How Prince William Counnty schools’ data leak impacts students, families

This article was republished with permission from WTOP’s news partner InsideNoVa.com. Sign up for InsideNoVa.com’s free email subscription today.

Prince William County schools mistakenly shared student and parent personal information with Hazel Health, a third-party partner of the school division.

The division on Dec. 19 sent a notification to the affected families notifying them that on Dec. 16 Hazel Health inadvertently sent a welcome text to families who had not opted into the provider’s service.

Hazel Health is the division’s contracted provider of mental telehealth services to students at no cost to families.

Following the mistaken welcome text, the school system discovered it had “unintentionally disclosed” personal identifiable information for those who had not opted into the service, the division said in its statement to the affected families.

The disclosed information included the following parent contact details: name, mobile phone number, email address, physical address, guardian status, relationship to the student and contact order preference.

Student information included: student ID, district ID, state testing ID, name, gender, birth date, grade level and details related to the child’s school including school code, school name and school address.

As soon as the incident was discovered, the school system “took immediate steps to ensure Hazel Health destroyed the information,” according to the school system’s notification.

“Hazel Health is an approved vendor of PWCS and has met the division’s standards for data security,” the division said. “PWCS has corrected the data file to prevent this error in the future and updated internal processes to prevent similar incidents in the future.”

The school system was unable to provide further information due to most employees being on leave for winter break.

Parent reacts

One parent in the school division, Rochelle, told InsideNoVa she was among the parents who received a text message from Hazel Health despite not enrolling her two children in the service.

Rochelle, who did not want to publicly disclose her last name for fear of retribution by the school system, said she and her husband chose not to enroll their children in the Hazel Health services because she trusted her children to come to them if they needed help.

The opt-out process, she said, was complicated. In the back-to-school packet, parents had the option to opt-in to a number of programs, including the Hazel Health service.

If a parent wanted to opt-out of any of the programs, parents were meant to leave those boxes unchecked. With several opt-in and opt-out options on one page and an electronic signature required to move to the next page, Rochelle said it would have been easy for a parent who’s not tech savvy to accidentally opt-in.

The data leak incident, Rochelle said, gives her “zero faith” in the county to handle and protect her children’s personal information.

While the school system said it took steps to destroy the information shared with Hazel Health, Rochelle was skeptical.

“They can say that they destroyed it. How do you prove that, though?” Rochelle said.

While she said it’s necessary for schools to maintain records on students and hold personal information such as medical history, contact information and beyond, Rochelle said she’d like to see the school system stop including additional services and programs in the back-to-school packet.

Instead, she suggested, if somebody needs access to any of the services the school system provides, they can go directly to the school and ask for the necessary resources.

“Let it be your kids’ information, medical information, emergency detail information, emergency pickup information and that’s it,” Rochelle said of the back-to-school packet.

Federal News Network Logo
Log in to your WTOP account for notifications and alerts customized for you.

Sign up