Information FAQs

There are instances when faculty and staff are approached, either in person or through document requests such as warrants or subpoenas, by law enforcement agencies, other investigative agencies, the media, or outside legal counsel regarding University-related matters. This fact sheet contains information to help faculty and staff handle these encounters appropriately and to comply with applicable laws, such as privacy laws, including but not limited to, the Family Educational Rights and Privacy Act (“FERPA”) and the Health Insurance Portability and Accountability Act (“HIPAA”).^{^[1]}

What is meant by “Information”: “Information” includes verbal and written information created or held by or on behalf of the University about the University, University students, faculty members, staff members, University facilities, University intellectual property or the intellectual property of third-parties affiliated with the University, as well as information that may be observed.^{^[2]}

Can employees release Information in any form to third-party investigators, attorneys, and agencies?

Employees should not release any information or provide access to any facility owned or controlled by the University to external investigators, attorneys, or agents before contacting their supervisor and either

The Office of Legal Counsel (405-325-4124 Norman; 405-271-2033 HSC) if the information relates to the University’s intellectual property or pertains to a current or former student or employee, or
The Office of Compliance (405- 271-2511) if the information could be HIPAA-protected (e.g., if the information is the Protected Health information).

The Office of Legal Counsel may elect to assign an attorney or University representative to assist with or oversee any mandatory or voluntary responses, document releases, or inspections.

What if a third party such as a member of the press or a member of the community requests University Information?

If a member of the press or other non-government or non-attorney requests information, University employees should refer that inquiry to the Open Records Office at (405) 325-0202 or openrecords@ou.edu. The Open Records Office will determine whether the third-party is entitled to the information by law or whether the request should be referred to Marketing & Communications.

What if a government agent or external investigator visits an employee in person and requests University Information?

If a member of a government agency, member of a law enforcement agency, external investigator, or external legal counsel requests information in person, employees should take the following steps:

Verify Identity: Employees should ask the requestor for identification or credentials, such as a business card, and review and make a copy of the identification or credentials.
Place Two Calls: Employees should tell the requestor that it is the University’s policy that before any information or access to information or facilities can be provided, the employee must contact their supervisor. The employee or supervisor must also contact the Office of Legal Counsel and/or the Office of Compliance, as applicable. Employees may ask the requestor to talk to the supervisor or the Office of Legal Counsel, but the Office of Legal Counsel should be contacted prior to responding to a request for information or access.
Escort the Requestor: The University expects that a supervisor or member of the Office of Legal Counsel, Office of Compliance, or designee will accompany the requestor into or through any nonpublic, patient care, or export-controlled areas.

What if the government agent or external investigator is requesting documents as part of a background check or security screen on the employee?

If a requestor is conducting either a routine background check or security screen, such as for military service, and presents a signed release from the student or employee, the department may proceed without contacting the Office of Legal Counsel; however, the Office of Legal Counsel is available for any questions or concerns.

What if the government agent or external investigator has a search warrant?

If a government agent or external investigator presents a search warrant, employees should ask to copy the warrant and should immediately notify the supervisor and the Office of Legal Counsel of the search warrant.

Ultimately, the employee must allow the search to occur, even if the requestor will not wait for the employee to contact the supervisor and Office of Legal Counsel. If this occurs, employees must immediately contact the Office of Legal Counsel and must also log all documents taken during the search and attempt to obtain the requestor’s permission to copy the documents prior to their removal. If feasible, the employee should record the actions of the requestor and provide that recording to their supervisor or the Office of Legal Counsel upon request.

What if the employee is served with a subpoena for University Information?

If a requestor presents a subpoena for University documents or if an employee receives a subpoena for such by mail, email, or fax, the employee must immediately give the subpoena to the supervisor, who will contact the Office of Legal Counsel regarding the appropriate response to the subpoena. Not all subpoenas for documents are compliant with state or federal laws, such as HIPAA and FERPA. The Office of Legal Counsel will determine whether the University must comply with a particular subpoena.

Who should employees contact if they have further questions?

Please reach out to the Provost’s Office or the Office of Legal Counsel with any further questions.

^{[1] These procedures are derived from the Board of Regents of the University of Oklahoma Compliance and Quality Improvement Program. https://compliance.ouhsc.edu/;20 U.S.C. § 1232g; 34 CFR Part 99; Public Law 104-19; and 51 O.S. §24A.1.}

^{[2] Information would not include items that relate to the employee’s personal, non-University matters, e.g. domestic charges, etc.}