VDOE and FCPS Failing Streak: Seven Years of Failing to Prevent Inadvertent Disclosure

For at least seven years, Fairfax County Public Schools (FCPS) and Fairfax County School Board (FCSB) have failed to take sufficient precautions to prevent inadvertent disclosure.

For at least five years, FCPS, FCSB, and Virginia Department of Education (VDOE) have failed to stop the inadvertent disclosures, even though VDOE and/or U.S. Department of Education’s (USDOE) Student Privacy Police Office (SPPO) have repeatedly found FCPS at fault for failure to take sufficient precautions to prevent inadvertent disclosure. Not even losing a lawsuit in 2021, during which Fairfax County Circuit Court Judge Richard E. Gardiner pointed out FCSB’s failures, stopped FCPS and FCSB from future failures to take sufficient precautions to prevent inadvertent disclosure.

The irony is, while FCPS and FCSB have spent years failing to prevent inadvertent disclosures, FCPS school officials have spent years intentionally engaging in bad faith activities designed to prevent disclosure of other records from being responsive to FERPA and FOIA requests.

For example, in an October 6, 2019, email, Jane Strong, former head of FCPS’ due process and eligibility office, advised a colleague that she was adding a lawyer to the email strand just so the emails would be attorney-client privileged. The email didn’t contain private or proprietary information or even address legal proceedings, yet she wanted to prevent the correspondence from being obtained via a FERPA or FOIA request anyway.

On other occasions, FCPS advised staff not to put anything in writing and/or to change student and/or parent names to nicknames and/or initials. In order for a record to be responsive via FERPA or FOIA, if it is related to a specific person, the information within the record must be personally identifiable to the point that it can’t possibly be confused as someone else’s. Hence records in which names are changed to initials, nicknames, and other identifiers can’t be confirmed to be about one specific person, and won’t come up in FERPA and/or FOIA searches.

What Does Case Law Tell Us About Inadvertent Disclosure and Using Privilege to Hide Records?

In Anaya v. CBS Broad., Inc., 251 F.R.D. 645, 650 (D.N.M. 2007) the Court determined:

“‘The mere fact that an attorney was involved in a communication does not automatically render the communication subject to the attorney-client privilege.’ Motley v. Marathon Oil Co., 71 F.3d 1547, 1550–1551 (10th Cir.1995)…. Channeling work through a lawyer rather than having non-legal personnel perform it does not provide a basis for claiming attorney-client privilege…. Including an attorney as a ‘cc’ addressee or on the distribution list of an interoffice e-mail communication sent to several people does not transform the e-mail into a privileged attorney-client communication. See In re Gabapentin Patent Litig., 214 F.R.D. 178, 186 (D.N.J.2003).”

As head of a department that handles legal issues on a daily basis, Strong should have known that 1) merely adding FCPS’ lawyer to her October 6, 2019, email didn’t make it privileged and 2) taking such an action was a bad faith attempt to withhold information. She should have known that her action doubled as proof that FCPS’ claims of privilege cannot be taken as being in good faith, or accepted at face value. Unfortunately, FCPS’ bad faith actions didn’t stop with Strong. For years, other staff members intentionally took actions to, or trained others to, prevent disclosure of records that should have been released via FERPA and/or FOIA requests.

In the Supreme Court of Virginia Case Angela Walton v Mid-Atlantic Spine Specialists, P.C., et al, the Court stated the following:

“While the attorney-client privilege serves a very important function in the administration of justice, it is subject to waiver, and the holder of the privilege is responsible for exercising reasonable caution to ensure that the privilege remains intact. For the proponent of the privilege to enjoy the benefits of the privilege, he or she must also bear the burden of taking sufficient measures to safeguard privileged documents.”

Has FCPS and/or FCSB taken “sufficient measures to safeguard privileged documents”?

No.

For years FCPS has failed to take sufficient precautions to prevent inadvertent disclosure. Listed below are the failures that I’m aware of, which relate to my own kids and others. There are parents who are afraid of speaking up, so this is in no way a comprehensive list.

June 10, 2016

In response to a 6.10.16 FERPA request I submitted, FCPS failed to take sufficient precautions to prevent inadvertent disclosure and provided me PII related to two students.

VDOE later advised me that I couldn’t file a FERPA-related complaint for students other than my own. VDOE did not initiate an investigation.

July 21, 2016

In response to a 7.21.16 FERPA request I submitted, FCPS failed to take sufficient precautions to prevent inadvertent disclosure and provided me PII related to two staff members.

VDOE later advised me that I couldn’t file a FERPA-related complaint for students other than my own. VDOE did not initiate an investigation.

February 17 and February 28, 2017

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when an FCPS teacher bcc’d her husband on two emails, on two different dates, that contained confidential PII for one of my kids.

I filed a state complaint with VDOE. VDOE found FCPS in noncompliance. After the finding of noncompliance, FCPS failed to stop the noncompliance and VDOE failed to monitor FCPS to ensure the noncompliance had ceased. Hence, neither ensured FCPS was taking sufficient precautions to prevent the inadvertent disclosure of records.

March 17, 2017

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when an FCPS employee disclosed PII for a student and then refused to provide the parent the name of the individual to whom he provided the student PII.

Yet, Code of Virginia § 22.1-287.02 states:

“In cases in which electronic records containing personally identifiable information are reasonably believed by the Department of Education or a local school division to have been disclosed in violation of the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g) or other federal or state law applicable to such information, the Department or local school division shall notify, as soon as practicable, the parent of any student affected by such disclosure, except as otherwise provided in § 32.1-127.1:05 or 18.2-186.6. Such notification shall include the (i) date, estimated date, or date range of the disclosure; (ii) type of information that was or is reasonably believed to have been disclosed; and (iii) remedial measures taken or planned in response to the disclosure.”

June 7, 2017

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when an FCPS teacher emailed a FCPS principal and stated that he’d “heard through the grape vine” information about my family. Although neither the teacher nor the principal were in the same region—and, although grapevines wouldn’t exist if FCPS was taking sufficient precautions to ensure the implementation of FERPA and prevent the inadvertent disclosure of records—the principal responded that she wanted to connect with the teacher.

June 8, 2017

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it provided me PII related to nine students in its response to a 6.8.17 FERPA request I submitted.

See: FERPA Violation: Silverbrook Elementary School Students’ Privacy Violated; Behind the Scenes, Choosing Students to “Enrich”

June 29, 2017

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it provided me PII for a family that submitted a complaint to VDOE.

October 13, 2017

I emailed FCSB about FCPS’ failure to take sufficient precautions to prevent inadvertent disclosure. Elizabeth Schultz was the only board member who responded. She replied:

"Thank you for taking the time to email and document your concerns. I understand how frustrating many of these circumstances can be and look forward to getting the appropriate staff involved to review the issues to date and make a determination of the necessary plan going forward."

October 27 and October 31, 2017

On 10.27.17, I emailed Superintendent Scott Brabrand about FCPS’ failure to take sufficient precautions to prevent the inadvertent disclosure of records. On 10.31.17, Chief Academic Officer Francisco Duran responded. He replied:

"Staff within the Department of Special Services are aware of two situations . . . We believe these two incidents to be isolated in nature and not indicative of a systemic problem related to confidentiality. However, in response to these two events, we will be developing tighter procedures around division wide FERPA practices as well as initiating additional training on the requirement to maintain student confidentiality.”

That same day, I responded to Francisco, letting him know he'd been misinformed. He never responded.

December 11, 2017, and January 17, 2018

FCPS admitted it had concerns about FCPS’ ability to take sufficient precautions to prevent inadvertent disclosure. In an internal FCPS document titled "Hot Topics", dated December 11, 2017, and which covers the 2015-17 fiscal years, FCPS specifically stated:

“Confidentiality of student records is a significant concern across the division.”

Irony: Although “Hot Topics” admits FCPS’ own concerns related to its ability to prevent disclosure of student PII, when FCPS gave me a copy of “Hot Topics” in its response to a 1.17.18 FERPA request, it failed to redact student PII prior to providing me the record.

After FCPS provided me this record, I contacted SPPO and it echoed what VDOE previously advised me: Only the parents and/students whose information was disclosed can file a complaint. I pointed out that FCPS admitted it had concerns itself, but both SPPO and VDOE refused to investigate.

January 16, 2018

In response to a 1.16.18 FERPA request I submitted, FCPS failed to take sufficient precautions to prevent inadvertent disclosure and provided me PII related to two students.

January 17, 2018

In response to a 1.17.18 FERPA request I submitted, FCPS failed to take sufficient precautions to prevent inadvertent disclosure and provided me the “Hot Topics” record noted previously and a separate record with PII for a staff member taking medical leave.

January 29, 2018

Superintendent Scott Brabrand responded to Congresswoman Barbara Comstock’s inquiry that she submitted on my behalf in November 2017. Brabrand specifically stated to Comstock:

"Ms. Oettinger shared her concerns about the Family Education Act (FERPA) violations by several FCPS school-based employees. These issues were addressed with each employee by their supervisors, following FCPS protocol for employee discipline. In addition, staff from the Department of Special Services met with the school team to review the violations and to develop a plan to ensure these violations are not repeated."

Yet, in the “Hot Topics” document dated a month prior to Brabrand’s response to Comstock—and provided to me in an unredacted form less than two weeks prior to Brabrand’s response to Comstock—FCPS admitted its own concerns about its ability to prevent inadvertent disclosure and exhibited this concern to be well founded by providing me the “Hot Topics” document.

The years of noncompliance that followed proved that whatever plan the Department of Special Services developed to "ensure these violations are not repeated" didn't work.

November 7, 2018

I met Superintendent Brabrand in person at his office. I advised him that, as of that date, FCPS violated my kid’s privacy and violated the privacy of over 30 students and staff when it provided me their PII in responses to FERPA and/or FOIA requests, even though I didn't request such information.

Brabrand replied, "I don't know about that," and then said his team advised him it was more like two. I told Brabrand he’d been provided false information and handed him a copy of the “Hot Topics” record for his keeping.

2019

FCPS failed to take sufficient precautions to prevent inadvertent disclosure and provided a FCPS parent PII for 12 students.0

See: FERPA Violation: Longfellow Middle School Students’ Privacy Violated - Special Education Action

May 31 and June 4, 2019

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when an FCPS teacher emailed PII related to one of my kids to Ms. Davis at Fairfax County Federation of Teachers (FCFT).

June 2 and June 7, 2019

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when the same teacher who emailed PII related to one of my kids to FCFT emailed PII related to one of my kids to her personal computer.

Yet, according to FCPS’ regulation 6410, employees are not permitted to use their personal emails or devices to carry out their job duties.

August 2019

FCPS failed to take sufficient precautions to prevent inadvertent disclosure of records when a teacher’s child took a picture of a record containing PII and posted it to social media.

After I complained to FCPS, Assistant Superintendent Jay Pearson emailed me the following:

“I personally visited the school yesterday to address this issue. While there is an explanation as to how [redacted] was shared inappropriately, it is not excusable and not an acceptable manner for [redacted] to be shared. There will be a staff training in September on privacy and confidentiality of student information."

October 1, 2019:

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when a FCPS principal included the wrong person on an email that included PII related to one of my kids.

October 24, 2019

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it provided another parent a response to her FERPA request, which included 12 pages of records with PII related to one of my kids and 76 pages of records with PII for students other than her own. The principal who provided the records to the parent in this instance is the same principal who emailed the wrong person student PII related to one of my kids less than three weeks prior.

The principal emailed me at 7:25 pm about the breach and specifically stated:

"I am writing to inform you that I was alerted today by a parent who picked up documentation from my office, that within her documentation I mistakenly included a document that had identifiable information of [Student] within it. This was totally my mistake as I somehow picked up a document with [Student's] information on it and packaged it with the information for the other parent."

The parent contacted me via email about 30 minutes later, at about 8:04 pm, to 1) make me aware PII related to one of my kids had been disclosed to her; 2) that she had filed a FERPA request for one of her kids and FCPS provided 76 pages of records unrelated to her child, and 3) to advise me that she'd already contacted the school about the breach.

Although the principal characterized the disclosure as one record, the parent clarified it was more than one record and then provided proof by emailing me what was disclosed to her.

In addition, I contacted Superintendent Scott Brabrand about the disclosure.

Brabrand refused to respond to my emails, so I continued to send them and included FCSB members on them.

On November 1, 2019, FCSB member Karen Corbett Sanders emailed the following directly to Brabrand and FCPS in-house lawyer John Foster:

“Someone needs to respond to Ms. Oettinger re: the complaint below. Is this a factual representation? Were here [sic] son’s files shared with another family? If so, how and what are we doing to rectify the situation. We need to be diligent in how we address these issues. Additionally, guidance from legal needs to be sent immediately to the board on how they should treat this correspondence.”

Brabrand responded to Corbett Sanders the same day:

“We will respond. We did inadvertently share some information with another parent. We are reviewing our process and will provide an update next week. John will send language to the board this afternoon.”

It was another week before Brabrand responded to me on November 8, 2019. His email response echoed his January 29, 2018, letter to Congresswoman Comstock. He stated:

“I am sorry to report that the school did make a mistake and unintentionally provided information about [REDACTED] to another parent. This is unacceptable and we apologize for the error. As a result, I have requested that school staff immediately receive additional training about FERPA. We take student privacy very seriously.”

FCSB member Karen Corbett Sanders responded to Brabrand’s email and my emails via an email directly addressed to Brabrand, FCPS legal counsel John Foster, and then-head of FCPS’ special education department Teresa Johnson. She stated:

“There has to be a better way of addressing these issues. Training is one part of the process the other is holding folks accountable when they fail to do what is expected. Please let me know how you plan on addressing these concerns going forward.”

Brabrand responded with a “Will do” to Corbett Sanders—even though the previous year Brabrand told Comstock that a plan had been developed. I don’t know if he ever provided Corbett Sanders a plan, but if he did, the years of inadvertent disclosures that followed prove that any plan created didn’t work.

April 8, 2020

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when yet another FCPS principal disclosed PII related to one of my kids.

April 23, 2020

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when an FCPS teacher sent a group email to parents of students receiving special education services. One of the parents made me aware of the release.

FCPS later argued that email addresses don’t include PII, hence it didn’t violate PII.

However, by providing each parent specific emails for other parents, it provided them the knowledge of what children were receiving special education services, which is something that is not supposed to be disclosed.

May 2020

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when a FCPS school created a public sign-up sheet that parents were required to use in order to schedule end-of-school year medicine pickup. The sign-up link was included in a public email to parents, thus anyone clicking on the link had access to a record including PII related to students taking medication.

See: Dear Silverbrook ES: A Public List of Students Who Take Medicine is Not a Good Idea

June 26, 2020

Jane Strong, director of the Office of Special Education Procedural Support, sent an email to FCPS staff that states:

"We need to have a meeting to discuss our FERPA procedures and consider whether we will change our SOP."

Jane helped develop the “Hot Topics” document years earlier, and had long known about FCPS’ years of failures to take sufficient precautions to prevent inadvertent disclosure.

August 2020

FCPS failed to take sufficient precautions to prevent inadvertent disclosure records when it provided a FCPS parent spreadsheets related to over two dozen students, which included information about students who have 504 Plans, students’ ID numbers, their classes, their grades, their gender, and their health conditions.

See: FERPA Violation: Willow Springs Elementary School Students' Privacy Violated

September 11, 2020

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it failed to prevent a ransomware attack. According to news reports, records were stolen from FCPS by a hacker, which is different from FCPS providing records to someone. However, in the case of the ransomware attack and all the other examples provided above and below, FCPS failed to take sufficient precautions to prevent the inadvertent disclosure of records. It knew it had a problem and just as U.S. Dept of Ed advised schools in 2016 to create a pandemic plan, schools knew ransomware attacks were on the rise.

June through October 2020

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when two of its law firms released PII related to students and staff on seven occasions within a four-month period.

See: Fairfax County Public Schools, Sands Anderson, and Blankingship & Keith Breach Privacy During Due Process

September through November 2020

FCPS allegedly provided staff FERPA training during this period.

Two staff members later stated that FCPS trained them to use initials and other personal identifiers instead of the names of students, to prevent the records from including PII.

Via a FOIA request, I obtained the following records, which FCPS claimed it used in the trainings: "FERPA Redaction Reference Guide", "FERPA: Frequently Asked Questions", and a FERPA training slideshow.

October 2020

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it provided a parent a link to numerous unredacted documents with PII related to over 70 students.

See: Robinson Secondary School Privacy Breach: FCPS Released Names, ID Numbers of Students Receiving Special Education

October 7, 2020

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when an FCPS procedural support liaison cc’d a parent on an email for another parent’s child. The email had an IEP termination letter attached.

See: FCPS Office of Special Education Procedural Support Has a History of Privacy Breaches

October 27, 2020

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it emailed me another FCPS family’s transcript for its due process hearing with FCPS.

November 9, 2020

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it released the name, ID numbers, and recommendations for students receiving special education at one of FCPS’ largest high schools.

See: Robinson Secondary School Privacy Breach: FCPS Released Names, ID Numbers of Students Receiving Special Education

February 23, 2021

The law firm Blankingship Keith billed FCPS for 1.5 of work that included researching the Special Education Action site to monitor it for disclosures. The bill specifically states:

"research Parent's blog in response to privacy complaints raised in order to confer with Client and John Cafferky on same."

Evidently, instead of having a plan in place to monitor disclosures, FCPS thought it a good use of money to pay lawyer Weasley Allen $245/hour to research this site.

May 6, 2021

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when Jane Strong emailed six documents related to a student, which contained PII related to a student, to individuals who should not have received them. The student whose PII was disclosed here is the same one who PII was disclosed October 27, 2020.

May 17, 2021

After I continued to file complaints with SPPO, one of its specialists contacted FCPS to address its failures to take sufficient precautions to prevent inadvertent disclosure.

However, even SPPO stepping in didn’t stop FCPS’ failure to take sufficient precautions to prevent inadvertent disclosures. Four days later it happened again.

May 21, 2021

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when an FCPS teacher projected PII related to students on her screen during a video call.

See: South County High School Breaches Student Confidentiality Again

June 2, 3021

The SPPO specialist who met with FCPS on 5.17.21, emailed me that FCPS was found in noncompliance and that FCPS assured her that FCPS staff had received FERPA training:

"We therefore find that the District take specific actions, these actions include training staff. Specifically, the District failed to obtain prior written consent before disclosing education records to another parent. We also have evidence that the District does not have a policy that would violate FERPA on a regular basis. The District has required school officials complete a FERPA training to ensure that the scope and limitations of FERPA are adhered to. The District completed such training on November 12, 2019, which satisfies the requirements of this Office. Concluding, this Office has received assurance from the District, therefore, we are closing the investigation as the District has completed the required corrective actions."

I advised the SPPO specialist that after she met with FCPS, it continued its failure to take sufficient precautions to prevent inadvertent disclosures.

June 24, 2021

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when a procedural support liaison sent PII related to a student to the wrong person. This wasn’t the first time FCPS did this with this person. Just two months prior, FCPS sent the same person an internal email between staff, in which FCPS admitted fault related to an Office for Civil Rights (OCR) complaint and how it would address it.

June 29, 2021

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it provided me PII related to thousands of students in its response to a 6.29.21 FERPA request I filed.

See: Fairfax County Public Schools Breaches Privacy of Thousands of Students; FERPA Noncompliance Continues

September 2021

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it emailed PII related to a student to a family other than the student’s.

See: Fairfax County Public Schools Violated Privacy of Chesterbrook ES Student and Family

September 10, 2021

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it released PII related to students within its response to a FOIA request and when it released what it alleged were “privileged” records within its response to the same FOIA request.

FCPS filed a lawsuit against me and fellow FCPS parent Debra Tisler. Although neither I nor Debra published PII related to students, FCPS released statements to the public that led people to believe we did and that student PII was a primary reason for filing the lawsuit.

Yet, in all the years FCPS failed to take sufficient precautions to prevent inadvertent disclosure of PII related to my kids, to my knowledge it never filed a lawsuit against anyone else on behalf of my kids.

In all the years FCPS failed to take sufficient precautions to prevent inadvertent disclosure of PII related to other students, and provided the PII to me (even though I never requested it), up until that point, FCPS had never filed a lawsuit.

In addition, in all the years I published redacted information about FCPS failing to take sufficient precautions to prevent inadvertent disclosure of PII related to students, FCPS never filed a lawsuit against me until that point.

During the October 22, 2021, hearing date, FCPS’ lawyer Ryan Bates stated he appreciated that student names had been redacted in advance of records being published, and then made it clear his concerns were related to what he considered “privileged” work product:

“As far as we can tell, and I believe as — as to what was posted on the website, I think it was less than 1000 was actually posted on the website. And from what we can tell, they redacted all of the student names, and we appreciate that. But there was a lot of information of the other type more so attorneyclient, work product that was not redacted. So I find that to be rather interesting. But it's -- it's -- it's important because it's an important sort of point of this case.”

While FCSB filing a lawsuit against us, I filed a state complaint against FCPS.

In its 11.26.21 letter of findings, VDOE stated the following:

". . . we are concerned that continuing complaints in this area could signal larger issues in the school division's response to matters concerning FERPA or an issue with insufficient training and/or procedures. Additional actions addressed through the state educational agency’s general supervision authority will be forthcoming."

To date, I have no knowledge of what the forthcoming actions were and/or if they were ever implemented.

After the finding of noncompliance, FCPS failed to stop the noncompliance and VDOE failed to monitor FCPS to ensure the noncompliance had ceased. Hence, neither ensured FCPS was taking sufficient precautions to prevent the inadvertent disclosure of records.

October 8, 2021

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when an FCPS central office staff member forwarded PII related to a student to the wrong family.

October 28, 2021

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when a FCPS high school emailed PII related to almost 60 students in a mail merge email to numerous parents. The email stating the parents were "in receipt of this letter because you indicated on the school health form that your child has an attention deficit or other mental health condition of concern."

2022

While parents continued to contact me about FCPS’ continued failures to take sufficient precautions to prevent inadvertent disclosure, none were willing to step forward and share the records as evidence supporting their claims. After FCPS sued me and Debra Tisler end of 2021, parents feared FCPS would sue them.

March 2023

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it released PII related to more than 70 students, listing their math and/or reading SOL scores.

October 17 to October 19, 2023

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it included PII related to over 35,000 students and other records within my own kids’ records.

I immediately filed complaints with U.S. Department of Education’s Office of Civil Rights (OCR) and Office of Inspector General (OIG), since neither FCPS, VDOE, nor even SPPO could stop the years-long disclosures. At the suggestion of an OCR lawyer, I subsequently filed a complaint with SPPO. Although VDOE has a responsibility to investigate credible allegations of noncompliance, even if a parent doesn’t make a complaint, to my knowledge it has yet to initiate an investigation into this matter.

October 30, 2023

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it emailed me and VDOE a record for another student that FCPS failed to fully redact.

VDOE stated it would address FCPS’ failure to fully redact the record. However, to date, and to my knowledge, VDOE has failed to address this issue with FCPS.

November 14, 2023

FCPS failed to take sufficient precautions to prevent inadvertent disclosure when it provided PII related to over a thousand students to a parent. Specifically, the high school emailed student report cards to a parent other than their own.

In the case Angela Walton v Mid-Atlantic Spine Specialists, P.C., et al. a letter from Angela Walton’s doctor inadvertently was provided to Walton’s counsel. After Walton’s counsel indicated intent to use the letter during trial, lawyers from the doctor attempted to block the use and/or distribution of the letter. The Court held hearings on the doctors’ motions to implement a protective order, which led to the following being included within its final decision:

“At the first hearing, the circuit court determined that disclosure has to be voluntary or there is not a waiver. If it's involuntary disclosure, there is not a waiver. If it's ... inadvertent or by mistake, if we show this to be inadvertent, then there can be a waiver, then we have ... Lois Sportswear[, U.S.A., Inc. v. Levi Strauss & Co., 104 F.R.D. 103, 105 (S.D.N.Y.1985) ], those factors.

the only logical inference ... is that Smart [Copy] copied according to their procedures and the medical records were provided to them and this document had to be commingled with them. I can't believe that Smart [Copy] went into a separate place to take a binder that was not authorized and copied it.”

According to the Supreme Court of Virginia’s decision in the Angela Walton case, a number of other hearings took place at the circuit court level, and ultimately that court decided the disclosure was involuntary instead of inadvertent:

“the doctors' motion, ruling that the letter was privileged, had been "involuntarily" disclosed, and there had been no waiver. The circuit court, in its ruling, stated: "And being involuntary by the fact that we don't know how [the letter] was disclosed, but we do know that Dr. Moore has indicated that he didn't give permission and he didn't provide it, and it was not in the records he had, and nobody knows how it got disclosed.”

In addition, the circuit court prohibited Walton from distribution of the correspondence and from mentioning it in the trial.

How did this circuit court decision come about?

During the trial, the doctor’s answers did not align with the letter in which he’d admitted culpability. Although the doctor remembered the contents of the letter when Walton and her lawyers still had it, once they were no longer allowed to use it in the trial, the doctor struggled with memory of events and ended with the jury finding in favor of the doctor.

Similarly, FCPS records included within my own kids’ educational records indicate FCPS has knowledge of noncompliance and that FCPS engaged in retaliation and employed unusual and unequal practices when making decisions related to students. Yet, year after year, FCPS has maintained to students, parents, staff, VDOE, hearing officers, and others that it is in compliance.

For example, FCPS’s Hot Topics report, which Jane Strong and Dawn Schaefer, the former head and current head of FCPS’, provided edits and input, admits:

“Confidentiality of student records is a significant concern across the division”.

Yet, FCPS repeatedly pushed out messaging stating it takes privacy seriously, was or had or would develop a plan, and so on, even though the disclosures continued.

More recently, after I found PII related to over 35,000 students within my own kids’ educational records, FCPS provided misleading information within its response to a complaint appeals officer, which could mislead it to believe the 35,000+ disclosure was a one off, a one-time event.

Another example:

The “Hot Topics” document states:

“Dyslexia and fidelity of instruction continue to be significant concerns across the division.”

However, FCPS has advised parents, students, staff, VDOE, and due process hearing officers otherwise.

One of my kids was proposed the same reading program four school years in a row, even though the publisher, Wilson, doesn’t endorse it for students who have Dyslexia. Yet FCPS staff continued to tell me and other parents division wide, who were experiencing the same, that the program was appropriate.

Yet, in the records FCPS included within my own kids’ educational records, I found two emails in which FCPS lawyers admit to staff that they know the program isn’t intensive enough for students who have Dyslexia, but that a staff member attempted to indicate otherwise to a previous hearing officer. In addition, one of the lawyer indicates that FCPS wants to testify in an upcoming hearing that the program is actually appropriate for some students who have Dyslexia.

In the Angela Walton case, the Supreme Court of Virginia ultimately determined that the circuit court erred as a matter of law in finding that the disclosure was involuntary instead of inadvertent:

“There was no evidence suggesting that the letter was knowingly produced by someone other than the holder of the privilege through criminal activity or bad faith, and the doctors do not argue that any criminal activity or bad faith was involved. All of the evidence indicates that the doctors mistakenly produced the letter, and therefore its disclosure was inadvertent, not involuntary.”

In every case listed above, with the exception of the ransomware case, FCPS voluntarily disclosed unsolicited records to me and/or other parents.

In the last of the three cases previously mentioned, FCPS allegedly included the wrong person on an email, which allegedly led to that voluntary, yet inadvertent disclosure, of student report cards.

In the second to last of the cases previously mentioned, FCPS was responding to a state complaint. It claimed its complaint response was late because it was redacting records. And yet, when it voluntarily emailed me and VDOE its late information—which it had allegedly been redacting—it failed to fully redact a record. The record wasn’t accidentally sent as in the case of the report cards mentioned previously. FCPS intentionally and voluntarily emailed me and VDOE. It simply failed to redact the record in full even though it allegedly has an entire system in place regarding disclosure of records.

In the third to last of the cases previously mentioned—the one in which FCPS included PII related to over 35,000 students, as well as other records, within my kids' records—FCPS voluntarily disclosed the records to me, even though 1) FCPS had months to ensure the records were, indeed, my kids’ educational records; 2) I didn’t request records other than my kids’ educational records; and 3) I repeatedly asked FCPS to confirm that it was providing me access to my kids’ educational records.

In addition, I went out of my way to ensure the records it was providing were my kids’ educational records as defined by IDEA. The following is a timeline of what led to my in-person review and of all the opportunities FCPS had to ensure it was taking sufficient precautions to prevent inadvertent disclosure.

For years, FCPS refused me access to in-person review of my kids’ educational records, even though it provided in-person access to other parents, and on at least one occasion I helped a parent review her student’s records in person. In addition, for years it ignored my complaints that records it had provided digitally were saved wrong and/or were inaccessible.

May 18, 2023

I filed a state complaint focused on FCPS’ refusal to provide access to inspect and review my kids’ records, its withholding of records, and its noncompliance with FERPA.

May 30, 2023

VDOE issued a Notice of Complaint (NOC) marking the opening of its investigation into my complaint.

July 17, 2023

VDOE issued a Letter of Findings (LOF). FCPS had failed to respond to the complaint, so VDOE found FCPS in noncompliance and stated FCPS had “within 30 days of the date of these findings” to all me “an opportunity to complete an in-person record review.”

In the analysis of its findings, VDOE stated,

“Complainant correctly notes that our Complaint Resolution Procedures provide that, if a response is not provided by the designated response date, the school division should be provided with notice that if the response is not received within seven days, the matter will be referred to the Superintendent of Public Instruction for review regarding appropriate sanctions. This letter of findings and subsequent corrective action taken by the department to address timely communication with local school divisions regarding complaints will be elevated to the Superintendent of Public Instruction.”

In addition, VDOE stated,

“Over the past several years, we have addressed a number of complaints involving LEA’s handling of student record confidentiality and parent access to student record, resulting in findings of compliance in some instances, and of noncompliance in others. . . . However, our jurisdiction is limited to students with disabilities, and thus, our ability to address what appears to be a division-wide lack of understanding of these fundamental principles is limited. In other words, our office does not have the ability to require division-wide corrective action addressing the full reach of FERPA. It is worth noting that VDOE has offered assistance to the LEA in several instances through outreach of individuals designated by previous Superintendents of Public Instruction.”

August 29, 2023

I was scheduled to start the inspect and review. After I arrived, it was clear FCPS wasn’t providing me access to all of my kids’ educational records. There were too few records in the room to cover over 15 years of having two kids enrolled in FCPS.

I left and advised FCPS to let me know when it would provide me access to an inspect and review of all records, and I’d come back. I wanted to do everything at once.

September 5, 2023

FCPS appealed VDOE’s decision and on September 5, 2023, Complaint Appeal Reviewer Cecil Creasey provided his appeal decision. Creasey upheld VDOE’s decision that FCPS was in noncompliance regarding access to student records. In addition, he characterized the divisions argument as “disingenuous”:

“The school division provides no authority to support its contention that it can fail to comply with the investigation steps and use that failure as a sword to argue that VDOE did not make an investigation. By any measure, such an argument is disingenuous.”

However, in regard to VDOE’s systemic finding, Creasy remanded the issue back to VDOE. He stated that “the investigation of the systemic practices was factually incomplete and, thus, constitutes an error of fact.”

Creasey’s characterization of FCPS’ argument as “disingenuous” echoes Judge Gardiner’s 2021 characterization of FCSB’ argument as “almost frivolous”. In 2021, Gardiner specifically stated:

“Now, the Board makes what I think to be almost a frivolous argument when they say, Well, it wasn't the individual board members who made the decision; it was their -- it was an employee or their agent. But that, in my view, makes absolutely no difference at all. They were the ones -- the Board were the ones who gave that duty to that person, and they are bound by what that employee did.”

On both accounts, FCSB attempted to blame someone else rather than take responsibility for its failures.

October 16, 2023

I was supposed to start the inspect and review this day, but because FCPS refused to provide me a simple yes or no to my direct question about whether it was providing access to my kids’ records as defined by FCPS, I didn’t start the inspect and review. FCPS and I went back and forth via email and toward the end of the school day, FCPS finally provided me a “yes”.

October 17-19, 2023

I did an inspect and review on and off during these three days.

I was specifically looking for meeting recordings that I’d complained to FCPS and VDOE about for years. I repeatedly told FCPS and VDOE that there was something wrong with the recordings and that I couldn’t access them. FCPS repeatedly stated the records were accessible and then it ignored me. After I filed a complaint, FCPS advised VDOE that the records worked and VDOE believed FCPS based on testimony, without any actual evidence.

With the help of the FCPS paralegal in the room with me, I found recordings I was looking for and he tried to open them after I was unable to open them. He called in an FCPS IT tech after he couldn’t open them either. The FCPS IT tech stated that 1) a quick look at the 1 KB file size indicated that the files couldn’t be recordings and 2) that the files, which has xspf extensions, were saved wrong.

For another recording, which I hadn’t been provided previously, every time I tried to save it to a thumb drive I brought with me, there was a problem. The FCPS paralegal tried to trouble shoot the issue with me, but was unsuccessful. The FCPS IT expert said he couldn’t use a thumb drive brought in from someone outside the school, so I removed my thumb drive and he used a FCPS thumb drive to attempt to save the record. After he figured out the problem, he watched as I saved the recording to my thumb drive. This took the majority of the time I was there the first two days and beginning of the third day. On the last day, I copied FCPS thumb drives and discs that were supposed to be FERPA responses to FERPA requests I made through the years. I’d lost some of those FERPA responses due to computer issues through the years, so I made copies of those files while looking through paper records. The paralegal helped me move boxes around so I could pull out paper records as the computer FCPS provided me to use saved the digital records.

At one point I saw a paper record that wasn’t fully redacted, but since 1) the majority was related to one of my kids; 2) the unredacted info was benign; and 3) my experience is that if you don’t document that something happened, FCPS will deny it, I copied the record and planned to address it later with FCPS.

After years of FCPS disclosing records, I expected FCPS to mess up. It's failures, at this point, are more rule than exception.

October 19, 2023

VDOE issued its remand findings and stated that FCPS didn’t actually issue a systemic finding and that its concerns had been satisfied:

“. . . we did not make a systemic finding as such. Rather, we imposed broad corrective action, as we had made several individual noncompliance findings regarding the school division’s implementation of the requirements of FERPA over recent years. In other words, because we saw ongoing concerns in individual instances, we believed that there was a need for the school division to take more robust action to ensure sustainable compliance. Because, in its September 27, 2023, submission, the school division described the steps it has taken, as well as steps planned for the near future regarding the confidentiality of and access to student records, we find those concerns have been satisfied, and we make no additional finding on a systemic basis.”

What’s interesting is that somehow VDOE went from having concerns that were so significant that it was requiring corrective actions of FCPS to stating a submission from FCPS addressed its concerns.

Irony: On the day VDOE issued its remand finding, I was doing the in-person inspect and review that led me to realizing FCPS included PII related to over 35,000 students, as well as other records, within my own kids’ records.

November 21, 2023

I appealed VDOE’s remand decision and stated that FCPS’ FERPA noncompliance was at the systemic level and cited the case of finding PII related to over 35,000 students and other records within my kids’ educational records.

On November 21, 2023, FCPS submitted its response to my appeal to hearing officer Cecil Creasey. In its response to my appeal, FCPS stated that “At most, she has offered of a single instance of what appears to be human error that occurred in the context of an in-person review of records ordered by VDOE—which was outside the typical electronic document production that FPCS [sic] employs.”

Yet, FCPS knew that 1) it had been inadvertently disclosing records for years and 2) that on October 30 and November 14, between the inspect and review, FCPS disclosed PII related to thousands of other students. FCPS refused to disclose this information to the appeals officer.

FCPS voluntarily gave me the records after having months to pull everything together – and after seven years of noncompliance and after five years of me filing complaints related to the noncompliance.

In its decision regarding the Walton case, the Supreme Court of Virginia examined and made a clear decision regarding waiver of privilege:

“Once the trial court determines that a disclosure of one or more communications is inadvertent, it must then determine whether the attorney-client privilege has been waived for the items produced. In cases of inadvertent disclosure of a document protected by the attorney-client privilege, we adopt the multi-factor analysis set forth below, requiring the court to assess whether the holder of the privilege or protection took reasonable steps to prevent disclosure and promptly took reasonable steps to rectify the error. This approach avoids the extremes, see New Bank of New England, 138 F.R.D. at 482, of an across-the-board rule of waiver when a communication has been produced, an approach often attributed to Dean Wigmore,^[4] or a blanket "no waiver" rule which would hold that negligence by counsel or a producing party can never constitute waiver for lack of clear and intentional decision to waive protections. Id.

"Under the standards we now adopt, waiver may occur if the disclosing party failed to take reasonable measures to ensure and maintain the document's confidentiality, or to take prompt and reasonable steps to rectify the error. See id. at 482. This approach balances concerns of fairness and the fundamental importance of protection of the privilege long recognized in Virginia law "against the care or negligence with which the privilege is guarded." Lois Sportswear, 104 F.R.D. at 105. Under this approach, the following factors are to be included in the court's consideration: (1) the reasonableness of the precautions to prevent inadvertent disclosures, (2) the time taken to rectify the error, (3) the scope of the discovery, (4) the extent of the disclosure, and (5) whether the party asserting the claim of privilege or protection for the communication has used its unavailability for misleading or otherwise improper or overreaching purposes in the litigation, making it unfair to allow the party to invoke confidentiality under the circumstances. See, e.g., Koch v. Cox, 489 F.3d 384, 390 (D.C.Cir.2007) (considering whether the party asserting privilege seeks to employ that privilege both as a sword and as a shield, and thereby to gain litigation advantage); United States v. Desir, 273 F.3d 39, 45 (1st Cir.2001) (considering unfairness of allowing invocation of the privilege when a party testifies about portions of a communication or selectively asserts protections, because the "privilege cannot be used as both a shield and a sword"); United States v. Workman, 138 F.3d 1261, 1263-64 (8th Cir.1998). Thus, there may be "a determination that the privilege holder's conduct makes it unfair to allow subsequent assertion of the privilege." United States v. Yerardi, 192 F.3d 14, 18 (1st Cir.1999) ("Probably the most common example is a privilege holder's effort to answer some questions in a subject area (usually those that serve the privilege holder's interests) but not others (those that harm the privilege holder's interest). Such a pick-and-choose approach may seem unfair in general or because it distorts the evidence that is presented to the factfinder"). See Developments in the Law — Privileged Communications, 98 Harv. L.Rev. 1450, 1629-31 (1985).”

If applied to the records FCPS included within my own kids’ educational records, these five factors apply as follows:

For the first and second, the examples shared above provide ample evidence that for years FCPS failed to take precautions to prevent inadvertent disclosures and failed to rectify the errors, carelessness, and other issues causing the noncompliance. Just as in the Walton case, FCPS did not take sufficient efforts to prevent intermingling of my kids’ educational records with other records, even though it had months to examine the records it was providing me to inspect and review.

In addition, the records in the case at hand overlap with records FCPS disclosed in 2021, but which it later tried to pull back, saying they were privileged. In both cases, FCPS failed to redact PII for students involved in a restraint and seclusion case and/or Jane Does involved in sexual assault cases, even though FCPS was supposed to maintain their privacy and prevent disclosure of their information. Hence, in the case of these students, it failed to prevent disclosure in 2021 and again in 2023. In addition, in 2023 FCPS included PII related to a student whose PII it provided me almost five years prior. Just as I did previously, I spoke with the parent, both of us in shock that FCPS failed so horrendously that it disclosed unsolicited PII related to the same student to me almost five years apart. That student graduated two years ago, which led to the parent and I discussing our concerns regarding FCPS disclosing PII related to our kids for years to come, to include even a decade or more in the future when, depending on the type of record disclosed, our kids' work and families could be negatively impacted.

For the third, scope of discovery, as with the Walton case, there was no expedited or extensive work needed. FCPS is required to maintain records in a certain manner and has repeatedly stated it does so. Hence, it should have simply been a matter of putting the records in one location for my review.

For the fourth, extent of disclosure, as with the Walton case, privilege is permanently destroyed because records have been included in complaints filed with federal and state agencies, records have been provided to the families and/or lawyers connected to students whose information was disclosed, records have been published by multiple online sites and social media channels, and various online postings indicate the public has downloaded records from this site.

For the fifth, interests of justice, as shared above, FCPS has used the unavailability of the records for “a misleading or otherwise improper or overreaching purpose, making it unfair under the circumstances” to allow FCPS to invoke confidentiality.

In the case of the reading program, FCPS’ failure to address the reading needs of its students is reflected in reading scores publicized nationwide. FCPS’ decline started in 2017, well before COVID, yet it insisted to parents and others that it was providing FAPE, even though it knew it had significant problems with identification of students who have Dyslexia and with fidelity of implementation.

In the case of the recordings FCPS insisted it provided me in an accessible format, the false information FCPS provided VDOE – which VDOE took as truth instead of investigating — resulted in 1) me losing the state complaint, 2) me not being provided access to educational records, and 3) me being unable to advocate for my kids because I wasn’t provided access to records I needed in the course of my advocacy. Due to timelines related to different types of complaints, I face time baring because the information was withheld previously.

In the case of independent educational evaluations (IEE), as another example, FCPS knew its IEE fee rates were below market rate, but refused to pay market rate anyway. In addition, they acknowledged that they made decisions related to parents’ IEE requests according to the parent and not according to IDEA and implementing Virginia regulations. Other examples can be provided, too.

In addition, it actively trained staff to change student and parent names to initials, nicknames, and/or other identifiers to prevent the records from being identified as responsive to FERPA and/or FOIA requests. Then there’s the email mentioned at the beginning of this article, in which Jane Strong stated she was taking the bad faith action of including a lawyer on the email just to make the email privileged.

As with Walton, by suppressing such records, FCPS has been allowed to engage in practices that can and/or have misled complaint investigators, hearing officers, staff, parents, and students.

In spite of all of this, FCPS wants to put everything back in a box, just as it did in 2021—and just as, to my knowledge, it did not do on any other occasion on which it inadvertently disclosed information between 2016 and 2023.

In the case of the Charlotte Observer, 921 F.2d 47 (4th Cir. 1990) the United States Court of Appeals for the Fourth Circuit, looked at the question of whether two reporters could be barred from disclosing “the name of an attorney, who had been identified in open court and in the presence of or the two reporters, as a target of an ongoing grand jury investigation.”

In its decision, the court looked at prior restraint and decided the following:

“... because the attorney's name was revealed in open court, we conclude that the issue has already been decided by the United States Supreme Court in a number of prior restraint cases. See Oklahoma Publishing Co. v. District Court, 430 U.S. 308, 97 S.Ct. 1045, 51 L.Ed.2d 355 (1977); Nebraska Press Assoc. v. Stuart, 427 U.S. 539, 96 S.Ct. 2791, 49 L.Ed.2d 683 (1976); Cox Broadcasting Corp. v. Cohn, 420 U.S. 469, 95 S.Ct. 1029, 43 L.Ed.2d 328 (1975), and Sheppard v. Maxwell, 384 U.S. 333, 86 S.Ct. 1507, 16 L.Ed.2d 600 (1966). In Nebraska Press Association, the Court outlined the long history of the problems presented by the conflict between a defendant's constitutional right to a fair trial before an unbiased jury and the constitutional guarantee of freedom of the press. In discussing prior decisions in Nebraska Press, the Court noted:

“The thread running through all these cases is that prior restraints on speech and publication are the most serious and the least tolerable infringement on First Amendment rights. A criminal penalty or a judgment in a defamation case is subject to the whole panoply of protections afforded by deferring the impact of the judgment until all avenues of appellate review have been exhausted. Only after judgment has become final, correct or otherwise, does the law's sanction become fully operative.

“A prior restraint, by contrast and by definition, has an immediate and irreversible sanction. If it can be said that a threat of criminal or civil sanctions after publication "chills" speech, prior restraint "freezes" it at least for the time.

“The damage can be particularly great when the prior restraint falls upon the communication of news and commentary on current events. Truthful reports of public judicial proceedings have been afforded special protection against subsequent punishment . . . for the same reasons the protection against prior restraint should have particular force as applied to reporting of criminal proceedings, whether the crime in question is a single isolated act or a pattern of criminal conduct.”

In addition, the court underscored that once the veil was lifted, it was unrealistic to believe replacing the veil would stop disclosure of whatever resides underneath:

“Once announced to the world, the information lost its secret characteristic, an aspect that could not be restored by the issuance of an injunction to two reporters. The district court injunction applied only to the two reporters and not to others who may have obtained the information from some collateral source. Moreover, the attorney, whose name was inadvertently mentioned in open court, in all probability was aware that he was a target of the investigation because such targets are often notified by letter from the United States Attorney, and this would be expected when the target is a practicing attorney.

“To enjoin the press from publishing the name of the person identified in open court as a target of a grand jury investigation is the type of prior restraint condemned in Nebraska Press. Once the name has been made public in open court, the First Amendment protection of a free press comes into play. On the present record where only a target's name has been mentioned, Federal Rule of Criminal Procedure 6(e)(3)(C) is not strong enough to resist the force of the First Amendment.”

In 2021, Judge Gardiner came to a similar conclusion regarding the First Amendment protection of freedom of the press once the record was made public. Gardiner specifically stated that the records were obtained lawfully in response to a FOIA request and that they have public significance:

“it’s clearly also about a matter of public significance because this has to do with legal bills that are being paid by the taxpayers of Fairfax County. And while it’s not a matter of something like the Pentagon papers where we’re talking about the war in Vietnam, certainly it’s a matter of public significance as to what the taxpayers – what bills the taxpayers are having to absorb.”

In addition, he stated:

“And with regard to the public interest, I don't think there's any question in this case that it's in the public -- this is in the public interest. What we're doing here is -- what the defendants are doing is enforcing their rights under the First Amendment, and those rights, enforcing their rights under the First Amendment, is about as high in the public interest scale as you can get.”

Final Words

Both FCPS and VDOE had years to take sufficient actions to prevent inadvertent disclosures and to engage in good faith actions allowing parents, students, and educators access to all information, so they could make informed decisions.

Perhaps the action of making the public aware of FCPS systemic disclosure problems, and perhaps providing previously withheld information to parents, staff, students, and state and federal agencies, will help change the years-long reality FCPS engaged in and VDOE enabled.