CVA is committed to protecting the privacy of students. Staff should comply with the following OSPI best practices when communicating via email about assessment information:
Question: Is it acceptable to email student or test information?
Answer: To protect student privacy, NEVER send students’ Personally Identifiable Information (PII) via email!
When writing emails to persons outside of your local school or district (other than parents/guardians), and especially when contacting OSPI/state agencies, please remember to avoid including confidential student Personally Identifiable Information all together in an email. Email communications are not secure!
Personally Identifiable Information is the student’s name, birthdate, and the State Student Identification (SSID) number and other private student information not declared as Directory Information.
- When communicating about a student’s case, use only the SSID number or other identifying number.
- The SSID number should not be shared in combination with any other PII, including name, birth date and testing data.
- If you are unsure whether a particular piece of information is both confidential and necessary for OSPI staff, don’t include it in your email communication. OSPI staff will contact you via phone if they require additional information to assist.
OSPI’s policy is to allow OSPI staff to send and receive student information in email, as long as the information is not confidential and cannot alone be used to access the student’s confidential education record.
Also, any communications to assessment@k12.wa.us and assessment.analysts@k12.wa.us should be channeled through the VSD District Assessment Coordinator whenever possible.
EXAMPLES of emails with student information:
BAD: I have a student named Benson Sasquatch, SSID 123456789, born 5/5/99, and I can see that he has a 2330 on the SBA math in SRS, but that’s not showing up in the graduation database and he needs a waiver and the deadline is today, so how do I get that fixed?
GOOD: I have a student with some scores that I can see in SRS that aren’t showing up in the graduation database. The SSID is 123456789. The student needs a waiver and the deadline is a week from now so how do I get that fixed?
In the “good” example, the basic information of the situation is provided without explicitly linking the student to a piece of confidential information. When it is necessary to communicate confidential information, please provide that via phone, fax, or secure email.
In all communications, staff should be mindful of the requirements of the Family Educational Rights and Privacy Act (FERPA), Health Insurance Portability and Accountability Act (HIPAA), and the Protection of Pupil Rights Act (PPRA).