Education Week - January 22, 2014 - 11

DIGITAL DIRECTIONS > Tracking news and ideas in educational technology
www.digitaldirections.org
Incidents Highlight Potential Harm of K-12 Data Breaches
CONTINUED FROM PAGE 1
for more and better use of data in
K-12 schools, arguing that good information
is critical to personalizing
student learning, providing teachers
with real-time feedback, and helping
policymakers make smarter decisions.
All states now have longitudinal
data systems that track students'
performance over time, and much of
the technology that has flooded classrooms
now records even children's
smallest digital actions.
In recent months alone, however,
districts and their vendors have lost
laptops and flash drives containing
student information, accidentally
posted children's health information
and Social Security numbers online,
and improperly released individual
student test scores.
An increasingly widespread busi-
ness model is also cause for concern,
privacy advocates say. In December,
the Electronic Privacy Information
Center, a Washington-based nonprofit,
filed a complaint with the Federal
Trade Commission accusing the
popular financial-aid website Scholarships.com
of selling sensitive student
information to third-party marketers
without adequate disclosures.
"We don't have good data on how
often this is happening in schools,"
said Joel R. Reidenberg, a professor
of law and technology policy at
Princeton and Fordham universities.
"But essentially every adult
American has had their financial
information compromised. There's
no reason to think the educational
world is any better."
Inappropriate Access
In 2012, the Gagnon family of
Camp Verde, Ariz., became the
face of public outrage over reports
that some corporate-affiliated
mobile dentists were performing
unnecessary-and often traumatic-dental
work on children
from poor families in order to maximize
reimbursements from the federal
Medicaid program.
The Gagnon family sued Phoenix-based
ReachOut Healthcare
America, a company that provides
administrative support to mobile
dentists, after their medically fragile
4-year-old son, Isaac, was given two
unauthorized and unnecessary "baby
root canals" while being forcibly held
down inside his school. The suit has
since been settled, according to the
family's attorney, who declined to
comment on the specifics of the case.
In June of last year, the U.S. Sen-
ate Judiciary Committee concluded
an investigation into complaints
involving ReachOut Healthcare
and four other corporate dental
chains operating across 23 states.
The committee found that the traumatic
treatment endured by the
Gagnon family was "not necessarily
widespread" among ReachOut
Healthcare's affiliated dentists,
but criticized the company for failing
to provide adequate oversight.
The committee also recommended
that Nashville, Tenn.-based Church
Street Health Management be excluded
from the Medicaid program
after a review of treatment records
found that two-thirds of the baby
root canals, or pulpotomies, performed
at a Phoenix clinic operated
by the company were likely unnecessary.
The company, now known
as CSHM, has since gone through
bankruptcy proceedings and taken
ask for student information databases,"
Ms. Yee maintained.
In response, she sponsored a bill,
signed into law last year, strengthening
the procedures for reporting violations
related to the release of student
directory information-which
typically includes name, address,
and phone number-to third-party
vendors. Under the federal Family
Educational Rights and Privacy Act,
or FERPA, schools may disclose such
tal teams affiliated with the company
provided services to more than
100,000 children in 2010 and 2011,
according to Mr. Tolkin.
In part because of parent complaints
about unwanted solicitations
made using student directory information,
a number of districts, including
the 37,000-student Peoria Unified
School District outside Phoenix, have
severed ties with the company.
"We let them know we wouldn't
CHICAGO
Last November, the district
reported that 2,000 students
participating in a free visionexamination
program offered by
the city had their names, dates
of birth, gender, and ID numbers,
as well as information from their
exams, accidentally posted online.
FLORIDA
SCHOOL DATA-SECURITY LAPSES
Experts say it's difficult to know exactly how frequently
school systems have their data compromised. Such
instances can happen without anyone knowing, and
they're not always reported. But a review of recent
news reports found some troubling incidents:
LOUDOUN COUNTY, VA.
The 71,000-student Loudoun County public schools was thrust into damagecontrol
mode last month after an outside vendor, New York City-based Risk
Solutions International, inadvertently uploaded and left unprotected some
schools' emergency evacuation plans, as well as "directory information" that
included students' names, addresses, telephone numbers, dates and places
of birth, course schedules, and attendance histories, according to the
Washington Post.
Rich Contartesi, the Loudoun County district's assistant superintendent
of technology services, told Education Week that the biggest lesson learned
is that districts must be vigilant in overseeing third-party contractors.
"You want to make sure that you know something about the business
practices, processes, and physical plant of the companies that have your most
sensitive information," he said.
on new management, allowing for
continued participation in the Medicaid
program, said Perry Hall, a senior
strategist for the public relations firm
Lovell Communications.
Arizona state Sen. Kimberly Yee,
a Republican, said inappropriate access
to student records helped fuel
the abuses by mobile dentists in her
state and elsewhere.
ReachOut Healthcare's practice is
to "make friends with employees on
[school] campuses, particularly those
in administrative or nursing offices,
take them to lunch, and thereafter
information so long as parents are
provided the opportunity to opt out of
any such releases.
Ms. Yee said her goal was to main-
tain "the privacy of students on campuses
from outside vendors who want
to obtain [directory] lists to increase
their client bases."
In an email, company spokesman
Eric Tolkin wrote that "student directories
are only used in approximately
2 percent of schools served by dentists
affiliated with ReachOut Healthcare."
That would still involve thousands
of students: In Arizona alone, den-
In June, the Tallahassee Democrat
reported that roughly 47,000
participants in state teacherpreparation
programs had their
personal information-including
names and in some cases Social
Security numbers-posted on the
Internet for two weeks last spring.
The information was being stored
by Florida State University.
LONG ISLAND, N.Y.
The 12,000-student Sachem
Central School District suffered
three data-security breaches in
recent months, including one in
which the names, ID numbers,
and designations for free-lunch
programs of 15,000 former
students were posted online,
according to a Newsday report.
A 17-year-old student from
Sachem North High School was
arrested and accused of illegally
downloading and posting the
information last November, and
pleaded not guilty to the charges,
according to reports.
SOURCES: Education Week
and news reports
years, especially when it involves
children, said Mr. Reidenberg, the
Fordham professor.
That's cause for concern, he said,
given the volume and scope of accidental
data breaches in K-12 systems. In
2009, for example, the Philadelphiabased
Public Consulting Group, a
private contractor of the Tennessee
Department of Education, inadvertently
left the names, addresses, dates
of birth, and full Social Security numbers
of more than 18,000 Nashville
Public Schools students available
online for more than two months.
Affected families were notified of the
breach and given free identity-theft
and online-credit monitoring, according
to Nashville school officials.
Just as alarming, advocates say, is
that many businesses now encourage
children, families, educators,
and district officials to pay for online
content and services with personal
information.
Unfair Practices
In its FTC complaint over the "deceptive
and unfair" business practices
of Highland Park, Ill.-based
Scholarships.com, the Electronic
Privacy Information Center, or EPIC,
accused the website of encouraging
its 14 million users to provide
sensitive information, then using
an affiliated entity of the company
known as American Student Marketing,
or ASM, to sell that data
to third-party marketers without
adequate disclosures.
The site invites users to indicate
their sexual orientation, if they are
clinically depressed, if they have
a drug addiction, and if they have
parents who are illegal immigrants,
among other pieces of information.
According to the complaint, ASM then
sells that information to marketers.
In an email, Scholarships.com said
users have the option to provide the
sensitive information referenced in
EPIC's complaint, that such information
is collected primarily to direct
users to relevant scholarship opportunities,
and that most third-party
marketing comes from postsecondary
institutions.
be able to continue the relationship
given what seemed to be an abuse of
that information," said Danielle Airey,
the Peoria district's director of public
relations.
Security Breakdown
Privacy advocates, though, offer few
such specific examples of children
being harmed as the direct result of
having their personal information
compromised.
The fallout from identity theft, for
example, might not be known for
In a telephone interview, company
vice president Kevin N. Ladd also
suggested that using individuals'
personal information to support targeted
advertising is hardly unique to
Scholarships.com.
Data proponents acknowledge the
growing furor around privacy concerns,
but say better security practices,
clearer consent procedures, and
improved contracting protocols can
mitigate risks without dampening
data's educational benefits.
Ms. Barnes of EPIC, though, stressed
the need for a wide perspective on
what those risks actually are.
"From our standpoint, the initial
harm comes when the law is violated
and when student consumers lose
control over their data," she said.
Contributing Writer Michelle R. Davis
contributed to this article.
EDUCATION WEEK | January 22, 2014 | www.edweek.org | 11
iStockphoto
http://www.digitaldirections.org http://www.Scholarships.com http://www.Scholarships.com http://www.Scholarships.com http://www.Scholarships.com http://www.Scholarships.com http://www.edweek.org
Education Week - January 22, 2014

Table of Contents for the Digital Edition of Education Week - January 22, 2014
