According to the American College Health Association, 1 in 368 U.S. college students is living with HIV. But do positive collegians who know their status have any guarantee their classmates won’t discover it too? Since the Virginia Tech shootings last April, college infirmaries have been wrestling over the confidentiality of medical records. Could—and should—campus officials have done more to alert the family and classmates of Virginia Tech gunman Cho Seung-Hui about his documented mental-health history? And how does this extreme case trickle down into such everyday scenarios as testing for HIV and sexually transmitted diseases—and partner notification? “Virginia Tech is the latest example of how health professionals are very confused about what they can do [on campuses],” says Donald A. Misch, MD, of Northwestern University’s Health Service. “It’s a mess.”

Health administrators have wrangled for years over a collision between the Family Educational Rights and Privacy Act (FERPA), a college privacy law passed in 1974, state mental-health codes and the Health Insurance Portability and Accountability Act (HIPAA). A FERPA exception to HIPAA says that some medical records can be treated as educational records; another FERPA clause dictates that those educational records can be released in “emergency circumstances,” a very gray area that rarely specifies what constitutes a threat to other students. What if a university health official finds that a positive student is having unprotected sex with another student? Could positive students’ HIV status ever be legally revealed against their will? And could they be unfairly criminalized as a result? “There really needs to be some clarification of all these laws,” says Misch. Meanwhile, students and parents should study up on school health-privacy policies.