A gunman bursts into a university classroom on a Monday morning killing spree, which ends only when he takes his own life. Later that week, a news organization receives material mailed by the killer--a student with known behavioral problems--that blames others for his actions.

Eerily similar to last week's tragedy at Virginia Polytechnic and State University, that was the horror that struck the University of Arizona campus in Tucson in October 2002. From that carnage emerged a risk management program designed to identify and deal with potential threats to the campus community but still comply with mental health confidentiality laws.

While there is no way to definitively determine whether the UA program has prevented another campus massacre, it has identified "a few" individuals who fit the mold of mass murderers who have scarred the two universities, said Steve Holland, director of risk management and safety for the UA.

"This kind of protocol is the best chance we have" of preventing future campus mass killings, said Peter Lake, a professor of insurance law at Stetson University Law School in DeLand, Fla.

In the UA incident, an often disruptive nursing student with failing grades shot and killed an instructor in her office before storming a classroom and gunning down two more professors in front of a group of students. The heavily armed gunman then ordered the students out of the room before killing himself.

The next day, a local newspaper received a letter from the killer--mailed the night before the shootings--in which he claimed that the instructors and others had wronged him.

Like the Virginia Tech killer, the UA gunman demonstrated behavioral problems at least 18 months before his violent eruption. For example, he told an instructor in April 2001 he had thoughts of suicide and "might put something under the college." Although the threat was reported to the campus police, they took no action because a university administrator and a faculty member talked with the student and felt no further intervention was warranted (BI, Nov. 4, 2002).

That kind of miscalculation is what the UA program is designed to prevent.

"We think we learned an awful lot" from that tragedy, Mr. Holland said. The "single biggest thing" was the need for a system that pulls together all the different pieces of information that instructors, campus police and other areas of the school have about a potential threat.

In isolation, each piece of information may not cause the same level of concern that school officials might have if they could see all of it in one place, he said.

To that end, Mr. Holland established central repositories for all reports on threatening behavior exhibited by students and university employees. Such reports on students now are filed with the dean of students; reports on employees are filed with human resources.

Students also are encouraged to report disturbing behavior.

When a report indicates what Mr. Holland concludes could be threatening behavior, he scrambles a behavioral assessment team into action. It consists of representatives from the university's risk management, human resources, student counseling and employee assistance departments as well as the dean of students and campus police.

In the team's meeting, "the goal is to connect the dots" on various pieces of information on the potentially troubled individual, Mr. Holland said.

If the team concludes that the person poses a threat, the university's response would be case-specific, Mr. Holland said. He and his team would determine which university official should warn the individual that his or her behavior is inappropriate. The official is selected based on whom the student most likely would respect as an authority figure, Mr. Holland said.

In more drastic cases, the university could move to have the person held for mental health treatment, arrested or barred from campus.

During the process, the university has to consider the federal and state laws that govern when a mental health counselor may disclose information obtained from a patient during counseling. Those laws generally prohibit disclosure of students' health information--even to students' parents.

But there is an exception, though negotiating through it can be tricky, said Laura M. Knoblauch, a member of the American College Health Assn. Ms. Knoblauch, also the privacy officer and student health service risk manager for Illinois State University in Normal, Ill., has testified before Congress on issues involving the Health Insurance Portability and Accountability Act--the federal statute that governs health privacy rules.

HIPAA defers student privacy rights to the Family Education Rights and Privacy Act, and FERPA contains a privacy exemption when students pose an imminent threat to themselves or others, Ms. Knoblauch said.

But when a student's mental health records are involved, state law would trump FERPA and may be more stringent, Ms. Knoblauch said.

Often, though, "FERPA is a practical irrelevancy," because so much of an individual's disturbing behavior likely would not qualify for privacy protection, Mr. Lake said.

Even if a university inadvertently violates FERPA, "it's a paper tiger," Mr. Lake said. There is no private right to sue over a FERPA violation, and the risk of a federal fine is extremely small--especially if the violation occurred as part of a university's effort to protect students and faculty, he said.

Meanwhile, federal and state laws would allow a university's internal staff to review a student's mental health records on a "need-to-know" and "case-by-case" basis, Ms. Knoblauch said. That decision should be made in consultation with the university's legal department, she said.

Mr. Holland noted that no mental health information on students is transmitted by e-mail, and such sensitive information is included only in written, confidential reports that document the action UA has taken against an individual.