This is directly for the USBE Special Education. Since this specifically address the use of email responses with student information, please take the time to review and implement the information below. Remember as a team we specifically utilize first initial and last name or just first initial. If parents are using first names and the email references the last name you must redact the name by replacing it with just an initial or using “student.”
EMAIL AND STUDENT PRIVACY
Introduction to FERPA
The Family Educational Rights and Privacy Act (FERPA) is a federal law that prohibits the improper disclosure of personally identifiable information derived from education records. FERPA requires schools to provide certain privacy protections for education records that they maintain. Additionally, FERPA affords parents and adult students certain rights with respect to student education records, including:
! The right to inspect and review student education records;
! The right to request an amendment of student education records;
! The right to provide written consent before the LEA discloses personally identifiable information (PII) from the student’s education records, except for certain exceptions specified in FERPA; and,
! The right to file a complaint with the U.S. Department of Education concerning an LEA’s alleged failure to comply with FERPA.
Personally Identifiable Information (PII)
Personally identifiable information (PII) contained in educational records relating to IDEA-eligible students is subject to FERPA requirements and includes:
! A student’s name;
! The name(s) of a student’s parents or other family members;
! A student’s address;
! Personal identifiers (e.g., social security number, student number);
! Other indirect identifiers (date of birth, place of birth, mother’s maiden name, race, ethnicity); and,
! Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community to identify the student with a reasonable certainty.
The Family Policy Compliance Office (FPCO) has held that student ID numbers and social security numbers constitute personally identifiable information since they are “easily traceable” to the student. Letter to Shea, 36 IDELR 7 (FPCO 2001).
Email Transmission of PII
Due to the rapidly evolving use of digital communication and record keeping, traditional FERPA rules and regulations offer little guidance in regards to electronic communications. Some hearing officers or courts have taken the position that emails that are not maintained as part of the student’s records are not FERPA records. However, given the fact that emails are frequently used as evidence in due process hearings and State complaint investigations, school staff should exercise caution in documenting student concerns in email communications.
Regardless of whether email communications qualify as “education records” under FERPA, unencrypted email is not a secure method for transmitting confidential information or sensitive data over the internet. Anytime FERPA protected information is emailed, there is a risk that it could be accessed by unintended recipients. As such, USBE policy prohibits LEAs from transmitting PII over email.
Responding to Messages Containing PII
Many parents may share their concerns about their student’s special education services via email to school staff. In these instances, school staff must redact any PII from the email prior to responding to the parent or forwarding the email. For example, in instances where a student’s name is used, school staff should delete the student’s name from the message and replace it with a generic term (e.g., “student” or [Student]) or use some other indicator such as a highlight or symbol to indicate where the redaction occurred. In the subsequent message, school staff should include a short statement to the email recipient indicating that PII within the email has been redacted in compliance with FERPA and USBE policies to avoid the unsecure transmission of student sensitive information. The USBE follows this same procedure whenever school staff or parents send an email containing PII to USBE staff.
Best Practices for Avoiding Inadvertent Disclosure
Before sending any email communication about a student with a parent, administrator, or colleague, school staff should carefully consider whether that information could be shared in another way. Staff members should avoid the use of email for documenting substantive matters and concerns. If an email is intended to document a substantive matter or concern, it should be printed and included in the student’s file.
If communication about a student must be sent over email, school staff should:
! Not include more information in an email than necessary;
! Double check the recipient’s email address, especially for bulk emails and Cc’d messages; and
! Ensure an attached file is the file they intended to send.
In the rare circumstance when school staff determine that PII must be transmitted over email, the information should be in a protected file attachment, not in the body of the email, followed by a separate email containing a strong password to access the file.