Open Records and Leaked Medical Memo
You are the communications lead at a public university whose athletics program is raising funds for a $5 million baseball facility naming gift. On Monday, the student newspaper requests under the state open records law all emails between athletics communications and the donor from the past 18 months. On Tuesday, an anonymous account posts an internal athletics memo listing a quarterback's concussion protocol, including 'return to play' dates and a physician's note. The coach wants to post the full memo to 'prove we followed the protocol.' A reporter asks for the player's medical records. Legal counsel says preserve all records, release nothing without review, and expect a 10-business-day response. The donor, whose name is on the facility, emails that he is 'rethinking the gift' because of the 'media circus.' A team doctor says the memo was shared with 14 staff. The quarterback's parents have not been contacted by the university. The student paper has already published the memo.
1. Outline how you will handle the open records request and what you will communicate to the requester.
Read the worked answer
Steps:
- Acknowledge in writing within two business days. State the date received, the scope as you understand it, the statutory response date, and any fee estimate. Do not say 'we will release everything.'
- Assign a records liaison from the university records office and legal counsel. Athletics does not run a separate process.
- Preserve with a litigation hold to athletics communications, development, the AD, and IT. Include texts and personal devices if used for university business. No deletions.
- Clarify and narrow search terms, custodians, and date range. Ask the requester if they will narrow; if not, proceed.
- Review for exemptions: FERPA student records, donor personal or financial information, attorney-client privilege, deliberative process, and personnel. Redact rather than withhold entire documents where possible. Log each redaction and legal citation.
- Produce non-exempt records in batches by the deadline; if third-party notice to the donor is required, tell the requester. Communicate: 'We are reviewing responsive records under the state public records law and will produce non-exempt records by [date].' Explain delays factually. The goal is compliance and credibility, not a press win. A slow, redacted production is better than an incomplete dump that violates privacy.
2. The coach wants to post the full internal memo to prove protocol was followed. What is your recommendation and how do you explain it?
Read the worked answer
Recommendation: do not post the memo. Reasons: it contains a student's medical information; FERPA and institutional health-privacy policy protect it; posting it may also violate ADA confidentiality. Even if the coach believes it proves compliance, it does not prove compliance to the public. It invites armchair medical review and sets a precedent that internal operations memos can be released on demand. It also harms the player, who has not consented. Alternative: issue a statement: 'The university has a concussion protocol and followed it. An independent review is underway. We will not discuss individual medical information.' If there is a genuine public-safety concern, a redacted summary reviewed by legal and the team doctor may be appropriate, but not the raw memo. Explain to the coach: the goal is credibility, not volume. Over-disclosure can look like spin and can expose the university. Offer him media training and a joint statement with the team doctor. If he pushes back, remind him that the memo was leaked, not officially released; confirming its contents rewards the leak. Document the advice.
3. Draft the three communications: to the quarterback's parents, to the donor, and to the public. Explain why they differ.
Read the worked answer
Parents (private call, then email): 'We are sorry you learned about the memo from the media. We should have called you first. We are not releasing [player]'s medical information. We want to meet with you and the team doctor today. Please tell us what you need.' This must apologize for the process, not admit a medical error, and must offer a concrete meeting. It is detailed because the family has a right to direct answers. Donor (private call): 'Thank you for your call. I understand the media attention is frustrating. The university is committed to the facility project and to handling student medical information privately. I cannot discuss personnel or records, but I can set a meeting with the AD and development.' This must protect the relationship and the project without accepting conditions on the gift. Public (statement): 'The university is aware of a leaked internal memo involving a student-athlete's health information. We take privacy seriously and have begun a review. We will not discuss individual student records. The university remains committed to the baseball facility project and to donor intent.' This acknowledges the leak, states the boundary, and reassures without details. They differ because each audience needs a different mix of accountability, relationship, and boundary. Sending the public statement to the parents would be cruel; sending the parents' message to the public would invade privacy.