What are a University's legal obligations and limitations on a report like this? Also, doesn't the shrink's report violate the doctor-patient confidentiality, or am I missing something?