When it comes to issues of mental health on campus, lawyers, psychologists and university administrators all agree on one thing: Striking an appropriate balance between protecting an individual's privacy and the community's security is not easy.
In federal law and in most states, privacy concerns generally trump security, but in practice, universities say situations are handled on a case-by-case basis and sometimes result in a school contacting a student's parents or the police for help.
Privacy and security "don't need to be in conflict with one another," said Craig Haney, a professor of psychology and law at the University of California at Santa Cruz.
"By protecting people's privacy interests, in the long run you're advancing security concerns as well. If outside sources have access [to private health information], people might be reluctant to seek help."
Since the deadly shootings at Virginia Tech on Monday, however, many have wondered why the school did not take more proactive steps to treat or remove from campus gunman Seung-hui Cho, despite his known history of mental illness.
Both professors and students told university officials they believed Cho was unstable. In an English class, he wrote explicit and violent plays, which ultimately led to his removal from the class for private tutoring.
Two female students reported him for stalking and local law enforcement authorities had him sent for psychological evaluation
According to William Winsdale, a licensed psychoanalyst and professor of law at the University of Houston, administrators at Virginia Tech had a responsibility to the school's other students because "Cho was clearly psychotic and they should have erred on the side of caution."
"This is the classic horrendous example of when someone gets identified as a risk and then the system doesn't work to follow though to determine how big a risk and to whom he is a risk."
Winsdale said privacy rules had a place, particularly when it comes to limiting the media's access to health records, but institutions like Virginia Tech should not "hide behind bureaucracy … [or] behind 'privacy.'"
In some states, most notably California, if a therapist knows his patient is going to commit a specific violent act and does not report it, he can be held liable. These laws came out of the 1976 case, Tarasoff vs. Regents of the University of California, in which the California Supreme Court ruled therapists had a "duty to protect" intended victims.
However, in most states, including Virginia, conversations between a therapist and his patient are considered privileged and mental health professionals cannot be held responsible for violence caused by patients in their care unless that patient is being held at a hospital.
"Therapists generally have no legal duty to protect the public from the harm their patients might cause," Jeffrey Rachlinski, a professor of law and psychology, told ABCNEWS.com.
Similarly, he said, "Universities don't have a legal responsibility to tell parents" if a student is exhibiting signs of mental illness.
Though not required to report threats of violence, Rachlinski explained that "professional norms," the rules psychologists make for themselves, require therapists to alert authorities if they believe someone is "a threat to himself or others."