DAR File No. 39375

Education, Administration

Rule R277-487

Public School Data Confidentiality and Disclosure

Notice of Proposed Rule

(Amendment)

DAR File No.: 39375
Filed: 05/15/2015 07:02:16 AM

RULE ANALYSIS

Purpose of the rule or reason for the change:

Rule R277-487 is amended to provide procedures and requirements for local education agencies (LEAs) that work with a third party provider; requires a third party provider that works with an LEA to comply with student privacy and data requirements. Similar procedures in Section R277-419-9, which will be removed, are incorporated into two new rules and this amended rule.

Summary of the rule or change:

Changes to Rule R277-487 include adding and revising definitions, incorporating language from Section R277-419-9 into Section R277-487-3 and Section R277-487-12, and making numerous technical changes throughout the rule. (DAR NOTE: The proposed new rule, R277-417, is under DAR No. 39372, and the other proposed new rule, R277-418, is under DAR No. 39373. The proposed amendment to Rule R277-419 is under DAR No. 39374 in this issue, June 1, 2015, of the Bulletin.)

State statutory or constitutional authorization for this rule:

• Subsection 53A-13-301(4)
• Art X Sec 3
• Section 53A-1-411
• Subsection 53A-1-401(3)
• Subsection 53A-8a-410(4)

Anticipated cost or savings to:

the state budget:

Procedures in Rule R277-487 affect LEAs and third party providers so it is anticipated that there is likely no cost or savings to the state budget.

local governments:

It is anticipated that there is likely no cost or savings to local government (LEAs) because the procedures currently in Section R277-419-9 are merely incorporated into Rule R277-487.

small businesses:

It is anticipated that there is likely no cost or savings to small businesses (third party providers) because the procedures currently in Section R277-419-9 are merely incorporated into Rule R277-487.

persons other than small businesses, businesses, or local governmental entities:

Procedures in Rule R277-487 affect LEAs and third party providers so it is anticipated that there is likely no cost or savings to persons other than small businesses, businesses, or local government entities.

Compliance costs for affected persons:

There is likely no compliance costs for affected persons because the procedures currently in Section R277-419-9 are merely incorporated into Rule R277-487.

Comments by the department head on the fiscal impact the rule may have on businesses:

I have reviewed this rule and believe that there is likely no fiscal impact on businesses.

Brad C. Smith, State Superintendent

The full text of this rule may be inspected, during regular business hours, at the Division of Administrative Rules, or at:

Education
Administration
250 E 500 S
SALT LAKE CITY, UT 84111-3272

Direct questions regarding this rule to:

• Angela Stallings at the above address, by phone at 801-538-7656, by FAX at 801-538-7768, or by Internet E-mail at angie.stallings@schools.utah.gov

Interested persons may present their views on this rule by submitting written comments to the address above no later than 5:00 p.m. on:

07/01/2015

This rule may become effective on:

07/08/2015

Authorized by:

Angela Stallings, Associate Superintendent, Policy and Communication

R277. Education, Administration.

R277-487. Public School Data Confidentiality and Disclosure.

R277-487-1. Definitions.

A. "Board" means the Utah State Board of Education.

B. "Chief Privacy Officer" means a USOE employee designated by the Board as primarily responsible to oversee and direct the DGPB to carry out the responsibilities of this rule, direct the development of materials and training about student and public education employee privacy and security standards, including FERPA, for the USOE and LEAs.

C. "Classroom-level assessment data" means student scores on state-required tests, aggregated in groups of more than 10 students at the classroom level or, if appropriate, at the course level, without individual student identifiers of any kind.

D. "Comprehensive Administration of Credentials for Teachers in Utah Schools (CACTUS)" means the electronic file maintained and owned by the USOE on all licensed Utah educators. The file includes information such as:

(1) personal directory information;

(2) educational background;

(3) endorsements;

(4) employment history; and

(5) a record of disciplinary action taken against the educator.

E. "Data Governance/Policy Board (DGPB)" means a board composed of USOE and LEA employees, as directed by the Board, whose purpose is to resolve public education data and process issues, make policy decisions, review all research requests for public education data, and fill only those requests that are appropriate and comply with the standards in this rule.

F. "Data security protections" means protections developed and initiated by the Chief Privacy Officer and the DGPB that protect, monitor and secure student, public educator and public education employee data as outlined and identified in FERPA and Sections 63G-2-302 through 63G-2-305.

G. "Disciplinary action" means any lesser action taken by UPPAC which does not materially affect a licensed educator's license and licensing action taken by the Board for suspension or revocation.

H. "Enrollment verification data" includes:

(1) a student's birth certificate or other verification of age;

(2) verification of immunization or exemption from immunization form;

(3) proof of Utah public school residency;

(4) family income verification; or

(5) special education program information, including:

(a) an individualized education program;

(b) a Section 504 accommodation plan; or

(c) an English learner plan.

[H]I. "FERPA" means the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. 1232g, a federal law designed to protect the privacy of students' education records. The law is hereby incorporated by reference.

[I]J. "LEA" [means]or "local education agency "[, including local school boards/public]means a school district[s], charter school[s, and] or, for purposes of this rule, the Utah Schools for the Deaf and the Blind.

[J]K. "Personally identifiable student information" means the student's name; a personal identifier, such as the student's social security number or student number; other indirect identifiers such as the student's date of birth or place of birth; other information that, alone or in combination, is linked or linkable to a specific student and enables a person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or information requested by a person who the educational agency or institution reasonably knows is entitled to the requested information.

[K]L. "Student information" means materials, information, records and knowledge that an LEA possesses or maintains, or both, about individual students. Student information is broader than student records and personally identifiable student information may include information or knowledge that school employees possess or learn in the course of their duties.

[L]M. "Student performance data" means data relating to student performance, including data on state, local and national assessments, course-taking and completion, grade-point average, remediation, retention, degree, diploma, or credential attainment, enrollment, and demographic data.

N. "Superintendent" means the State Superintendent of Public Instruction or the Superintendent's designee.

O. "Third party provider" means a third party who provides educational services on behalf of an LEA.

[M]P. "USOE" means the Utah State Office of Education.

 

R277-487-2. Authority and Purpose.

A. This rule is authorized under Utah Constitution Article X, Section 3 which vests general control and supervision over public education in the Board, by Section 53A-1-401(3) which allows the Board to make rules in accordance with its responsibilities; by Section 53A-13-301([3]4) [regarding confidentiality and required or appropriate disclosure of personally identifiable student information]which directs the Board to makes rules to establish standards for public education employees, student aides, and volunteers in public schools regarding the confidentiality of student information and student records; [by Section 53A-1-607(2) regarding disclosure of student performance data to LEAs for assessment and accountability purposes; ]by Section 53A-8a-410(4) which directs the Board to make rules to ensure the privacy and protection of individual[educator] evaluation data; [by Section 53A-3-602.5 regarding a school performance report requiring criterion-referenced or online computer adaptive tests to be aggregated for all students by class; ]and by Section 53A-1-411 which directs the Board to establish procedures for administering or making available online surveys to obtain information about public education issues[; and by Section 53A-6-104 which authorizes the Board to issue licenses to educators and maintain licensing information].

B. The purpose of this rule is to:

(1) provide for appropriate review and disclosure of student performance data on state administered assessments as required by law;

(2) provide for adequate and appropriate review of student performance data on state administered assessments to professional education staff and parents of students;

(3) ensure the privacy of student performance data and personally identifiable student information, as directed by law;

(4) provide an online education survey conducted with public funds for Board review and approval; and

(5) provide for appropriate protection and maintenance of educator licensing data.

 

R277-487-3. Data Privacy and Security Policies.

A. Board Responsibilities:

(1) The [Board]Chief Privacy Officer and DGPB shall develop resource materials for LEAs to train employees, aides, and volunteers of an LEA regarding confidentiality of personally identifiable student information and student performance data, as defined in FERPA.

(2) The [Board]Chief Privacy Officer and DGPB shall make the materials available to each LEA.

B. LEA Responsibilities:

(1) An LEA is responsible for the collection, maintenance, and transmission of student data.

([1]2) An LEA[s] shall establish policies and provide appropriate training for employees regarding the confidentiality of student performance data and personally identifiable student information[, including an overview of all federal, state, and local laws that pertain to the privacy of students, their parents, and their families. The policy should address the specific needs or priorities of the LEA].

([2]3) [LEAs shall require password protection for all student performance data and personally identifiable student information maintained electronically]An LEA shall provide the policies described in R277-487-3B(2) to parents of students affected by the policies, as well as post the policies for the public on the LEA's website.

(4) An LEA shall ensure that school enrollment verification data, student performance data, and personally identifiable student information are collected, maintained, and transmitted:

(a) in a secure manner; and

(b) consistent with sound data collection and storage procedures, established by the LEA.

(5) An LEA may contract with a third party provider to collect, maintain, and have access to school enrollment verification data or other student data if:

(a) the third party provider meets the definition of a school official under 34 CFR 99.31 (a)(1)(i)(B);

(b) the contract between the LEA and the third party provider includes a provision that the data is the property of the LEA; and

(c) the LEA monitors and maintains control of the data.

(6) If an LEA contracts with a third party provider to collect and have access to the LEA's data as described in R277-487-3B(5), the LEA shall notify a student and the student's parent or guardian in writing that the student's data is collected and maintained by the third party provider.

(7) As required in Section 53A-13-301, an LEA shall notify the parent or guardian of a student if there is a release of the student's personally identifiable student data due to a security breach.

C. Public Education Employee and Volunteer Responsibilities:

(1) All public education employees, aides, and volunteers in public schools shall become familiar with federal, state, and local laws regarding the confidentiality of student performance data and personally identifiable student information.

(2) All public education employees, aides, and volunteers shall maintain appropriate confidentiality pursuant to federal, state,[ and] local laws, and LEA policies created in accordance with this section, with regard to student performance data and personally identifiable student information.

[(3) An employee, aid, or volunteer shall maintain student performance data and personally identifiable student information in a secure and appropriate place as designated by LEA policies.

(4) An employee, aid, or volunteer accessing student performance data and personally identifiable student information in electronic format shall comply with LEA policies regarding the procedures for maintaining confidentiality of electronic records.

] ([5]3) An employee, aide, or volunteer [shall]may not share, disclose, or disseminate passwords for electronic maintenance of :

(a) student performance data ; [and]or

(b) personally identifiable student information.

[(6) All public education employees, aids and volunteers have a responsibility to protect confidential student performance data and personally identifiable student information and access records only as necessary for their assignment(s).

] ([7]4) A [P]public education employee[s] licensed under Section 53A-6-104 [shall]may access [and]or use student information and records if the public education employee accesses the student information or records consistent with R277-515, Utah Educator Standards.[Violations may result in licensing discipline.]

(5) A public education employee may be disciplined in accordance with licensing discipline procedures if the public education employee violates this R277-487.

 

R277-487-4. Transparency.

A. The Chief Privacy Officer working with the DGPB shall recommend USOE policies for Board approval and model policies for LEAs regarding the state's student data systems.

B. The Chief Privacy Officer shall ensure that the [R]rules/policies[shall] address:

(1) accessibility to parents, students and the public of the student performance data[defined in R277-487-1];

(2) authorized purposes, uses , and disclosures of data maintained by the [state]Superintendent and LEAs;

(3) the rights of parents and students regarding their personally identifiable information under state and federal law;

(4) parent, student and public access to information about student data privacy and the security safeguards that protect the data from unauthorized access and use; and

(5) contact information for parents and students to request student and public school information from LEAs consistent with the law.

 

R277-487-5. Additional Responsibilities of Chief Privacy Officer and DGPB.

A. The Chief Privacy Officer may [pursue]recommend legislation , as approved by the Board , for additional data security protections and the regulation of use of the data.

B. The Chief Privacy Officer shall supervise regular privacy and security compliance audits, following initiation by the Board.

C. The Chief Privacy Officer and the DGPB shall have responsibility for identification of threats to data security protections.

D. The Chief Privacy Officer and the DGPB shall develop and recommend policies for [USOE]the Superintendent and model policies for LEAs for consistent wiping or destruction of devices when devices are discarded by public education entities.

E. The Chief Privacy Officer and the DGPB shall develop USOE and model LEA policies for the training of staff for appropriate responses to suspected or known breaches of data security protections.

 

R277-487-6. Prohibition of Public Education Data Use for Marketing.

Data maintained by the state, school districts, schools, and other public education agencies or institutions in the state, including data provided by contractors, [shall]may not be sold or used for marketing purposes (except with regard to authorized uses or directory information not obtained through a contract with an educational agency or institution).

 

R277-487-7. Public Education Research Data.

A. The [USOE]Superintendent may provide limited or extensive data sets for research and analysis purposes to qualified researchers or organizations.

(1) [A]The Superintendent shall use reasonable methods [shall be used ]to qualify researchers or organizations to receive data, such as evidence that a research proposal has been approved by a federally recognized Institutional Review Board (IRB).

(2) Aggregate de -identified student assessment data [are]is available through the USOE website. The Superintendent shall ensure that [P]personally identifiable student information is protected.

(3) The [USOE]Superintendent is not obligated to fill every request for data and [has]shall establish procedures to determine which requests will be filled or to assign priorities to multiple requests. The [USOE/Board understands that it will]Superintendent shall respond in a timely manner to all requests submitted under Section 63G-2-101 et seq., Government Records Access and Management Act. In filling data requests, the Superintendent may give higher priority[may be given] to requests that will help improve instruction in Utah's public schools.

(4) [A fee may be charged]The Superintendent may charge a fee to prepare data or to deliver data, particularly if the preparation requires original work. The [USOE]Superintendent shall comply with Section 63G-2-203 in assessing fees for responses to GRAMA requests.

(5) The researcher or organization shall provide a copy of the report or publication produced using USOE data to the USOE at least 10 business days prior to the public release.

B. Student data and information: Requests for data that disclose student information shall be provided in accordance with the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. Section 1232g; such responses may include:

(1) student data that are de -identified, meaning that a reasonable person in the school community who does not have personal knowledge of the relevant circumstances could not identify student(s) with reasonable certainty;

(2) agreements with recipients of student data where recipients agree not to report or publish data in a manner that discloses students' identities. For example, reporting test scores for a race subgroup that has a count, also known as n-size, of less than 10 could enable someone to identify the actual students and shall not be published;

(3) release of student data, with appropriate binding agreements, for state or federal accountability or for the purpose of improving instruction to specific student subgroups.

C. Licensed educator information:

(1) The [USOE]Superintendent shall provide information about licensed educators maintained in the CACTUS database that is required under Section 63G-2-301(2).

(2) [Additional]The Superintendent may release information/data[may be released by the USOE]:

(a) consistent with the purposes of CACTUS[,];

(b) if the requester accepts the confidentiality protections [accepted by requester(s),]established by the Superintendent; and

(c) [the benefit that]if the research may provide a benefit for public education in Utah, as determined by the [USOE]Superintendent.

D. Recipients of USOE research data shall sign a USOE-designated confidentiality agreement, if required by the [USOE]Superintendent.

E. The Board or the [USOE]Superintendent may commission research or may approve research requests.

 

R277-487-8. Public Education Survey Data.

A. The Chief Privacy Officer, working with the DGPB, shall approve statewide education surveys administered with public funds through the USOE or through a contract issued by the USOE, as required under Section 53A-1-411.

B. Data obtained from Board statewide surveys administered with public funds are the property of the Board.

C. Data obtained from Board statewide surveys administered with public funds shall be made available as follows:

(1) Survey data made available by the Board shall protect the privacy of students in accordance with FERPA.

(2) The Superintendent shall ensure that [S]survey data about educators [shall be available]is provided to a requester in a manner that protects the privacy of individual educators consistent with State law.

 

R277-487-9. Comprehensive Administration of Credentials for Teachers in Utah Schools (CACTUS) Data, Confidentiality, and Appropriate Disclosure.

A. CACTUS maintains[public, protected and private] information on licensed Utah educators[. Private or protected information includes such items as home address, date of birth, social security number, and any disciplinary action taken against an individual's license.], including information classified as private, controlled, or protected under GRAMA.

B. [A CACTUS file shall be opened on]The Superintendent shall open a CACTUS file for a licensed Utah educator when:

(1) the individual initiates a USOE background check, or

(2) the USOE receives a paraprofessional license application from an LEA.

C. The data in CACTUS may only be changed as follows:

(1) Authorized USOE staff or authorized LEA staff may change demographic data.

(2) Authorized USOE staff may update licensing data such as endorsements, degrees, license areas of concentration and licensed work experience.

(3) Authorized employing LEA staff may update data on educator assignments for the current school year only.

D. A licensed individual may view his own personal data. An individual may not change or add data except under the following circumstances:

(1) A licensed individual may change his demographic data when renewing his license.

(2) A licensed individual shall contact his employing LEA for the purpose of correcting demographic or current educator assignment data.

(3) A licensed individual may petition the USOE for the purpose of correcting any errors in his CACTUS file.

E. Individuals currently employed by public or private schools under letters of authorization or as interns are included in CACTUS.

F. Individuals working in LEAs as student teachers are included in CACTUS.

G. Designated individuals have access to CACTUS data:

(1) Training shall be provided to designated individuals prior to granting access.

(2) Authorized USOE staff may view or change CACTUS files on a limited basis with specific authorization.

(3) For employment or assignment purposes only, authorized LEA staff members may access data on individuals employed by their own LEA or data on licensed individuals who do not have a current assignment in CACTUS.

(4) Authorized LEA staff may also view specific limited information on job applicants if the applicant has provided the LEA with a CACTUS identification number.

(5) CACTUS information belongs solely to the USOE. The USOE shall make the final determination of information included in or deleted from CACTUS.

(6) CACTUS data [consistent with Section 63G-2-301(1) under the Government Records Access and Management Act are public information and shall be released by the USOE]may only be released in accordance with the provisions of GRAMA.

 

R277-487-10. Educator Evaluation Data.

A. The [Board]Superintendent shall provide classroom-level assessment data to administrators and teachers. School administrators shall share information requested by parents while ensuring the privacy of individual student information and educator evaluation data.

B. Individual educator evaluation data shall be protected at the school, LEA and state levels and, if applicable, at the USOE.

C. LEAs shall designate employees who may have access to educator evaluation records.

D. LEAs may not release or disclose student assessment information that reveals educator evaluation information or records.

E. LEAs shall train employees in the confidential nature of employee evaluations and the importance of securing evaluations and records.

 

R277-487-11. Training and Technical Assistance.

A. The Chief Privacy Officer and DGPB shall develop training for the Board, the USOE and LEAs.

B. The Chief Privacy Officer and DGPB shall develop model policies, as resources permit.

 

R277-487-12. Application to Third Party [Vendors]Providers and Contractors.

A. The USOE and LEAs shall [have]set policies that [expressly limit]govern a third party provider or contractor's access to personally identifiable student data and public school enrollment verification data[to third party vendors and contractors].

B. [Personally identifiable student information may only be released consistent with the provisions of 34 CFR Part 99.31(a).

C. De-identified student data and information may only be released consistent with 34 CFR Part 99.31(b)]An LEA may release Student information and public school enrollment verification data to a third party provider if:

(1) the release is allowed by, and released in accordance with, FERPA and its implementing regulations; and

(2) if the LEA complies with the requirements of R277-487-3B.

[D]C. CACTUS or public education employee information may only be released consistent with state law, with express permission of the licensed individual or employee , or with the purposes for which the information was entered into CACTUS or a similar employee database.

[E]D. Sanctions for violations of authorized use and release of student and employee data:

(1) All USOE contracts shall include sanctions for contractors or third party [vendors]providers who violate provisions of state policies regarding unauthorized use and release of student and employee data.

(2) The [USOE]Superintendent shall recommend that LEA policies include sanctions for contractors or third party [vendors]providers who violate provisions of federal or state privacy law and LEA policies regarding unauthorized use and release of student and employee data.

 

R277-487-13. Annual Reports by Chief Privacy Officer and DGPB.

A. The Chief Privacy Officer[ shall work with the DGPB, the USOE, and the Board to prepare an annual report about student data], with the assistance of DGPB, shall submit to the Board an annual report about student data.

B. The public report shall include:

(1) information about the implementation of this rule;

(2) information about research studies begun or planned using student information and data;

(3) [the ]identification of significant threats to student data privacy and security;

(4) a summary of data system audits; and

(5) recommendations for further improvements specific to student data security and the systems that are necessary for accountability in Board rules or legislation[:

(1) Board rules;

(2) legislation; or

(3) both Board rules and legislation, if appropriate].

 

KEY: students, records, confidentiality

Date of Enactment or Last Substantive Amendment: [January 7, ]2015

Notice of Continuation: November 14, 2014

Authorizing, and Implemented or Interpreted Law: Art X Sec 3; 53A-13-301([3]4); 53A-1-401(3); 53A-1-411; 53A-8a-410(4)