Data Collection Sparks Privacy Concerns MT Public Schools
February 10, 2009 · 1 Comment
February 9, 2009
Data collection sparks privacy concerns
By ERIC NEWHOUSE
Tribune Projects Editor
Montana’s Office of Public Instruction has begun collecting information – including medical data – on students with disabilities, raising some confidentiality concerns among school officials.
“I don’t have any problem submitting this data to the state, but it’s wrong to associate it with an individual student by name,” said Doug Sullivan, superintendent of schools in Sidney.
In addition to a list of the physical and emotional disabilities students have, Sullivan also is concerned that the state requires general income information by asking which students are eligible for a subsidized school lunch, Sullivan said.
“I asked the principal not to disclose some of that specific information about my son, but he told me that could jeopardize federal funding of school programs,” Sullivan said. “But that jeopardizes my right as a parent to control information about my own child.”
Madalyn Quinlan, chief of staff for OPI, said the data is required by the Achievement in Montana system, which is used to assess and track the educational progress of students.
“It’s an accountability requirement for the federal government to ensure we are providing services to the students they’re providing funding for,” said Great Falls Public Schools Superintendent Cheryl Crawley. She said the system’s current security provisions appear adequate to her and her staff.
The program, which collects 108 data sets on each child, is in the fourth year of a five-year contract with the software vendor, Infinite Campus Inc.
“The system for the special education program is just being rolled out this year,” said Bob Runkel, assistant superintendent of OPI.
Information in that system includes individual education programs, in which teachers devise strategies to educate students with a variety of physical, mental and emotional disabilities.
“My point is that that information doesn’t belong to the state, at least not on a personal identification basis, particularly in a state that has so strongly rejected the Real ID program (a national program of standardized identification),” Sullivan said.
Runkel said school officials are sensitive to those concerns.
“Of course we’re concerned,” he said. “We’ve developed a system, keeping privacy and confidentiality of student data in mind, and it has a lot of safeguards built into it.”
“The product itself is actually stored with the state (online) firewall,” Quinlan said. “Any information uploaded from the school districts comes across a secure site, and no information is exchanged via e-mail.”
Additionally, all OPI employees are trained on student confidentiality procedures, she said.
Those measures aren’t enough, according to Sullivan and the board of trustees of the Sidney Public Schools.
Sullivan said he wonders why OPI can’t generate a student identification number and send it to the district, which will then assign it to a student. Once that is done, the district and OPI could refer to that student by the number, with only the district having access to the name assigned to the ID number.
“The (software) product we purchased has the student name as an integral part of the program,” Quinlan said. “And the student name helps us when we deal with the local school district.”
Even if an ID number is created, the information could still be exposed at the district level, said Glynn Ligon of ESP Solutions Inc., a consulting firm in Austin, Texas, that bills itself as specialists in K-12 data systems.
“I personally think the ruse of getting only the ID number goes only so far in protecting the student’s identity, because it still creates a unique record that is linked back to a personally identifiable record at the local level – and possibly elsewhere,” he said. “Plus, within the record itself, there will be, at times, data or combinations of data that uniquely identify individuals.”
Barbara Clements of ESP Solutions added that system hackers tend to be more successful on a local level.
“Frankly, I haven’t heard of any hackers getting into student records at the state level. They are usually high-school students wanting to change a grade, and they are more likely to go after school district systems,” she said. “There is nothing, really, to gain from state records, which contain only a small portion of what is kept at the local level.”
Clements said that other states’ education departments have adopted different strategies to protect student privacy.
“In some states we have worked with, there was concern about collecting the student name,” Clements said. “Those states have generally either collected the student records without the student name or stripped the name of the record when the data are entered into a data warehouse.
“The name is important to ensure that the student identifier is correct,” she added. “Once that check is done, the name is not really needed at the state level. “
It can be a delicate balancing act to meet all the legal requirements and ensure security.
“Many states have collected records … over the years – without the student’s name,” Ligon said. “The real solution is to have a solid, legal, defensible data access and management policy that complies with FERPA (the Federal Education Rights and Privacy Act), HIPAA (the Health Insurance Portability and Accountability Act, which provides for patient privacy), and your state laws, and allows local policies to be adopted that are consistent.”
OPI officials are beginning to revisit the issue as the current software contract, which calls for the state to pay $435,000 annually, nears the end of its terms.
“We’re doing some research now on what other states with a longer track record have been doing to keep student names separate from ID numbers and accompanying information,” Quinlan said. “There is some precedent for it nationally.”
Additional Facts
Hearing
The Senate Judiciary Committee will hold a hearing on Senate Bill 338, which would protect information and court records relating to children with disabilities, at 9 a.m. Tuesday in room 303 of the state Capitol in Helena.
Link: http://axiomamuse.wordpress.com/2009/02/10/data-collection-sparks-privacy-concerns-mt-public-schools/
