Exclusive: Virginia鈥檚 Fairfax Schools Expose Thousands of Sensitive Student Records
In an apparent accident, the district released a trove of confidential documents on special ed and mental health to one of its most outspoken critics.
By Linda Jacobson | November 1, 2023Virginia鈥檚 Fairfax County Public Schools disclosed tens of thousands of sensitive, confidential student records, apparently by accident, to a parent advocate who has been an outspoken critic of its data privacy record.
The documents identify current and former special education students by name and include letter grades, disability status and mental health data. In one particularly sensitive disclosure, a counselor identified over 60 students who’ve struggled with issues like depression, including those who have engaged in self-harm or been hospitalized.
A letter from the district to the state provides copious details about the condition and care of a medically fragile fourth grader. And a document containing 鈥渁ttorney work product鈥 marked 鈥減rivileged and confidential鈥 references a pair of Title IX cases. It identifies two students as 鈥淛ane Doe鈥 鈥 a common practice with alleged victims of sexual assault or harassment 鈥 but then names the students in parentheses.
The disclosure of private student data is likely the largest since 2020, when the hacker group MAZE , including Social Security numbers and birthdates, on over 170,000 students and employees in the nation鈥檚 13th-largest district. But this time, it looks like human error, rather than ransomware, was to blame.
鈥淲hy worry about people from the outside?鈥 asked Callie Oettinger, who received the recent document collection. 鈥淭hey鈥檝e got the door wide open from the inside.鈥
Oettinger, a parent and special education advocate with a long and contentious relationship with Fairfax administrators, went to a school on three consecutive days last month to examine her children鈥檚 files 鈥 data such as test scores, attendance records and audio recordings of meetings she鈥檚 been requesting for years. In addition to boxes of paper files, the district provided her with thumb drives and computer discs that Oettinger estimates include personal data on roughly 35,000 students.
Parents who have challenged the district over special education services said the leak opens their children to further harm. Among the records released to Oettinger was a 2019 email exchange in which officials questioned the cost of an independent educational evaluation for Julie Melear’s son, who has dyslexia.
鈥淚s my kid, for the rest of his life, going to have to look over his shoulder to see what Fairfax is putting out there?鈥 asked Melear, who had three children in the district and now lives in Denver.
The latest disclosure is not an isolated incident. Oettinger, who also runs a special education , said the district has repeatedly released information on her now 19-year-old son to other parents and unauthorized staff and, on at least six occasions between 2016 and 2021, provided her with documents on children who are not her own. One was a 2020 internal on special education that included students鈥 names, their attorneys and costs for services.
But those instances seem small compared to the volume of records she received in October, which span the years 2019 to 2021. It also comes four years after the district鈥檚 former superintendent apologized to Oettinger for a similar disclosure and two years after a county judge ruled against Fairfax in a case related to leaked student records.
Contacted last week, Fairfax officials 鈥 who pledged to improve security after the 2020 breach 鈥 appeared unaware they had given Oettinger access to students鈥 personal data. The district鈥檚 communications office forwarded an inquiry from The 74 to Molly Shannon, who manages the district鈥檚 public records office. In an email, Shannon asked a reporter to identify who accessed the records and where it occurred 鈥漵o we can investigate and remediate the issue at the school, notify any affected families, and work with the parent to ensure other students’ information is properly secured.鈥
Under , the district is required to alert parents 鈥渁s soon as practicable鈥 if there鈥檚 a violation under the Family Educational Rights and Privacy Act, or FERPA.
The records release is the latest dilemma for Virginia鈥檚 largest school system, which has come under intense scrutiny for its handling of special education. Following a federal civil rights probe last year, to make up for services it failed to provide to students with disabilities during the pandemic. For years, federal officials the state to improve its monitoring of districts to ensure they鈥檙e complying with all special education laws. As recently as February, they told former state Superintendent Jillian Balow that remained a sticking point.
Data leaks linked to are not unique to Fairfax. In 2017, for example, the Chicago Public Schools posted , including health conditions and birthdates, to unsecured websites. Time-consuming records requests to school districts have also skyrocketed in recent years, fueled in part by controversies over COVID protocols, library books and curriculum. Many districts have struggled to keep up, but one expert said Fairfax shouldn鈥檛 be one of them.
鈥淚 have a lot more sympathy for the many, many small districts,鈥 said Amelia Vance, founder and president of the Public Interest Privacy Center. But with an annual $3.5 billion budget, Fairfax, she said, 鈥渃ertainly seems to have the resources and they’ve had these requests for years. If they don’t have a system to respond in a protective manner, in an efficient manner, that’s on them.鈥
Phyllis Wolfram, executive director of the Council of Administrators of Special Education, a national organization, said she doesn鈥檛 think it鈥檚 common for districts to release students鈥 files to the wrong parent. But if record requests are increasing, she said, security should be tighter.
鈥淕iven the shortage of school staff all around, we must be extra vigilant and ensure high-quality training for all staff,鈥 she said.
鈥楶rocess and protocols鈥
FERPA is that gives parents the right to examine their children鈥檚 educational records. Oettinger said she asked to see original documents in person 鈥 after the state overruled the district鈥檚 initial refusal 鈥 because past responses have been incomplete or contained electronic files that didn鈥檛 open.
She said she is unsure who in the district ultimately signed off on the recent release. On Oct. 16th, she received an email from Shannon saying the records were ready. From Oct. 17 to 19, she sat in a small room next to the main office of her local high school and viewed the files. A paralegal from the central office supervised as she copied records to thumb drives and scanned paper documents on her phone, Oettinger said. He offered assistance and even called in an IT expert when a media file didn鈥檛 open. She recorded everything and shared audio files of her visit with The 74. Ironically, she said, some of her own children鈥檚 records are still missing.
At one point, she spotted an unredacted document with a teacher鈥檚 notes and suspected there were more. But she said she didn鈥檛 realize the full scope of the disclosure until she began reviewing the files at home.
She filed a complaint with the U.S. Department of Education鈥檚 Office for Civil Rights on Oct. 20 and contacted a handful of parents she knows with children named in the documents.
Oettinger said she didn鈥檛 report the leak to district officials because she doesn鈥檛 trust them 鈥 a skepticism that has only intensified over time. When her son had reading difficulties in elementary school, educators responded three times that an evaluation 鈥渋s not warranted,鈥 according to district records and, she said, told her that boys learn to read slower than girls.
鈥淵ou get one chance with your kid, and there鈥檚 no handbook,鈥 she said. 鈥淚n special education especially, nobody knows what to do. All you know is that you鈥檙e fighting.鈥
It took an independent evaluation for her son to be diagnosed with dyslexia, and by seventh grade, he had an Individualized Education Program, a plan that outlines the services a district is obligated to provide students with disabilities. Like thousands of Fairfax parents, she also complained that the district failed to follow that plan during the pandemic. He graduated in 2022, but her daughter remains a Fairfax student.
As she navigated the system for her son, she became a sounding board for other families. She launched her website, Special Education Action, in 2020. She鈥檚 filed at least 100 complaints with the state education department over special education services in the district and another dozen with the federal civil rights office, of which at least two have resulted in investigations. Her persistence 鈥 sending detailed, sometimes biting, emails and pressing for answers to all her questions 鈥 has earned her a reputation for 鈥渂erating鈥 staff, according to one 2019 email from Dawn Schaefer, director of the district office that handles special education complaints.
鈥淚t鈥檚 obvious you don鈥檛 know what you鈥檙e talking about, so let me break it down for you,鈥 Oettinger wrote in a 2020 email to a staff person regarding a diagnosis for her son.
In addition to requests for documents on her own children, she submits Freedom of Information Act requests with the district each year for more general data that she uses in her advocacy role. In one internal 2020 email she obtained, John Cafferky, an attorney who handles special education cases for the district, said she files them because she鈥檚 鈥渨aiting for someone to slip up.鈥
District officials have promised her they would do a better job of safeguarding student privacy. In a 2019 email exchange with former Superintendent Scott Brabrand, Oettinger reported multiple cases of school staff forwarding information about her son to the wrong people.
鈥淚 am sorry to report that the school did make a mistake and unintentionally provided information about your son to another parent,鈥 he responded. 鈥淲e take student privacy very seriously. Following our process and protocols is paramount to ensuring we protect student information.鈥
Following the 2020 ransomware incident, the district and released a statement saying it was 鈥渃ommitted to protecting the information of our students, our staff, and their families.鈥 The state also stepped in to help the district clean up its 鈥渋nternal practices, and ensure it should not happen again,鈥 state Superintendent Lisa Coons told The 74.
But it did.
In 2021, another Fairfax parent, Debra Tisler, filed a public records request seeking invoices for legal services in an attempt to learn how much Fairfax was spending on attorneys鈥 fees related to students with disabilities. The district released records that included personal information on about a dozen students.
Tisler shared the files with Oettinger, who posted , with names blacked out, on her website. The district to get the records back, but lost the case.
Judge Richard Gardiner, who heard the lawsuit in a Fairfax County district court, said the records were 鈥渙btained quite lawfully.鈥
鈥淭he [district], for whatever reason 鈥 maybe it was ineptness, I don’t know; I have no evidence on that 鈥 made the decision to turn over the information, and they’re stuck with that,鈥 he said, according to of the hearing.
Following the lawsuit, an from December 2022 showed the district鈥檚 in-house attorneys didn鈥檛 finish redacting students鈥 personal information before its records office released the documents. Fairfax instituted new procedures to ensure records go through multiple reviews, including checks by a paralegal and a staff attorney. The district also to keep up with demand.
鈥楤asic data protection鈥
But it appears the system broke down. Some parents whose records ended up in the recently released files said they weren鈥檛 surprised because they, too, have previously received documents pertaining to other students.
鈥淪ome of the information I found out about other people’s children I don’t want to know,鈥 said Melear, the parent who relocated to Denver.
In the files released to Oettinger, Torey Vanek鈥檚 daughter was included on a spreadsheet of students who receive special education services or accommodations for a disability. A ninth grader at Woodson High School, her daughter has dyslexia.
“There is a joint frustration among many parents in Fairfax,” Vanek said. “Part of me is not surprised, but part of me is like this is just basic data protection.”
Get stories like these delivered straight to your inbox. Sign up for The 74 Newsletter
