[Wactclc-alma] Potential FERPA violations (Was: Job Reports sent via email)

[Thomas, Kirsti]

The discussion of sending job reports via email made me think about Alma's Scheduled Reports which also go out via email.  That reminded me that I should probably share something I recently found out with the rest of you.

This past Fall Quarter, I disabled all of our Scheduled Reports in Alma that contained patron ID numbers in the original Alma Analytics report after I found out that the Dept. of Education says including student ID numbers in unencrypted email may be a possible FERPA violation.

Scheduled Reports transmit data via unencrypted email.  If the report includes patron ID numbers, then it includes student ID numbers.  So if you've got Scheduled Reports with patron ID numbers, you're regularly sending out student ID numbers in unencrypted emails.

As a form of communication, email is considered to be extremely insecure unless users take active measures to encrypt their messages.  The reasoning is that email can travel through multiple servers on the way to its destination and could theoretically be intercepted at any point during delivery.  So if school employees send unencrypted email with "personally-identifiable information" and someone intercepts that email, then the school has accidentally "released" or "disclosed" that information.


The Dept. of Education Privacy Technical Assistance Center says:



Emailing confidential data. Consider the sensitivity level of the data to be sent over the email. Emailing unprotected [personally-identifiable information] or sensitive data poses a high security risk. It is recommended that organizations use alternative practices to protect transmissions of these data. These practices include mailing paper copies via secure carrier, de-sensitizing data before transmission, and applying technical solutions for transferring files electronically (e.g., encrypting data files and/or encrypting email transmissions themselves).

https://nces.ed.gov/programs/ptac/pdf/ptac-data-security-checklist.pdf



The Dept. of Education National Center for Education Statistics says:



Sending Sensitive Student Data Via Email. There are times when it is necessary for agency staff to send student data via e-mail to an authorized school official. For example, a district may want to confirm that a student has successfully enrolled in the state's virtual school and is making progress. The easiest option is to send the request, with only the student's statewide identifier, to the virtual school for confirmation. Some districts use encrypted e-mails sent through the district's e-mail server. In general, external, unencrypted e-mail should never be used to discuss student-level data. In some circumstances, communication with others outside the firewall and in otherwise unsecure exchange is with a password-protected spreadsheet with a separate communication of the password

https://nces.ed.gov/pubs2016/NFES2016096.pdf


The Dept. of Education recommends that if you have to send "personally-identifiable information" (which includes student ID numbers) via email, you do one of the following:


  1.  Encrypt your email message (Note: this involves pre-sharing a key with the recipient)
     *   Instructions on sending encrypted email:
in Outlook:
https://support.office.com/en-us/article/encrypt-email-messages-373339cb-bf1a-4509-b296-802a39d801dc

on iPhone:
https://support.apple.com/en-us/HT202345

on Android:
It's complicated


  1.  Put the information in a password-protected spreadsheet or document attached to the email. Send a completely separate email with the password for the file.
     *   Instructions for password-protecting Microsoft Office files:
https://support.office.com/en-us/article/add-or-remove-protection-in-your-document-workbook-or-presentation-05084cc3-300d-4c1a-8416-38d3e37d6826


Since Scheduled Reports can't be configured to encrypt or password-protect data from the Analytics reports, we're no longer permitting the use of Scheduled Reports for anything that includes patron ID numbers.  Instead, we create an Alma Desktop widget or have staff check reports in Alma Analytics directly.

I've also requested that library staff no longer send emails containing student ID numbers.  If we need to communicate about a specific student account, I've asked that we either communicate via phone, or we create a Word document or Excel spreadsheet in Office 365 that contains the patron information and share that file with specific staff.

Cheers,

Kirsti S. Thomas
Library Technical Services Manager
Seattle Colleges
kirsti.thomas at seattlecolleges.edu<mailto:kirsti.thomas at seattlecolleges.edu>
206-934-4106

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ctc.edu/pipermail/wactclc-alma_lists.ctc.edu/attachments/20190318/effa3b09/attachment.html>