When people talk about a “duty of care” in higher education, the conversation almost always circles back to mental health – to counselling services, wellbeing strategies, or suicide prevention.
It’s understandable. Those are visible, urgent needs. But the phrase “duty of care” carries far more weight than any one policy or pastoral initiative.
It reaches into every space where universities hold power over students’ lives, and every context where harm is foreseeable and preventable.
That misunderstanding has shaped national policy, too. When over 128,000 people petitioned Parliament for a statutory duty of care in 2023, the Government’s response was to establish the Higher Education Mental Health Implementation Taskforce – a body focused on mental health and suicide prevention.
Its four objectives spoke volumes – boosting University Mental Health Charter sign-ups, expanding data analytics to flag students in distress, promoting “compassionate communications” to guide staff interactions with students and, where appropriate, with families, and overseeing a National Review of Higher Education Student Suicides.
These were not bad aims – but they did not speak to the duty that had been demanded. None addressed the legal, structural, or preventative responsibilities that underpin a real duty of care.
The Taskforce has tackled symptoms, not systems – outcomes, not obligations. By focusing on “student mental health,” the issue became more comfortable – easier to manage within existing policy frameworks and reputational boundaries.
It allowed the sector to appear to act, while sidestepping the harder questions of legal clarity, parity, and the accountability owed to those who were harmed, failed, or lost.
In a 2023 Wonkhe article, Sunday Blake made this point with striking clarity. “Duty of care,” she wrote, “is not just about suicide prevention.”
Nor, by extension, is duty of care just about mental health. Universities shape students’ experiences through housing, assessment, social structures, disciplinary systems, placement arrangements, and daily communications.
They wield influence that can support, endanger, empower or neglect. If the phrase “duty of care” is to mean anything, it must cover the full spectrum of foreseeable harm – not only the moments of crisis but the conditions that allow harm to build unseen.
Importantly, this broader understanding of duty of care is not confined to campaigners or bereaved families. The British Medical Association has also recently called for a statutory duty of care across higher education, after hundreds of medical students reported sexual misconduct, harassment, and institutional neglect in a UK-wide survey.
Drawing on evidence from its Medical Students Committee, the BMA argued that universities hold both knowledge and control, and therefore must bear legal responsibility for preventing foreseeable harm. Crucially, the BMA understands duty of care as a legal obligation – not a wellbeing initiative. Their intervention shows that this is not a niche debate about mental health, but a structural failure across the entire higher-education sector.
That wider perspective is not a theoretical question. It has been tested – violently, publicly, and avoidably – in real life.
The stabbing
In October 2009, Katherine Rosen was a third-year pre-med student at UCLA, one of America’s leading public universities. She was attending a routine chemistry class – an ordinary academic setting – when another student, Damon Thompson, approached her from behind and stabbed her in the neck and chest with a kitchen knife. He nearly killed her.
It was sudden. It was unprovoked. But it was not unexpected.
Thompson had a long, documented history of paranoid delusions. University psychiatrists had diagnosed him with schizophrenia and major depressive disorder. He reported hearing voices and believed classmates were plotting against him.
He had been expelled from university housing after multiple altercations. He told staff he was thinking about hurting others. He had specifically named Katherine in a complaint – claiming she had called him “stupid” during lab work.
Staff knew. Multiple professionals were aware of his condition – and the risks he posed. Just one day before the attack, he was discussed at a campus risk assessment meeting. And yet – no action was taken. No warning was issued, no protection was offered, and no safeguarding plan was put in place.
Katherine was left completely unaware. Because the university chose to do nothing.
The legal battle
After surviving the attack, Katherine took an action that would shape the future of student safety law in the United States – she sued her university.
Her claim was simple but profound. UCLA, she argued, had a special relationship with her as a student. That relationship – based on enrolment, proximity, institutional control, and expectation of care – created a legal duty to protect her from foreseeable harm. And that duty, she said, had been breached.
She wasn’t demanding perfection or suggesting universities could prevent every imaginable harm. She asked a basic question – if a student has been clearly identified as a threat, and the university knows it, doesn’t it have a legal responsibility to act before someone gets seriously hurt – or killed?
UCLA’s response? No. The university claimed it had no legal duty to protect adult students from the criminal acts of others – even when it was aware of a risk. This wasn’t their responsibility, they said. Universities weren’t guardians, and students weren’t children. No duty, no breach, no liability.
Their argument rested on a key principle of common law, shared by both the US and UK – that legal duties of care only arise in specific, established situations. Traditionally, adult-to-adult relationships – like those between a university and its students – did not automatically create such duties. Courts are cautious – they don’t want to impose sweeping responsibilities on institutions that may be unreasonable or unmanageable. But that argument ignores a crucial reality – the power imbalance, the structure, and the unique environment of university life.
The judgment
Katherine’s case wound its way through the California courts for almost ten years. At every level, the same question remained – does a university owe a duty of care to its students in classroom settings, especially when it is aware of a specific risk?
Finally, in 2018, the California Supreme Court delivered a landmark ruling in her favour.
The Court held – by a clear majority – that yes, universities do owe such a duty. Not universally, not in every context – but during curricular activities, and particularly when risks are foreseeable, they must take reasonable protective measures.
The judgment clarified that a “special relationship” exists between universities and their students, based on the student’s dependence on the university for a “safe environment.” That relationship created not just moral expectations but legal ones.
In the Court’s own words:
Phrased at the appropriate level of generality, then, the question here is not whether UCLA could predict that Damon Thompson would stab Katherine Rosen in the chemistry lab. It is whether a reasonable university could foresee that its negligent failure to control a potentially violent student, or to warn students who were foreseeable targets of his ire, could result in harm to one of those students.
That emphasis on warning mattered. The Court was clear that the duty it recognised did not demand extraordinary measures or perfect foresight. The minimum reasonable step UCLA could have taken — and failed to take — was to warn Katherine or put in place basic protective actions once staff knew she was a potential target. It was this failure at the most elementary level of safeguarding that brought the duty sharply into focus.
And again:
Colleges [universities] provide academic courses in exchange for a fee, but a college is far more to its students than a business. Residential colleges provide living spaces, but they are more than mere landlords. Along with educational services, colleges provide students social, athletic, and cultural opportunities. Regardless of the campus layout, colleges provide a discrete community for their students. For many students, college is the first time they have lived away from home. Although college students may no longer be minors under the law, they may still be learning how to navigate the world as adults. They are dependent on their college communities to provide structure, guidance, and a safe learning environment.
This ruling was a seismic moment. It wasn’t just about Katherine – it was about thousands of other students, across hundreds of other classrooms, who could now expect, not merely hope, that their university would act when danger loomed.
The precedent was narrow but profound
This victory came at a cost. It took nearly a decade of litigation, immense emotional strength, and personal resilience. And even in success, the ruling was carefully limited in scope:
… that universities owe a duty to protect students from foreseeable violence during curricular activities.
The duty applied only to harm that was:
- Foreseeable,
- Tied to curricular activities, and
- Within the university’s ability to prevent.
It did not impose a sweeping obligation on universities to protect students in all circumstances – nor should it. But it decisively rejected the idea that universities have no duty to protect.
This distinction – between the impossible and the reasonable – is crucial. The court did not ask universities to do the impossible. It simply expected them to act reasonably when aware of a real and specific risk to student safety. That principle sets a clear floor, not an unreachable ceiling, for institutional responsibility.
It also highlights a broader truth – duty of care in higher education is not a binary. It is not all or nothing. A range of duties may arise depending on the setting – academic, residential, or social – or the nature of the risk. The more control a university exercises, and the more vulnerable the student, the greater the duty it may owe.
This is not about creating impossible expectations – it is about recognising that responsibility must follow power.
That same logic – and the emerging recognition of limited but enforceable duties – has begun to surface in UK courts. In Feder and McCamish v The Royal Welsh College of Music and Drama, a County Court held that higher education institutions have a duty of care to carry out reasonable investigations when they receive allegations of sexual assault:
…by taking reasonable protective, supportive, investigatory and, when appropriate, disciplinary steps and in associated communications.
Again, where institutions have knowledge and control, the law expects a proportionate response.
But it is important to recognise just how narrow the duty was in Feder & McCamish. The College already had safeguarding procedures in place, and liability arose only because it failed to follow the process it had voluntarily adopted when students reported serious sexual assault.
The court did not recognise any general duty to protect student welfare – it simply enforced the College’s own promises. It illustrates the limits of UK law – duties arise only in piecemeal, procedural ways, leaving large gaps in protection whenever an institution has not explicitly committed itself to a particular process, or chooses not to follow it.
Why this story matters now
The Rosen judgment exposes a truth that too many still miss. Duty of care in higher education is not about expanding counselling teams or implementing wellbeing charters. It’s about the structure of responsibility itself – who knows what, who can act, and who must act when risk is foreseeable.
In Katherine Rosen’s case, mental health support for Damon Thompson already existed. What failed was the system around him – communication, coordination, and the willingness to protect others. The danger was known, the mechanisms to prevent it were available, and the decision to use them was not taken.
That is why framing “duty of care” as a question of mental health provision misses the point. Whether the risk is psychological, physical, financial, or reputational, the same principle applies – when institutions hold both knowledge and control, they owe a duty to act with care.
From assaults in halls to exploitation on placements, from harassment ignored to risks left unmonitored, the duty of care spans far more than mental health. It is about foreseeable harm in any form. It is about accountability that matches authority. It is about creating a culture in which doing nothing or ignoring what you know is no longer an option.
As Parliament prepares to debate the issue once again, the Rosen case stands as a reminder that this conversation cannot stop at wellbeing. The question is not whether universities should care about students’ mental health – of course they should. The question is whether they will take responsibility for the predictable consequences of their own systems, structures, and decisions.
Katherine Rosen’s survival – and her long legal struggle – gave the world a clearer definition of that responsibility. It showed that duty of care is not about offering sympathy after the fact, but about preventing foreseeable harm before it happens. That is the real meaning of duty of care in higher education – and it is the clarity the UK still urgently lacks.
