7 On Your Side shocked to find PGCPS 'confidential' student records exposed to public view
WASHINGTON (ABC7) —
School districts are tasked with keeping sensitive information about students private. But following the death of a Prince George's County teenager, the 7 ON YOUR SIDE I-Team found confidential records available where anyone could see them.
Murdered defending his own mother, the family of Oxon Hill's Keyshaun Mason wanted the world to understand the kind of young man he was when they gathered to honor him one month ago. His mother Lakisha Jenkins told the crowd, "Keyshaun was known in every area of his life."
7 ON YOUR SIDE knows something about him too. Something we shouldn't. Because when the I-Team searched the internet for information about the 14-year-old, we found Mason's confidential student records posted online.
LeRoy Rooker, who previously oversaw the Family Policy Compliance Office for the U.S. Department of Education, said, "It's shocking, it really is, that something like that, so sensitive would ever be in a place where it could inadvertently disclosed"
But Mason's records aren't the only ones we found. 7 ON YOUR SIDE discovered notes from a staffer in the Prince George's County school system. Those notes detail medical and disciplinary information, grades and special needs plans for more than a dozen students at Oxon Hill Middle School.
Rooker explained all that information we found should have been protected by a federal law abbreviated as FERPA, the Family Electronic Rights and Privacy Act. It's like its buddy, HIPAA, but for student records.
It was Rooker's job to enforce FERPA for 21 years in his role with the Department of Education. He tells 7 ON YOUR SIDE the law is designed to make sure the kind of information we stumbled upon stays private.
"What you've showed me would clearly trigger an investigation," Rooker said.
The Department of Education says it's working with Prince George's County to ensure it is in not in violation of FERPA following our discovery. We found the district's information on a website called Weebly.
Jim Jones, associate professor at George Mason University, is a technology security expert. He says Weebly is not the kind of website designed to protect the kind of information we found.
Weebly, according to Jones, is a popular option for educators who want to share notes and work with colleagues and students. It has password protections, but Jones says it's not the kind of site to wave the red flag when secret information goes public.
"Weebly is not designed to do that because they're not expecting sensitive information to be in there," Jones explained.
Parents also were not expecting sensitive information to be on the site. 7 ON YOUR SIDE took printouts of the records we obtained to those whose children were mentioned. Upon seeing the papers, the family of one student told us, "That's something that's confidential between her and her guidance counselor."
The families questioned whether Prince George's County schools planned to notify whether the information had been exposed. But the district wasn't aware the records had been posted until 7 ON YOUR SIDE told them.
A district spokeswoman declined multiple requests for an on-camera interview, telling ABC7 "PGCPS makes every effort to protect confidential information". In a statement the district said the website where the records were found was immediately taken down. But days later 7 ON YOUR SIDE was still able to access a cached version of the records, with information still publicly available on the website.
After notifying the U.S. Department of Education about our findings, the link to the records finally disappeared. But the trouble for the district has not. The agency says it will continue to work with Prince George's County Public Schools to ensure compliance with federal law.
After our discovery and questions about the use of Weebly, PGCPS' spokeswoman Sherrie Johnson said, "We will advise schools that the site should not be used for confidential student information. Understanding that everything in the digital realm runs the risk of being compromised, the district does have comprehensive measures in place to protect our systems from administrative procedures to dedicated staff members."
One family the I-Team spoke with believes her child's information should never have been on the web to begin with, saying, "She appreciates that you guys came here and let her know because clearly they weren't going to let us know because that's a mistake."
Weebly, a third party web hosting platform mentioned in this report, responded to this report with this statement:
"Weebly takes the online posting of private or illegal information very seriously. Posting such content is in direct violation of Weebly's terms of service, and its legal and policy teams respond immediately to abuse claims. Weebly hosts 32 million sites and in this particular case, it appears the site creator failed to utilize Weebly's password protection feature and improperly publicized private student information. If anyone comes across a Weebly-powered site with questionable content, they are highly encouraged to reach out to Weebly to address those concerns."