Children are our priority. Ensuring their needs are met is our goal.
Fairfax County Public Schools, Sands Anderson, and Blankingship & Keith Breach Privacy During Due Process
Fairfax County Public Schools (FCPS) and two law firms with which it works, Sands Anderson and Blankingship & Keith, failed to secure personally identifiable information on seven occasions in just a four-month period during 2020.
During this period, four due process complaints were filed on behalf of four different children. Their parents requested that their children’s full records be provided. They didn’t request unredacted information about other children (or adults). However, that’s what they received.
This one is related to a due process complaint I filed.
Between the time I filed the complaint and when the hearing officer submitted her final decision, the following breaches occurred:
Blankingship & Keith lawyer Wesley Allen sent me thumb drives that supposedly held my son’s complete record. He later recalled the thumb drives because he said the included unredacted information about other students.
Blankingship & Keith lawyer Wesley Allen contacted me about a student who is not one of my children.
Blankingship & Keith provided personal home addresses, emails, and phone numbers for FCPS staff.
FCPS’ Dawn Schaefer forwarded me a transcript for another family’s due process pre-hearing conference.
If you’ve been following along with this blog, you know confidentiality breaches are a major concern of mineâ€”and that I’m a bit of a magnet when it comes to them. Since 2016, FCPS has provided me personally identifiable information for almost three dozen FCPS students, FCPS families, and FCPS staff, to include an internal document listing children, their lawyers, medical history, and so on.
For this reason, I expressed my concern about privacy breaches to Hearing Officer Rhonda Mitchell.
I was concerned that if I provided more information to FCPS and its lawyers, that it would only serve to provide them more confidential information that they could potentially breach.
The timeline below tracks Hearing Officer Rhonda Mitchell’s solution to addressing my concerns and the breaches that followed.
I emailed Mitchell and specifically stated:
“I remain concerned by the repeat confidentiality breaches. FCPS just canâ€™t seem to help itself when it comes to violating the privacy of my family- particularly my son.”
“We can discuss the issue of confidentiality on the next conference call. If you discover a breach regarding this case before the next call and think we need to have an earlier call, please let me know.”
I emailed Mitchell:
“Iâ€™ve been thinking about this and I would like to have a conversation in advance.
“FCPS has violated my sonâ€™s privacy so many times, that waiting to see if they do the same again during this hearing isnâ€™t an option.
“In a recent due process hearing for which you were the hearing officer they breached the privacy of a number of students, so I know this could happen again to my own son.”
Mitchell responded to my 9.7.20 email:
I have no objection to having another conference call before the 21st.
Later that day, she issued a formal notice for a second pre-hearing conference and included “confidentiality” as a topic for discussion.
Side note: The above document’s metadata associates it with the U.S. Army and an author who is not the hearing officer. As of this writing, Virginia Hearing Officer Rhonda Mitchell has not responded to questions requesting she address the U.S. Army connection and the individual with whom she shared my son’s information. The metadata appears below.
After the 9.11.20 pre-hearing conference, during which we discussed my concerns related to privacy, Mitchell released a pre-hearing report that states the following:
“During the September 11th conference call, Ms. Oettinger expressed concern regarding the handling of [redacted]’s records and a possible breach of confidentiality by FCPS and their counsel. She provided several examples of former confidentiality and privacy breaches for which FCPS had been cited as being in noncompliance due to error or negligence. Apparently student records, including [redacted]’s records, had been forwarded to the wrong party(ies) in the past. This alleged pattern of breach is of concern to the Hearing Officer.
“Counsel for FCPS recommended that the records be received and held under the shield of a protective order. The Hearing Officer accepts this recommendation. Accordingly, counsel for FCPS is hereby directed to promptly draft a protective order for entry by the Hearing Officer. The protective order will be designed to maintain confidentiality and insure privacy of any and all documents related to [redacted] that are either held by or received by FCPS or their counsel.”
Wesley Allen submitted the protective order he drafted.
Four days after submitting the protective order, Wesley Allen e-mailed me about Sam, even though there is no Sam in my family.
Blankingship & Keith’s courier taped a large white envelope to my red doorâ€”even though I previously stated that my son’s information was not to be left in an unsecure location.
It remained there for hours, visible from the street, standing out like a unicorn in a bull fight. Not exactly the definition of securing private records.
The envelope contained thumb drives that supposedly had all of my son’s records on them.
One week after the protective order was put in place and two days after Blankingship & Keith couriered the thumb drives to me, another pre-hearing conference was held.
During the call, Wesley Allen stated that he wanted the thumb drives returned because they included unredacted information.
He asked, too, that I be prevented from “broadcasting” this information. I responded, stating that the protective order didn’t say anything about me being prevented from sharing that another breach occurred. The hearing officer did not state or later distribute an order preventing me from sharing that another breach occurred.
When asked about the breach, Wesley said he was just a “conduit” for the information, even though the thumb drives were put in a Blankingship & Keith envelope, which a courier Blankingship & Keith used later taped to my door, rather than securing the private information as requested.
Hearing Officer Rhonda Mitchell issued a “Fourth Pre-Hearing Order”. In it she admonished Wesley Allen for the privacy breach and stated:
The Hearing Officer is very concerned about this privacy breach by FCPS, particularly in light of petitioner’s on-going and repeated concerns about privacy.Â If FCPS has a history of such privacy breaches as alleged by petitioner, it should have been extremely careful to insure no privacy breach occurred when it delivered the information.Â In fact, with or without a history of privacy breaches, FCPS should be careful with student records and in no way breach a student’s privacy.Â
Â On the conference call, counsel for FCPS claimed to have only served as a conduit to get the information to petitioner.Â Conduit or not, counsel for FCPS is held responsible for the breach along with whoever assembled the information for delivery to petitioner.Â Counsel is representing FCPS in this case and should have insured that the information being sent under his firm’s cover did not include another student’s information.Â Counsel for FCPS is hereby admonished for the privacy breach.
Side note: The above document’s metadata associates it with the U.S. Army and an author who is not the hearing officer. As of this writing, Virginia Hearing Officer Rhonda Mitchell has not responded to questions requesting she address the U.S. Army connection and the individual with whom she shared my son’s information. The metadata appears below. In addition, the creation date for the document indicates that this might be a cut and past of an earlier document. *This is important to note. In future posts, I’ll share the hearing officer’s final decision for this due process hearing, which is a cut and past of large sections of a previous decision she wrote and issued, even though the students and their needs, circumstances and experiences are different.
1:09 PM: FCPS’ Dawn Schaefer emailed me a transcript for another family’s due process pre-hearing.
2:52 PM: Dawn sent an email, stating she wanted to recall the previous email.
2:56 PM: Dawn sent another email, which acknowledged the breach and terms of the protective order.
The Weeks that Followed
I know the family whose transcript was shared with me. I made the parents aware that FCPS had provided confidential information about their son to me and suggested they contact FCPS.
FCPS did not take proactive action to make the family aware of the breach. Instead, the parents had to approach FCPS to ask if there was a breach and what information was breached.
The response they were given cited the protective order related to the due process complaint I filed.
The parents had to point out to FCPS that a protective order in place for another student doesn’t waive FCPS’ responsibility to make the parents aware of breaches related to their own child.
The parents had to request exactly what was breached, when it was breached, and a copy of what was breached. At no point did FCPS offer any of this information without first being asked about it.
In addition, Wesley Allen advised the parents that, for their upcoming hearing, “so as to avoid unreasonably sharing confidential personnel information for its employees, FCPS will produce resumes/CVs for anyone scheduled to testify at the Hearing”, whereas in the past, resumes/CVs were provided in full to parents.
Makes one wonder what else is occurring, about which parents remain unaware.