Lawfully Managing Student Records El Dorado County Charter SELPA Steering Committee November 30, 2016 Presented by: Michael Tucker Attorney at Law Family Education Rights & Privacy Act (FERPA) Federal law comprehensive statute governing privacy of student records
Purpose To ensure parents and eligible students access to educational records Protect privacy Transfer of rights to eligible students 18 years of age; OR Enrolled in college Age of Majority Transfer of rights does not prevent an educational agency or institution from disclosing educational records, or personally identifiable information from educational records, to a parent without the prior written consent of an eligible student if:
The student is claimed as a dependent for federal income tax purposes by either parent; The disclosure is in connection with a health or safety emergency The disclosure is in regard to the student's violation of a law or policy; or Any other exception to disclosure requirements. 34 CFR 99.5 (a)(2). See also Letter to Anonymous, 53 IDELR 235 (ED 2008). Family Education Rights & Privacy Act (FERPA) Enforced by the U.S. Dept. of Educations Family Policy Compliance Office (FPCO) Applies to educational agencies and
institutions that receive federal funds from U.S. Dept. of Education (20 U.S.C. 1232g; 34 C.F.R. Part 99) California Law Largely tracks the language of FERPA, with some slight differences. (Ed. Code 49060-49805) Individuals with Disabilities Education Act (IDEA) Cross references FERPA. Protects the confidentiality of personally identifiable information at collection, storage, disclosure, and
destruction stages. LEAs must identify a custodian of records Must maintain, for public inspection, a current listing of names and positions of LEA employees who have access to personally identifiable information. (34 C.F.R. 300.610-300.627). Parent Rights Inspect and Review Regarding their child only Redact References to Other Students Before Disclosing to Parents. Seek Amendment of Education Records
California law limits to parents with legal custody Must Consent to Disclosure of Personally Identifiable Information in Education Records California law limits to parents with legal custody File a Complaint Defining Education Records 1. Any records directly related to an identified student; and 2. Maintained by an LEA or by a party acting for the agency or institution. (34 C.F.R. 99.3)
Defining Education Records Education records may be recorded in any manner, including but not limited to handwriting, print, computer media, video, audiotape, film, microfilm, or microfiche. (34 CFR 99.3.) Video Surveillance For instance, if the tape captured an altercation, it would be included in the involved students education record, and the school has to obtain consent before publishing or disclosing its contents to unauthorized individuals. However, authorization would be needed only for the students actually involved in the altercation; other students in the video would be
considered set dressing (not relevant to the incident) and not covered. This means that prior to disclosure to a video tape from a school bus showing an altercation, a school district would be required obtain unanimous consent from the parents of the students actually involved in the altercation. Seemingly, parental consent of other students in the video not relevant to the incident would not be required. National Forum on Education Statistics. (2006). Forum Guide to the Privacy of Student Information: A Resource for Schools (NFES 2006805). U.S. Department of Education. Washington, DC: National Center for Education Statistics. Directly Related to a Student No statutory definition of the term. Considered synonymous with "personally identifiable information" which includes, but is
not limited to: Student's name; Name of the student's parents or other family member; Address of the student or student's family; A personal identifier, such as the student's social security number, student number, or biometric record; Directly Related to a Student Other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name; Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the
student with reasonable certainty; or Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates. (34 CFR 99.3.) Directly Related to a Student What if we just use of a students initials? Two issues: Is it an educational record? Privacy concerns with inadvertent disclosure Directly Related to a Student Records that identify a student by initials, nicknames, or personal characteristics are
personally identifiable information if, alone or combined with other information, the initials are linked or linkable to a specific student and would allow a reasonable person in the school community who does not have personal knowledge about the situation to identify the student with reasonable certainty. Generally, initials, nicknames, and personal characteristics are often sufficiently unique in a school community that a reasonable person can identify the student from this kind of information even without access to any personal knowledge, such as a key that specifically links the initials, nickname, or personal characteristics to the student. In contrast, if a teacher uses a special code known only by the teacher and the student (or parent) to identify a student, such as for posting grades, this code is not considered personally identifiable information under FERPA because the only reason the teacher can identify the student is because of the teacher's access to personal knowledge of the relevant circumstances, i.e., the key that links the code to the student's name.
(U.S. Department of Educations Analysis of Comments and Changes to FERPA regulations (December 9, 2008).) Directly Related to a Student Privacy concerns with inadvertent disclosure. Example: Due to the inherent insecurity of email (hacked, accidentally forwarded to wrong recipient) the use of initials or some other coded system to refer to students may be good practice. Adds a layer of protection in case the record gets in the hands of the wrong person.
Maintained by an Educational Agency Not every record that relates to a student satisfies the FERPA definition of education records. The U.S. Supreme Court explained that education records are those kept in one place with a single record of access. (Owasso Independent School District v. Falvo, 534 US 426, 36 IDELR 62 (2002).) E-mails as Student Records S.A. v. Tulare COE and CDE (E.D. Cal. Oct. 6, 2009) 2009 WL 3296653 District court held that school district emails concerning or
personally identifying a student that had not been placed in his permanent file were not educational records as defined under FERPA. The court stated that Congress contemplated that educational records be kept in one place with a single record of access to those records. Because the emails the student requested had not been placed in his permanent file, and were therefore not maintained by the school district, the emails were not educational records and the school district was therefore not required to produce them under a request for student records under the IDEA. E-mails as Student Records S.A. v. Tulare COE and CDE (E.D. Cal. Oct. 6, 2009) 2009 WL 3296653
Court noted that maintained suggests the records will be kept in a hard copy file at the school or on a permanent secure database, and does not include every email a district receives regarding a student. NOTE: Tulare COE decision has been cited by other authorities (including OAH) but is not binding authority upon other federal District Courts or the 9th Circuit. Maintained by an Educational Agency - Case Example Student, who was eligible under SLD, was injured
twice on the schools playground. Both incident reports were confidentially kept in the district business office's risk management department in anticipation of litigation. OAH held that the Student was not denied FAPE by failing to timely provide copies of these incident reports to parent because they were not maintained in the students educational record. Student v. Saddleback Unified School District, 57 IDELR 298 (CA 2011). Maintained by an Educational Agency The designation of a document as an education record depends on who maintains it, not who originates it.
Or by a party acting for the agency or institution LEAs are obligated to, at the very least, inform parents that nonpublic agency (NPA) records must be retrieved directly from the NPA in the event that the records reside solely with the NPA. (L.J., et al. v. Pittsburg Unified School District, et al., 13-cv-03854-JSC (N.D. Cal May 14, 2014). Notify parents of the existence and location of any other records that may reside with a different agency which the LEA caused to be created or used in the IEP formation process. Maintained by an Educational Agency Student work samples generally are not
maintained See, e.g., Gwinnett County Sch. Dist., 62 IDELR 156 (SEA GA 2013). Certain Types of Educational Records IEPs are considered education records. Letter to Cossey, 211 IDELR 351 (OSEP 1984). Due process hearing decisions, including appellate court decisions, become part of a student's education record, subject to the requirements and protections of FERPA. Letter to Kudwa, 211 IDELR 89 (OSEP 1979). Written or electronic versions of the administrative decision must be made available to the public although the names of the students and
parents are redacted in accordance with the IDEA's confidentiality of data provisions. CDE complaint reports are education records subject to parental inspection, provided they identify the student by name. Letter to Shrant, 211 IDELR 253 (OSEP 1981). Assessment Protocols Written instructions on how a test must be administered and the questions posed. Test protocols that include personally identifiable information are education records within the meaning of the IDEA and FERPA, and therefore parents have the right to inspect and review them.
Letter to Price, 57 IDELR 50 (OSEP 2010); and Letter to Shuster, 108 LRP 2302 , 11 FAB 30 (OSEP 2007). See also Pasadena Unified Sch. Dist., 114 LRP 49748 , 18 FAB 12 (SEA CA 2014) (finding that a student's parents did not have the right to inspect protocols used in the student's assessments because they were not maintained in his file as education records). Assessment Protocols However, there may be circumstances where an assessor needs access to protocols, other than the score sheet, in order to adequately explain the students responses on the score sheet. Additional protocols could be maintained until the assessment results have been explained to the parents (e.g. after the IEP meeting where the results are
discussed). Also, information necessary to explain the test results is usually included in the comprehensive report drafted by the assessor. Assessment Protocols Common practice is to maintain the score sheet and shred the remaining test protocols, assuming that the remaining protocols do not contain any information which is identifiable to the student. However, under FERPA, a parent may request an explanation and interpretation of a record. (34 CFR 99.10 (c); 34 C.F.R. 300.613 (b)(1).)
Typically, assessors who are familiar with the test instrument will be able to adequately explain the results using the score sheet and his/her knowledge of the test instrument. Assessment Protocols Providing parents of special education students with copies of test protocols constitutes a fair use exception to federal copyright law. LEAs may establish appropriate safeguards to minimize the risk of improper use such as requiring parents to:
Review original test protocols before obtaining a copy Provide a written request for a copy Execute a nondisclosure or confidentiality agreement. Have a member of students IEP team review test information with parent before releasing copies, and providing information about purpose of maintaining test security to help the parent understand how future assessments could be compromised by inappropriate disclosure of test items and responses. Newport-Mesa USD v. Calif. Dept. of Educ. (C.D. Cal 2005), 43 IDELR 161. NOT Education Records
FERPA specifically excludes several types of records from consideration as education records, even though they may contain information directly related to a student and may be maintained by the educational agency. NOT Education Records Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the record. See Deer Park Cmty. City Schs., 116 LRP 1361 (SEA OH 12/11/15); Ann Arbor Pub. Schs., 115 LRP 6219 , 18 FAB 21 (SEA MI 2015); and Letter to Ruscio, 115 LRP 18601 , 18 FAB 31 (FPCO 2014).
Example: Counseling notes used only as a personal memory aid and never shared with any other staff member constitute "sole possession records" and are exempted from FERPA's parental access requirements. Letter to Ruscio, 115 LRP 18601 (FPCO 12/17/14). NOT Education Records Records maintained by a law enforcement unit of the educational agency or institution that were created by that unit for the purpose of law enforcement. Employee records.
NOT Education Records Adult student treatment records: Records of a student who is 18 years of age or older, or in college, that are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in such capacity; or made, maintained, or used only in connection with the provision of treatment to the student; and are not available to anyone other than persons providing such treatment. Grades on peer-graded papers before they are collected and recorded by a teacher. Parents Right to Access Records
Copies for parents; OR Inspect and review during regular school hours. Timeline in California, within 5 business days from the date of the request. Either orally or in writing. For special education students, LEA must comply to a request for school records without unnecessary delay before an IEP meting or any hearing, but no more than 5 business days. Parental Representatives Under FERPA, the right to review and inspect education records is
personal, in the sense that the district is not required to allow a parent to assign or delegate the right to review to a representative, whether that individual is an attorney, parent advocate, friend, or relation. See Letter to Longest, 213 IDELR 173 (OSEP 1988); and Letter to Segura, 113 LRP 7194 , 16 FAB 25 (FPCO 2012). However, for special education students, IDEA grants a designated representative the right to inspect a student's records on behalf of the student's parents. 34 CFR 300.613 (b)(3). See, e.g., In re: Student with a Disability, 54 IDELR 272 (SEA MT 2010) (concluding that a district did not violate the IDEA by requiring a signed release before turning over the student's records to the parent's representative).
Costs of Copies LEA may charge no more than the actual cost of reproducing the records. UNLESS, this cost effectively prevents the parent from exercising the right to receive the copies. May not charge parents a fee to search for or to retrieve a student's education records. No obligation to mail records to parent. Acceptable to have records available to be picked up at the school office. (34 C.F.R. 99.11; 300.617; Ed. Code 49065, 56504, Student v. Oakland USD (OAH No. 2013100534), ) Parental Consent for Disclosure to Third
Parties FERPA precludes LEAs from disclosing personally identifiable information from a student's education records without first obtaining signed and dated written parental consent, subject to certain exceptions. Parental Consent for Disclosure to Third Parties "Disclosure" means to "permit access to or the release, transfer, or other communication of personally identifiable information contained in education records by any means, including oral, written, or electronic means to
any party except the party identified as the party that provided or created the record." (34 CFR 99.3.) Parental Consent for Disclosure to Third Parties The following district communications relating to a student with a disability were disclosures for purposes of FERPA: Release to a newspaper of a copy of the minutes of a school board meeting at which the student's IEP was discussed. Discussion of financial information and details about the student's educational placement by school officials in interviews with newspaper reporters.
Discussion of the student's educational program and its costs during an open school board meeting attended by reporters. Greater Hoyt (SD) Sch. Bd., 20 IDELR 105 (FPCO 1993). Parental Consent for Disclosure to Third Parties Signed and Dated Written Consent Before Disclosure Specifies: Records to be Disclosed Purpose Parties or Class of Parties If the parent or eligible student requests the
records, the district must provide a copy of the records it has disclosed. (34 C.F.R. 99.30) Exceptions to Prior Written Consent Rule There are a number of specific exceptions under which an LEA may disclose personally identifiable information without prior written consent. The exceptions that most frequently impact students with disabilities include: Directory information; Health and safety emergencies Disclosure to school officials with legitimate educational interest; Disclosure to other schools; Disclosure to government agencies;
Discipline, law enforcement, and juvenile justice information; and Court orders and subpoenas; (34 CFR 99.31(a); Ed. Code 49076) Directory Information Information contained in an education record that is not harmful or is not an invasion of privacy if disclosed. Includes, but is not limited to: Students name Address Phone number Email Address Photograph Date and place of birth
Grade level Dates of attendance Participation in officially recognized activities and sports; awards received. (34 C.F.R. 99.3) Directory Information May disclose directory information without written parental consent if it has given public notice to parents of: The types of personally identifiable information designated as directory information The parents right to refuse to let the school designate any or all of those types of information about the student as directory information The period of time within which the parent has to notify the school in
writing that he does not want any/all of those types of information to be designated as directory information. (34 C.F.R. 99.37) Directory Information School officials may not designate students sex or transgender status as directory information. LEAs should maintain education records with this kind of information, but that such records should be kept confidential. Nonconsensual disclosure of personally identifiable information such as a students birth name and sex assigned at birth, could be harmful to or invade the privacy of transgender students, and may violate FERPA.
Dear Colleague Letter on Transgender Students, 116 LRP 19809 (May 13, 2016) Directory Information Parents (or adult students) have the right to request that the school change a students name and gender marker on the students records if they feel they are incorrect, misleading, or violate your privacy. 34 C.F.R. 99.7(a)(2)(ii). Health and Safety Emergencies LEAs may disclose personally identifiable information from an education record to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health and safety of student or other individuals. 34 CFR 99.36 (a).
An emergency exists if there is a significant and articulable threat to an individual's health or safety, considering the totality of the circumstances. Letter to Anonymous, 53 IDELR 235 (ED 2008) Threat does not need to be verbalized. LEA must be able to articulate what the threat is when it makes and records the disclosure. 73 Fed. Reg. 74,838 (2008). If, based on the information available at the time of the determination, there is a rational basis for the determination, US Dept. of Education will not substitute its judgment for that of the LEA. 34 CFR 99.36 (c). School Officials with Legitimate Educational Interest LEA determines which individuals possess such an interest. 34 CFR 99.31 (a)
(1). Annual FERPA notice should include LEAs definition of school official and what constitutes legitimate educational interest. Teachers
Administrators Health staff Counselors Attorneys Clerical staff Board members Committee and disciplinary board members Need to review record to fulfill professional responsibility and fulfill schools educational mission Need to know -- NOT curiosity School Officials with Legitimate Educational
Interest A contractor, consultant, volunteer, or other party to whom an agency or institution has outsourced institutional services or functions may be considered a school official, provided that the outside party: Performs an institutional service or function for which the agency or institution would otherwise use employees; Is under the direct control of the agency or institution with respect to the use and maintenance of education records; and Is subject to the requirements governing the use and re-disclosure of personally identifiable information from education records. 34 CFR 99.31 (a)(1)(i)(B). Examples: nonpublic school
School Officials with Legitimate Educational Interest Case law suggests that parental consent is required before disclosing educational records to an independent evaluator. See e.g., Owen J. Roberts Sch. Dist., 115 LRP 10060 (SEA PA 02/21/15). Disclosure to Other Schools LEA may disclose educational records without consent to officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student's enrollment or
transfer. 34 CFR 99.31 (a)(2). Must make a reasonable attempt to notify parent, unless: The disclosure was initiated by the parent or eligible student, OR LEAs annual FERPA notification includes a provision that education records will be forwarded upon request to other institutions where the student seeks admission or intends to enroll or is already enrolled. 34 CFR 99.34 (a)(1)(ii). Disclosure to Other Schools To determine an appropriate placement for a student, administrators may have to discuss a student's needs with officials from other schools where the student seeks to enroll, and the discussions may involve the disclosure of personally identifiable information.
An LEA can avoid a FERPA violation for disclosing educational records without parental consent if it makes an attempt to notify them OR its annual FERPA notification states that education records will be provided to other institutions where the student seeks admission. Letter to Anonymous, 113 LRP 35724 , 17 FAB 14 (FPCO 2013). Transfer of Records Whether District may or must transfer a record depends on: type of record location of receiving school
Three Types of Pupil Records Mandatory Permanent Maintained in perpetuity (or an exact copy thereof) Mandatory Interim Maintained for stipulated periods of time, then destroyed Permitted Records having clear importance only to the current educational process of the student 5 C.C.R. 430 Mandatory Permanent Pupil Records Legal Name of Pupil
Date of Birth Method of Verification of Birth Date Sex of Pupil Place of Birth Name and Address of Parent of Minor Pupil Address of Minor Pupil if Different Annual Verification of Name and Address of Parent and Residence of Pupil
Entering and Leaving Date of Each School Year and Any Summer or Other Extra Session Subjects Taken During Each Year, Half-Year, Summer Session, or Quarter Marks or Credits Toward Graduation Verification of or Exemption From Required Immunizations Date of High School Graduation or Equivalent
Mandatory Interim Pupil Records Progress slips and/or Access Log notices Health Information Parental Restrictions Participation in Special Regarding Access to Education Programs Directory Information or Including Related Stipulations
Tests Parent Rejoinders to Case Studies Challenged Records and Disciplinary Action Authorizations Parental Authorizations or Actions Necessary to Establish Eligibility for Prohibitions to Participate
Admission or Discharge in Specific Programs Language Training Records Results of Standardized Tests Administered Within Preceding Three Years Permitted Pupil Records
Objective Counselor and/or Teacher Ratings Standardized Test Results Older Than 3 Years Routine Discipline Data Verified Reports of Relevant Behavioral Patterns All Disciplinary Notices Attendance Records Transfer of Records Copy of Mandatory Permanent Pupil Record Shall Be Transferred Upon Request from Other District or Private School.
Original or Copy Must Also Be Retained Permanently By Sending District Copy of Mandatory Interim Pupil Record Shall Be Forwarded To Another California Public School May Be Forward To Private School or Out of State Copy of Permitted Pupil Records May Be Forwarded All Records Should Be Updated Prior to Transfer 5 C.C.R. 438 Transfer of Records If Within California Receiving School Required to Notify Parents of Record
Transfer and Their Right to Review, Challenge, and Receive Copy of Records If Out of California Sending District May Notify Parents of Their Rights Records May Not Be Withheld Because of Any Charges Owed By Pupil or Parents 5 C.C.R. 438 When may a receiving District request student records? When a pupil transfers 5 C.C.R. 438
Has student/parent indicated student will be transferring into receiving District? What if the Sending District Needs Records Back? Written consent always an option Subpoena Transfer of Records Special Education Students New school must take reasonable steps to promptly obtain pupil records, including IEP and other documents relating to the students special education and related services.
Previous school must take reasonable steps to promptly respond to request from new school. Former educational agency is required to send pupils special education records (or a copy) within five (5) working days upon request from new school. Ed. Code 56325, 56043(o), 5 C.C.R. 3024. Transfer of Records Do not assume your obligation to maintain students special education records is concluded if you forward records to new LEA. IDEA requires an LEA to keep records to show compliance. Statute of limitations for filing due process is 2 years from date party knew, or had reason to know facts underlying
basis of request. (Certain exceptions apply). Or to defend against compliance complaint filed with CDE, or civil rights complaint filed with OCR. Best Practice: Keep special education records a minimum of 3 years after student leaves the LEA. Transfer of Records Foster Youth Foster family agencies may access records of grades, transcripts, and IEPs County placing agency must notify district that student will be leaving the school on particular date and request that the pupil be transferred out. New district must immediately enroll the student (even without any records) District must transfer student out of school and deliver the educational
information and records of the pupil to the next educational placement within 2 business days. Determination of seat time Full or partial credits earned Current classes and grades Immunization and other records IEP Educ. 49069.3, 49069.5 Code 504Plan Retention and Destruction of Records Mandatory Permanent
Preserved FOREVER Mandatory Interim Unless forward to another district, may be adjudged disposable when student leaves district or when usefulness ceases Destruction shall be during the 3rd school year following such classification Permitted May be destroyed when usefulness ceases or after 6 months following pupils completion of or withdrawal from the educational program. Method of destruction must ensure that records are not available to possible public inspection in process. 5 C.C.R. 437
NOTE: CASBO publishes a Records Retention Manual available for purchase at www.casbo.org Retention and Destruction of Records IDEA requires that: An LEA inform parents when personally identifiable information collected, maintained, or used for special education purposes is no longer needed to provide educational services to the child. The information must be destroyed at the request of the parents. However, a permanent record of the student's name, address, and phone number, his or her grades, attendance record, classes attended, grade level completed, and year completed may be maintained without limitation. 34 CFR 300.624.
"Destruction" is a term of art under the IDEA regulations and it does not equate to physical destruction. Destruction is the physical destruction or removal of personal identifiers from information so that it is no longer personally identifiable. 34 CFR 300.611 (a). 5 C.C.R. 437 Governmental Agencies Disclosure without prior consent is permitted to authorized representatives of: The Comptroller General of the United States; The Attorney General of the United States; The Secretary; or State and local educational authorities in connection with an audit or
evaluation of federal or state supported education programs, or for the enforcement of or compliance with Federal legal requirements that related to those programs. (34 CFR 99.31(a)(3)(iv) and 99.35.) Information collected must be protected in a manner that does not permit personal identification of individuals by anyone except those officials. Information must be destroyed when no longer needed. 34 CFR 99.35 (a)(3)(iii). Discipline/Law Enforcement LEAs may disclose education records to the juvenile justice system when the disclosure concerns the system's "ability to effectively serve the student whose records are released." 34 CFR 99.31 (a)(5)(i).
LEAs may disclose disciplinary action taken against a student for behavior that posed a significant risk to the student or to other individuals. The disclosure may be made to school officials in other schools who have a legitimate educational interest in the behavior of the student. 34 CFR 99.36 (b). Discipline/Law Enforcement LEAs are not prevented from reporting a crime committed by a student with disabilities to appropriate authorities. Any district reporting such a crime must ensure that copies of the special education and disciplinary records of the child are transmitted for
consideration by the appropriate authorities to whom it reports the crime. However, a district may transmit such records only to the extent that such transmission is permitted by FERPA. 34 CFR 300.535 Judicial Order or Lawfully Issued Subpoena No permission necessary, but must notify parents/eligible student (limited exceptions) Custodian of records reviews description of requested items and makes copies of requested documents do NOT send originals Custodian of records completes declaration (which should be attached to subpoena) detailing what custodian did
Preserve confidentiality use envelope within envelope Can bill requesting party for reasonable costs of copying Judicial Order or Lawfully Issued Subpoena There is nothing in FERPA that requires an LEA to notify a parent of its intention to comply with a subpoena from the other parent. Letter to Anonymous, 115 LRP 33158 , 18 FAB 49 (FPCO 2015) If an LEA initiates legal action against a parent or student, the LEA may disclose to the court, without a court order or subpoena, the education records of the student relevant
for the school to proceed with its action as a plaintiff. Or to defend itself in a legal action initiated by parent or student. 34 CFR 99.31 (a)(9)(iii). What To Do If Student Records are Improperly Disclosed Consider report to law enforcement authorities. Determine exactly what information was compromised -- names, addresses, social security numbers, ID numbers, credit card numbers, grades, etc. Take steps immediately to retrieve data and prevent any further disclosures. Identify all affected records and students. Determine how incident occurred, including which
school officials had control of and responsibility for the information that was compromised. What To Do If Student Records are Improperly Disclosed Determine whether LEA policies and procedures were breached, including requirements governing access (such as user names, passwords, or PINs), storage, transmission, and destruction of information from education records. Determine whether the incident occurred because of a lack of monitoring and oversight. Conduct a risk assessment, and identify appropriate physical, technological, and administrative measures to prevent similar incidents in the future.
Notify parents/students of disclosure that identify resources if they suspect they are a victim of identity theft. Consider development and implementation of a Breach Notification Policy Procedures for Purging Larry P. Records From Student File The prohibition against IQ testing of African-American students only applies to California school districts. Students transferring into the district from another state may have IQ assessment information which violates Larry P. and CDE policy. It may also be the case, that the district mistakenly administered a prohibited test and/or discovers prohibited
information in the file of a current student. Based on the Campbell Directive and the requirements of Larry P., we recommend the following procedures for handling/purging prohibited records. Procedures for Purging Larry P. Records From Student File Review the students file to determine if it contains any prohibited information; Remove all assessment reports, including any prohibited protocols, which contain IQ information. Copy the original report(s). For the copied report, purge/redact all of the following information:
Any reference(s) to a test instrument(s) which yields an IQ score or other standard score that measures cognitive functioning. Any summary of the scores from the prohibited test instrument(s). Any recommendations, notes, or commentary in the report discussing the student's performance on the prohibited test instrument(s). Procedures for Purging Larry P. Records From Student File Make a copy of the purged/redacted report and place the copy in the student's file. Destroy the copy that was used to purge/redact the prohibited information. Notify the parent/guardian that, pursuant to court order and CDE legal guidelines, the original report and any relevant protocols will be sealed. Provide copies of any original reports to parent/guardian if requested.
Seal the original records purged from the file along with a copy of the notice provided to the parent/guardian in an envelope. Mark the outside of the envelope with the following information: The student's name; A destruction date five (5) years from the date the records were purged/redacted; A note stating that the envelope is not to be opened except for purposes of litigation, official state or federal audits, or at request of parent/guardian. Access Log LEAs must keep and maintain a log of each request for access to and each disclosure of personally identifiable information from education records of each student, as well as the names of state and local educational authorities and federal officials and agencies that may make further disclosures of
personally identifiable information from the student's education records without consent. The record of disclosure must include: The parties who have requested or received the information. The parties' legitimate interests in requesting or obtaining the information. 34 CFR 99.32. Other Resources Family Compliance Policy Office (FCPO) http:// familypolicy.ed.gov/ferpa-school-officials?src=ferpa California Department of Education http://www.cde.ca.gov/ds/dp/dataprivacyferpa.asp
Office of Special Education Programs (OSEP) http:// www2.ed.gov/policy/speced/guid/idea/letters/revp olicy/tpconfedr.html THANK YOU! GIRARD & EDWARDS Tel: (916) 706-1255 Fax: (916) 706-2672 www.girardedwards.com