The following is a complaint that was submitted to the Virginia Department of Education (VDOE).
VDOE found Fairfax County Public Schools (FCPS) in noncompliance.
The complaint features a few different types of confidentiality breaches, some of which I didn’t find out about until after I did a FERPA request.
Noncompliance, Student Records—Confidentiality
Complaint:
FCPS failed to ensure the protection of confidentiality of XXXXXX.
Additional Information:
Applicable Regulations:
- 34 C.F.R. 300.32, 300.622, and 300.623
- Special education laws and regulations state that parental consent shall be obtained before personally identifiable information is disclosed to anyone other than officials of the local educational agency unless the information is contained in the education records, and the disclosure is authorized under the Family Education Rights and Privacy Act. Each local educational agency shall protect the confidentiality of personally identifiable information at collection, storage, disclosure, and destruction stages. (This language is straight from the Virginia Department of Education. VDOE used it in response to a previous complaint I submitted. Given this was their stance previously—and this was the same issue as previously—the same should apply. So . . . I presented their own words to them.)
- Personally identifiable information to mean information that contains the following: (i) the name of the child, the child’s parent, or other family member; (ii) the address of the child; (iii) a personal identifier, such as the child’s social security number or student number; or (iv) a list of personal characteristics or other information that would make it possible to identify the child with reasonable certainty. (This language is straight from the Virginia Department of Education. VDOE used it in response to a previous complaint I submitted. Given this was their stance previously—and this was the same issue as previously—the same should apply. So . . . I presented their own words to them.)
I.
5.31.19:
FCPS failed to ensure the protection of confidentiality of XXXXX.
South County High School Teacher Chris Walton forwarded confidential information to Ms. Davis at Fairfax County Federation of Teachers (FCFT) and indicated to Ms. Davis that she spoke with South County Middle School teachers even though I never provided South County Middle School a release to speak with South County High School teachers, to include Chris Walton.
10.16.19: FCPS confirmed that it did not ensure the protection of confidentiality. Assistant Superintendent Jay Pearson emailed me and stated, “I am following up on the concern you raised, both in email and during our phone conversation, that a staff member sent information to an association representative that included personally identifiable information about your child. We reviewed the information forwarded to the association representative, and we agree that it should not have been forwarded.”
II.
6.4.19:
FCPS failed to ensure the protection of confidentiality of XXXXX.
South County High School Teacher Chris Walton forwarded private information to Ms. Davis at FCFT. FCPS employees Sam Gero, Chris Walton, Gary Morris, Kaaren Lowder, Dana Walker, and Jay Pearson were cc’d on the email. FCPS employee Sean McCormally was bcc’d on the email.
10.16.19:
FCPS confirmed that it did not ensure the protection of confidentiality. Even though Assistant Superintendent Jay Pearson was cc’d on Chris Walton’s email to FCFT, it wasn’t until after I obtained the email via a FERPA request, forwarded the email to Jay, and spoke with Jay on the phone that he emailed me and stated, “I am following up on the concern you raised, both in email and during our phone conversation, that a staff member sent information to an association representative that included personally identifiable information about your child. We reviewed the information forwarded to the association representative, and we agree that it should not have been forwarded.” This feeds into my belief that FCPS makes families aware of breaches ONLY if the family or another individual outside of FCPS makes FCPS aware of the breach.
III.
6.17.19:
FCPS failed to ensure the protection of confidentiality of XXXXX.
South County High School Teacher Chris Walton forwarded private information to her private email address.
IV.
10.1.19:
FCPS failed to ensure the protection of confidentiality of XXXXX.
Gary Morris emailed confidential information to Melaney Mackin, who is the principal of Silverbrook Elementary School, and Melaney was thus included on other emails that were a part of “reply to all” before I realized that Gary had added her to the emails.
I alerted Gary to the noncompliance.
10.2.19:
Gary admitted to the noncompliance.
V.
10.24.19:
FCPS admitted that it failed to ensure the protection of confidentiality of XXXXX.
10.24.19, 7:25 PM: South County Principal Gary Morris admitted that he failed to ensure protection of confidentiality. He specifically stated, “I am writing to inform you that I was alerted today by a parent who picked up documentation from my office, that within her documentation I mistakenly included a document that had identifiable information of XXXX within it. This was totally my mistake as I somehow picked up a document with XXX’s information on it and packaged it with the information for the other parent.”
10.24.19, 8:04 PM: I emailed Gary and asked, “What document and personal information did you share and with whom was this information shared?”
10.24.19, 8:04 PM: South County High School Parent XXXX emailed me to make me aware that 12 pages – not “a document” – about my son had been provided to her by SCHS. I forwarded XXXX my phone number and she and I then spoke for about 30 minutes and she shared the nature of the 76 pages of information that SCHS provided to her, none of which were related to her daughter. Twelve of the 76 pages related to XXXX.
10.25.19, 5:55 AM, Gary Morris emailed me, “I believe it was documentation around the new schedule and the communication about that schedule. The person who received it is a South County parent as well. In all honesty, she has not totally described the documentation. I typically don’t print out my emails, and that was the only thing that I may have had out in my office that would have had XXXXX ID number attached to it.”
This confirmed that FCPS has nothing in place to ensure confidentiality related to FERPA requests and that it has nothing in place to track what was provided in FERPA requests on the occasion that there was a breach.
10.25.19, 6:57 AM, I emailed Garry Morris that he was not correct. The breach was not related to a change of schedule.
10.25.19, 8:20 AM, Gary Morris emailed me, “I was able to find the document that I believe was sent home. The document was a chain of emails that centered on your discussion of XXXXX. There were 3 emails that had come up in this chain of emails and I had pulled what I believed to have been all of them. Obviously, I didn’t get them all, and did not do my diligence in screening what I did send.”
This was not correct, but at this point I didn’t respond to his continued ignorance. I later sent an email and showed up at the school at about 1 PM that day.
VDOE’s Letter of Findings:
The following is VDOE’s response to the complaint. One of the positive things about filing a complaint, even if it doesn’t go the way you wish, is that VDOE provides the applicable regulations and other language that can later be used in other complaints, due process, and so on.
While you might be disappointed by an outcome, use it as a learning experience.
You’ll note, too, that what VDOE says I stated doesn’t match what I actually stated. This has been an ongoing issue with VDOE and will be addressed in a separate article. If you aren’t in Virginia, this is something you’ll want to keep an eye on with your own state education agency.
ISSUE(S) AND REGULATIONS:
1. Student Records—Confidentiality.
Parent has alleged that LEA has violated special education laws and regulations governing confidentiality of student records. More specifically, Parent has alleged:
- On May 31, 2019, “[Student’s ninth grade Honor Geometry teacher] forwarded confidential information to . . . [LEA] Federation of Teachers . . . and indicated . . . that [Student’s ninth grade Honor Geometry teacher] spoke with [Middle School teachers] even though I never provided [Middle School] a release to speak [High School teachers], to include [Student’s ninth grade Honor Geometry teacher]” and that, in an October 16, 2019, email, LEA Assistant Superintendent “confirmed that it did not ensure the protection of confidentiality” with regard to this transmission;
- On June 4, 2019, “[Student’s ninth grade Honor Geometry teacher] forwarded private information to CFT” and that, in an October 16. 2019 email, LEA Assistant Superintendent “confirmed that it did not ensure the protection of confidentiality” with regard to this transmission;
- On October 1, 2019, School Principal ’emailed confidential information to [Elementary School Principal], and [Elementary School Principal] was this [sic] included on other emails that were a part of ‘reply to all’ before I realized that [School Principal] had added [Elementary School Principal] to the emails;
- On or about October 24, 2019, School Principal mistakenly included tudent’s confidential information in materials to be retrieved by another parent and that “12 of the 76 pages’ the parent received contained information about Student.
Applicable Regulations:
- 34 C.F.R. 300.613; 8 VAC 20-81-170.G.
- 34 C.F.R. 300.623; 8 VAC 20-81-170.G.11.
- 34 C.F.R. 300.32 and 300.623; 8 VAC 20-81-170.G.10.
- Family Education Rights and Privacy Act (20 USC 1232g).
- 8 VAC 20-150-20 (referencing inter alia, 16.1-260, 16.1-305.1, 16.1-305.2, 22.1-287, 22.1-287.1, 22.1-288.2, and 22.1-289).
Findings:
This office finds LEA in noncompliance on this issue.
Analysis:
- Special education regulations 34 C.F.R 300.613; 8 VAC 20-81-170.G) set forth generally provisions governing confidentiality of information. These provisions address, among other things, parental rights to inspect and review education records relating to the student.
- Additionally, these regulations (34 C.F.R. 300.623; 8 VAC 20-81-170.G.11.) direct school divisions to protect the confidentiality of personally identifiable information at collection, storage, disclosure, and destruction stages. The regulations (34 C.F.R. 300.32 and 300.623; 8 VAC 20-81-170.G.10.) specify that parental consent must be obtained before personally identifiable information (PII) is disclosed to anyone other than school division officials, unless the information is contained in the education records, and the disclosure is authorized under the Family Education Rights and Privacy Act (20 USC 1232g). Parental consent is not required before personally identifiable information is disclosed to school division officials collecting, maintaining, or using personally identifiable information as required by special education regulations, with limited expectations.
- More specifically, FERPA regulations (34 C.F.R. 99.31) provide exceptions to the parental consent requirement for disclosure of PII to, inter alia, “other school officials, including teachers, within the agency or institution whom the agency or institution has determined have legitimate educational interests.”
- The U.S. Department of Education, Office of Special Education Programs (OSEP), has stated that “One of the exceptions to FERPA’s prior written consent requirement (99.31(a)(1)) permits the disclosure of personally identifiable information from education records to school officials, within the agency or institution, whom the agency or institution has determined to have ‘legitimate educational interests.’ Typically, a school official has a ‘legitimate education interest’ if the official needs to review an education record in order to fulfill his or her professional responsibility.”
- Having reviewed the record—including LEA’s acknowledgments5 [sic]—regarding the cited incidents and applicable law and regulations, we find that, on at least one occasion, LEA shared Student’s PII with third parties without parental consent and without meeting the regulatory exceptions for such disclosure.
Based on the foregoing, we find LEA in noncompliance on this Issue.
0 comments on “Sample State Complaint: Noncompliance, Student Records—Confidentiality”