How Assessing Information Governance Can Improve Privacy in Schools

For public schools, technology is an important tool. But establishing strong security measures to protect student privacy is even more essential.

The K-12 Cybersecurity Act of 2019, a recent bill that has been introduced in the U.S. Senate, calls for the Department of Homeland Security (DHS) to initiate a review of the cybersecurity policies at public schools across the country. This includes developing a more comprehensive set of guidelines and tools so that schools can better protect institutional and personal data from ransomware and other breaches.

Being able to safeguard both school and student data should be apparent, but with limited resources and funding schools are finding it hard to be effective. In addition to the DHS guidelines, once available, schools should look at their records and information management programs. Creating an approach to effectively manage the full information lifecycle will ensure that records — both student and school — are in a better position to remain protected.

Effective Information Governance

Student records and personal data must be strictly governed in educational institutions, beginning when a record is created and continuing through its usage, storage, retrieval and maintenance phases. Information must also be managed with proper security and protection structures in place, especially when it comes to personal and confidential information.

Schools need a formal information governance program to establish a framework that details roles and responsibilities and identifies how records should be treated. This allows schools to effectively manage the growing volumes of information they are seeing and ensures that associated risks are well understood, documented and then controlled so risk mitigation can happen appropriately

But what does a formal information governance program look like?

Privacy Assessments

The first step in information governance is identifying where personal and sensitive data is located throughout a school’s records storage system, and who is responsible for managing those records. An in-depth assessment enables schools to identify gaps and prioritize opportunities for improvement. 

As part of this assessment, it is important to establish a records retention schedule. At the most fundamental level a retention schedule dictates how long to keep documents according to the given regulations that apply to each individual school district.

Information Governance Framework

While assessing, and later improving, a privacy program may seem easy, schools may have constraints that prevent them from making greater strides in protecting their records and information. Building an information governance framework should serve as the next step in the process. Establishing this framework will address issues spanning risk management, retention, compliance and disposition, and is important to give schools increased control over their information, from creating a record to its final disposition. To establish a framework, schools should identify its complete information inventory and develop information maps, which are databases that capture an inventory of what systems, applications and repositories they have, where they are located, and who is responsible for managing them. With this in place, they will be able to better understand their records and information program. Schools can also benefit from an updated retention management platform, a metric system that will measure the alignment of information management outcomes to privacy policies.

Content Classification

Classifying content is the last step in ensuring proper management of records and information. Educational institutions should develop an enterprise strategy that applies to both the pick-up of new, physical records, the digitization of these records, and the training of access, archiving and destruction requirements. This component sees an establishment of both accurate and fast-processing search engines, a reduced amount of legacy records and storage costs, improved service responsiveness, and the identification of records that can be eliminated to support space management requirements.

Access Controls

In addition to the steps outlined above, for privacy purposes it’s critically important to maintain access control policies and effective chain of custody procedures. This includes developing a step-by-step process to ensure complete security and should include using a unique identifier for location tracking as well as assigning certain levels of access to individuals depending on roles and responsibilities.

Conclusion

As security and privacy of records and information in schools continues to be one of the most pressing issues today, it is critical that school systems focus on their information governance program. Privacy starts with the ability to protect student records that are constantly being produced and stored. By executing a more detailed and managed framework, schools can worry less about breaches and more about their mission of education.

About the Author

Mary Ellen Buzzelli is Director State, Local and Education Strategy at Iron Mountain Government Solutions.


Featured

  • Abstract geometric pattern with interconnected nodes and lines

    Microsoft 365 Copilot Updates Offer Expanded AI Capabilities, Collaboration Tools

    Microsoft has announced updates to its Microsoft 365 Copilot AI assistant, including expanded AI capabilities in individual apps, the ability to create autonomous agents, and a new AI-powered collaboration workspace.

  • An open book with text transforming into smooth lines represents reading ease

    Fluency Innovator Grants to Award Free Subscriptions to WordFlight Literacy Intervention Solution

    The call for applications is now open for Foundations in Learning's Fall 2024 Fluency Innovator Grants program. Teachers and administrators from schools and districts serving grades 3-8 may apply to receive a free subscription to WordFlight, a literacy assessment and intervention solution for students with deficits in reading fluency and comprehension, for the Fall 2024 semester.

  • AI-themed background with sparse circuit lines and minimal geometric shapes

    Microsoft to Introduce AI Agent Building Tools in Copilot Studio

    In November, Microsoft plans to roll out a public preview of a new feature within Copilot Studio, allowing users to create autonomous AI "agents" designed to handle routine tasks.

  • landscape photo with an AI rubber stamp on top

    California AI Watermarking Bill Supported by OpenAI

    OpenAI, creator of ChatGPT, is backing a California bill that would require tech companies to label AI-generated content in the form of a digital "watermark." The proposed legislation, known as the "California Digital Content Provenance Standards" (AB 3211), aims to ensure transparency in digital media by identifying content created through artificial intelligence. This requirement would apply to a broad range of AI-generated material, from harmless memes to deepfakes that could be used to spread misinformation about political candidates.