It is no coincidence that K-12 organizations have become one of the most targeted sectors for cybercriminals seeking access to confidential data. Most student information systems (SIS) contain sought-after information when the goal is to illegally assume another person’s identity. Student and employee data sets most always include full, legal names, dates of birth, and far too often, social security numbers.
While still necessary to maintain employee social security numbers for tax and retirement reporting purposes, I believe it is time for schools and school districts to eradicate student social security numbers from both electronic and paper records, if they have not already done so.
The task may sound simple. However, the reality of accomplishing that feat is complex and must be strategically planned and executed.
The Greeneville City School District is located in the heart of the Appalachian Mountains in rural, eastern Tennessee. Digital records are now the norm; however, certain paper documents are still maintained in various locations throughout the district. The one warehouse in the district is not environmentally controlled with temperatures soaring during Tennessee summers and dipping throughout the winter months. To preserve these historical records, the district has a goal to digitize it all and has engaged with a vendor-partner to accomplish that task.
As the current Assistant Director of Schools for Administration, I have also served as the Chief Technology Officer for the school district for the past 27 years and have certainly observed a rapidly shifting landscape in regard to data security and information management. Never has data management been more critical than it is in today’s environment.
There are so many aspects of data security, privacy, and information management that need to be addressed. Just focusing on the elimination of student social security numbers, the following steps are the ones taken by our rural district and are recommended for others who might be facing this same challenge.
6 Steps to Remove Social Security Numbers from Student Data
1. Assemble a cross-sectional team of stakeholders who have a broad knowledge base. We began by brainstorming and prioritizing what could quickly become an overwhelming project. This is the point in the process at which we identified the importance of eliminating student social security information as our top priority.
2. Identify all sources of student social security information. While it may be obvious to concentrate on SIS, make sure to account for hard copies of such information that may be inside permanent records or other files. This step in the overall process can be laborious. Allow time for team members to speak with teachers, school leaders, special education experts, school secretaries, and others who will likely have pertinent information to help the project progress.
3. Communicate plans across the organization throughout the process. Like any project management endeavor, this one will not be fully successful without a robust, streamlined communication plan to keep all stakeholders involved and engaged. Parents and guardians need to know about your effort and understand the reasons behind it. Teachers need to be involved as they might be asked to provide student information when rostering as part of a software pilot project or other similar task. District leadership team members need to receive regular updates as the work progresses. School boards and local media outlets need to be involved. Invite them to serve on data security teams and work together to accomplish your goals.
4. Develop a strategic plan to address both paper and electronic record scrubbing simultaneously. It is important to have small teams focusing on specific record types. For example, we solicited the help of a couple of great special education teachers to assist our team in purging socials from historical records, which was a substantial task. Our district utilizes PowerSchool as our SIS. Our local PSUG (PowerSchool Users Group) played a tremendous role in developing a plan to begin using a unique pin number in lieu of social security number. They then tested the plan exhaustively in a sandbox environment before moving to the production server.
5. Involve your state education department information systems team. We reached out to the EIS (Education Information System) team at the Tennessee State Department of Education early in our planning stages. The Tennessee EIS platform is critical because all our state education funding is generated based on the student enrollment and attendance data uploaded by local SIS extracts. Our EIS support team were instrumental in helping us map the data fields and prepare for the transition to the unique pin numbers by which students would be uniquely identified and tracked.
6. Stay the course. Any school system with a large amount of data (historical and/or current) must acknowledge that the process of removing student social security numbers will be one that requires focus, endurance, and commitment. Team members may leave. New team members may emerge. It is important to have the process documented and a training plan in place by which information and knowledge transfer can happen quickly and thoroughly.
The Greeneville City School District is now positioned to enroll and serve students without ever seeing or knowing their social security numbers. As a longtime IT professional, I often worry about the fact that many young adults may find themselves applying for college scholarships, seeking a loan to buy that first new car, or filling out an application for a job only to discover that their identity has been stolen as the result of a data breach during their K-12 school years. It gives me a sense of peace to know that social security numbers are not at risk in the district I serve.
