By Audience: K-12 School Officials

The resources on this page are intended for staff and educators of public K-12 schools and school districts. Resources found here typically address FERPA and how it applies to the various day-to-day operations of public schools at the administrative level. Guidance is also provided for specific situations that occur only in the K-12 setting.

Best Practices

Malicious Software Data Breach Presentation

This Malicious Software Data Breach Scenario is an interactive exercise designed to provide participants with the opportunity to experience firsthand the process and pitfalls of responding to a data breach at the organizational level. Over the course of one to two hours, participants explore the scenario of a malicious ransomware incident affecting student information as well as other personally identifiable information (PII) from their organization.

The package includes three parts: Facilitator’s Guide, Presentation, and Exercise Handouts. Please find the additional parts below.

Best Practices

Malicious Software Data Breach Handouts

The package includes three parts: Facilitator’s Guide, Presentation, and Exercise Handouts. Please find the additional parts below.

Best Practices

Password Facilitator Guide

Best Practices

Password Handouts

Best Practices

Password Scenario

Best Practices

Data Breach Scenario Trainings

The Data Breach Scenario Trainings are a series of packaged trainings developed by the Privacy Technical Assistance Center, designed to help educational organizations at all levels conduct internal staff development on data breaches. Each scenario has been developed into a training package, providing ready-to-use resources for the scenario leader(s) and participants.

Guidance

Joint Guidance on the Application of FERPA and HIPAA to Student Health Records

The U.S. Department of Education and the Office for Civil Rights at the U.S. Department of Health and Human Services released updated joint guidance addressing the application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to records maintained on students.

Letters

SPPO response to Michigan on Disclosure of Immunization Status of Students

Letter to a Michigan state legislator on the applicability of the Family Educational Rights and Privacy Act (FERPA) to state reporting requirements concerning students’ immunization records.

Letters

Letter of Finding Regarding Attorney Client Privilege-July 2019

Letter of finding regarding the applicability of FERPA and attorney client privilege.

Guidance

Best Practices for Data Destruction

The Data Destruction Document is a best practices guide on properly destroying sensitive student data after it is no longer needed. It details the life cycle of data and discusses various legal requirements relating to the destruction of data under FERPA, and examines a variety of methods for properly destroying data. The guide also discusses best practices for data destruction and provides some real-world examples of how to implement it within your organization.

Mobile complaint link