Transcript Data Use Power Point

FERPA Rules:
Maintaining the Security and
Privacy of Student Data
West Virginia Department of Education
Carla Howe, Ph.D.
August 4, 2014
Introduction
• You have access to data tools that allow you to
view individual student records for performing
your official duties.
• You are legally and ethically obliged to safeguard
the confidentiality of these student records.
• There are many tools for exploring data; those
that access student-level data must be secured.
• The purpose of this presentation is to inform you
of your responsibilities to protect student privacy.
Responsibilities
• Protect the privacy of students and the
confidentiality of student data.
• Comply with state and federal laws, and
district policy, to maintain the confidentiality
of student data.
• Use confidential student data only as
necessary for legitimate educational purposes.
• Keep your password confidential.
Consequences
• Student education data may not be released
except under specific circumstances.
Improper release of these data expose you
and your district to potential criminal and
civil liability, and loss of federal funds.
• Student-specific information gathered from
secure tools may be shared only with
authorized school personnel.
Protecting
Confidential Information
• Be careful to prevent unauthorized people
from viewing your screen while you are
accessing confidential information.
• When you are finished with the data tools,
log off and close any windows containing
data or reports.
Sharing Reports
• Printed reports can be shared publicly only after
you’ve reviewed them to ensure that no student
could be identified from the report (for example,
in conjunction with other information that is
available).
• If a reasonable person from your community could
identify a student from a report, directly or
indirectly, then you should store that report in a
secure place. Share the report only with those with
a legitimate educational interest – as determined
by your school board, or district leadership.
Foundational Concepts Critical to
Data Training and Use
March 2014
What is FERPA?
Family Educational Rights and Privacy Act of 1974,
as amended (FERPA)
• Federal regulations that govern access to and
release of personally identifiable information
about students found in education records
• Applies to all schools that receive funds under
applicable programs of the USED
• Does not apply to private schools whose
students or teachers receive services from an
LEA or SEA, unless the private school also
receives federal funds
8
FERPA: Two Purposes
Access to
Educational Records
Limit on Disclosure
Parents &
Students
Prior Written
Consent
Authorized
Representatives
Consent
Exceptions
9
Annual notice of
FERPA rights
Schools must notify parents of their rights under
FERPA on an annual basis.
• Directory information designation
– What information does the entity designate as
directory?
• Location of records
• Right to inspect records, file a complaint,
consent to disclosure, amend records
• Military Recruiters
– Schools must provide recruiters with student name,
address, phone number and access to campus
10
Student Record
Information
• May be disclosed to the student with proper authentication
– Amended FERPA requires the use of reasonable methods to
determine the identity of intended and authorized recipient of
information AND authenticate or ensure that recipient is, in fact,
who he/she purports to be
• Parent Access Procedures
– Right to “inspect and review”
– 45-day timeline to provide the records
– May charge “reasonable fee” for copies, but not to search or retrieve
• Exceptions
– Letters of recommendation for which the student has waived the
right to review
– Information about other students
11
FERPA requires
Educational Providers to:
Educational
Providers
Protect student rights
Ensure that third parties do not
redisclose personally
identifiable information
Keep records of certain requests
and disclosures of student
education records
Notify students/parents of their
rights annually
State Education
Agency
Protect student rights
Ensure that third parties do not
redisclose personally
identifiable information
Keep records of certain requests
and disclosures of student
education records
12
Basic Concepts
• Education Record
• Directory Information
• Personally Identifiable Information
13
Education Record
Education Record
• A record which is maintained by the institution from which the student
can be identified (Directory Information)
• Directly related to a student
• Maintained by an educational agency or institution (or party acting on
behalf of the agency)
• For elementary and secondary level students
• Records maintained on special education students including records on
services provided to those students
EXCEPT: Records of School Personnel which are:
• Kept in the record maker’s sole possession
• Used only as a memory aid
• Not accessible or revealed to anyone except temporary substitute for
record maker
14
Directory information
Information in an education record of a student that would
not generally be considered harmful or an invasion of privacy
if disclosed
As defined in Policy 4350, Directory Information can include:
1.
2.
3.
4.
5.
6.
7.
8.
9.
Student's name
Address
Telephone listing
Email address
Photograph
Date and place of birth
Major field of study
Dates of attendance (for school)
Grade level
10. Participation in officially
recognized activities and sports
11. Weight and height of members of
athletic teams
12. Dates of attendance (for athletics)
13. Degrees and awards received, and
14. The most recent previous
educational agency or institution
attended by the student.
15
Personally identifiable
information
Personally Identifiable Information
• Student’s name, parent or family member names, student’s
address, or other information that would allow a reasonable
person in the school or its community, who does not have
personal knowledge of the relevant circumstances, to identify
the student with reasonable certainty.
• Indirect identifiers such as date and place of birth and mother’s
maiden name.
Personally Identifiable Information – Further Defined
• Other information that, alone or in combination, is linked or
linkable to a specific student that would allow a reasonable
person in the school community, who does not have personal
knowledge of the relevant circumstances, to identify the
student with reasonable accuracy
16
Directory Information
Directory Info IS NOT
• Social Security Number
• Student ID
WOW Student Screen
• Lists Directory Information
• Student history details require an enrollment
record
17
Restricting Directory Information
• Parents can “Opt Out” of sharing directory
information
• For example, if a student in a post-secondary
institution “opts-out”, then the National Student
Clearinghouse cannot redisclose student level
information to the state for that student
• Students do not have the option to “opt-out” for
required reporting to the state
• Students cannot opt out of wearing or
presenting a student ID or badge
18
How do you
authenticate identity?
• Regulations require a school to use reasonable
methods to identify and authenticate the identity of
parents, students, school officials, and other parties
before disclosing education records.
Sample Verification Process for Parent
Requests
Check student
enrollment in
the Student
Information
System
Submit
verification form
to the district of
enrollment to
verify there are
no court orders to
prevent parent
from seeing
records
Require parent
to pick up the
data in person,
show proof of
identify, sign
verification
form
19
Reasonable Methods
• Regulations require the use of “reasonable methods” to
ensure access is only given to only those education records
in which the official has a legitimate educational interest.
• Reasonable methods include:
– Physical controls (locked filing cabinets)
– Technological controls (role-based access controls for
electronic records)
– Administrative policies (must be effective in ensuring
compliance)
• This also means no student data are transferred off-site
using portable media (thumb drives to work at home) or are
sent via email unless in a password-protected or deidentified file.
20
Consent Exceptions
• May be disclosed to school officials with “legitimate
educational interest”
• Authorized government officials
– Regulations expand the school official exception to include
contractors, consultants, volunteers, and other parties to whom a
school has outsourced services or functions under certain
circumstances:
• The party is under the direct control of the SEA or LEA (contract);
• The party is subject to the same conditions governing the use and redisclosure of education records applicable to other school officials;
• WVDE requires these parties to also sign security agreements
21
Disclosure Exception:
Organizations conducting studies
• The school must have a written agreement with the
receiving organization that specifies:
– the purposes of the study;
– the information may only be used to meet the purposes of the
study stated in the agreement;
– the restriction on re-disclosure of the information;
– the requirement for destruction of the information when no
longer needed.
– Clarifies requirements that information disclosed under this
exception is used only to meet the purposes of the study, and
that all re-disclosure and destruction requirements are met.
• WVDE uses a Institutional Review Board and Research
Review Committee process and has specific forms that data
requestors must fill out
22
Disclosure Exceptions:
To Parents of kids 18+
• Regulations clarify that disclosure of education records
without consent is permitted to parents in some
circumstances:
– When a student is a dependent student under the IRS tax
code;
– When the student has violated a law or the school’s rules
or policies governing alcohol or substance abuse, if the
student is under 21 years old;
– When the information is needed to protect the health or
safety of the student or other individuals in an emergency.
– Ensures that schools understand that FERPA does not block
information sharing with parents if any of the above
exceptions apply.
23
Keeping records of
disclosures
• At the SEA and LEA, must record name and legitimate
interest in cases such as these
– Information disclosed without student’s written consent
– To the parent of an eligible student
– In response to a lawfully issued court order or subpoena
• However there must still be an attempt to notify the parent in these
cases unless it is in response to a threat on the student’s safety
– For external research purposes where individual students have
been identified
– In response to an emergency
• Emergencies do not require parental notification
• These include endangerment to the health or well-being of a student
• Note this is why WVDE has the Research Proposal
Application (and its process) and Data Security Agreements
24
More Exceptions
Financial Aid
• To persons or organizations providing student financial aid,
or determining financial aid decisions
Enrollment
• To officials at institutions in which a student seeks to enroll
or has enrolled so long as the disclosure is in connection
with the student’s enrollment
Judicial Order /
Subpoena
• Note that a reasonable attempt at parental notification is
required!
Accreditation
• To accrediting organizations and other entities conducting
educational studies
Health & Safety
Emergency
• When necessary to protect the health or safety of the
student or other persons
25
More Exceptions
USA Patriot Act
Campus Sex Crimes Prevention
Act
Clery Act
School Officials with a
legitimate educational interest
Specified officials for audit or
evaluation purposes
• information relevant to an investigation or prosecution
of an act of terrorism
• Schools are permitted to disclose information about
registered sex offenders
• Requires a school to inform the accuser and the accused of the outcome of
a school’s disciplinary proceeding of an alleged sex offense (name, violation,
and sanction imposed).
• A school may not require the accuser to execute a non-disclosure
agreement.
http://www.ed.gov/policy/gen/guid/fpco/ferp
a/index.html
26
FERPA & HIPAA
• At the elementary or secondary school level,
students’ immunization and other health records
that are maintained by a school district or individual
school, including a school-operated health clinic, that
receives funds under any program administered by
the U.S. Department of Education are “education
records” subject to FERPA, including health and
medical records maintained by a school nurse who is
employed by or under contract with a school or
school district.
27
What Can –
and Can’t – Be Released
• Individual student data can never be publicly published or
released.
• Summary (aggregated) data can be released, but only if
the group size is large enough (>10) to protect the privacy
of individual members of the group.
• When the identity of an individual student could be
inferred due to small group size in a report, treat that
report as confidential.
The summary reports to which you have access may contain
small group sizes, and should therefore be treated as
confidential.
Unauthorized
disclosures of PII
• Unauthorized disclosures of PII may result in
being prohibited from accessing PII for at least
five years
• The entity from which the data originated is
responsible for the prohibition of access
• Most recent FERPA provisions require
documentation and mandatory provisions for
written agreements
29
State Level Security
• Policy 4350 & HB 4316
• WVBE Data Security and Privacy Resolution
• WVDE Data Access & Management Guidance
(available online on the WVDE website under
the Data tab)
• Limited access at WVDE to WOW through jobrelated duties justification, supervisor sign-off,
and assurance to adhere to FERPA regulations.
30
Remember
 Email is now encrypted in transit nor at rest whether on a work
device or a personal device – BUT be cautious
– Attachments & messages opened on personal devices will
not be secure
– Sensitive data stored on a personal device is a security
breach
– Emails on personal devices that are work-related are subject
to FOIA
– Errors are easy with auto-complete names
31
Remember
• Remind your colleagues that disclosing PII is a
violation of state and federal law and policy.
School districts are local units of government
subject to the same laws and acceptable use
policies.
• Do not allow family members or others to use
your work devices.
Coming Soon
• Guidance for the “Alert” screen in WOW
– Primarily for student safety
• Life-threatening allergy information
• Custody/family information if student safety is at stake
• Local rules can still be applied, but some
general guidance will come from WVDE
Family Policy
Compliance Office
• U.S. Department of Education
– Phone: (202) 260-3887 Fax: (202) 260-9001
– Email: [email protected]
• www.ed.gov/fpco
– FERPA Final Regulations
– Revised Regulation Overviews for LEAs, Parents, Students
– FAQs
• Privacy Technical Assistance Center
– www.ptac.ed.gov
– Webinars, Publications, Case Studies
– FERPA 101 Webinar Recording and Transcript
34
Check your Quiz!
1. True
2. True
3. True
4. False – annually
5. True
6. False – if he/she HAS legal rights
7. False – do have authority
8. True
9. Grade Level
10. False – social security, cannot be direction
information
Check Your Quiz!
11. False – by student ID or other identifier
12. True
13. True
14. True
15a. Yes
15b. Yes
15c. No
15d. No
15e. No
15f. Yes
New Information
• Data Access & Management Guidance
document
– Available online on the WVDE homepage under
the Data tab
• HB 4316 - Student Data Accessibility,
Transparency and Accountability Act
• ZoomWV – West Virginia’s source for
accurate, K-12 education information –
Coming Soon
37
Contact Information
• For questions about data privacy and security,
please contact
Carla Howe, Ph.D.
Data Governance Manager.
[email protected]
304-558-7881