How Prince William County schools’ data leak impacts students, families

This article was republished with permission from WTOP鈥檚 news partner . Sign up for

Prince William County schools mistakenly shared student and parent personal information with Hazel Health, a third-party partner of the school division.

The division on Dec. 19 sent a notification to the affected families notifying them that on Dec. 16 Hazel Health inadvertently sent a welcome text to families who had not opted into the provider鈥檚 service.

Hazel Health is the division鈥檚 contracted provider of mental telehealth services to students at no cost to families.

Following the mistaken welcome text, the school system discovered it had 鈥渦nintentionally disclosed鈥� personal identifiable information for those who had not opted into the service, the division said in its statement to the affected families.

The disclosed information included the following parent contact details: name, mobile phone number, email address, physical address, guardian status, relationship to the student and contact order preference.

Student information included: student ID, district ID, state testing ID, name, gender, birth date, grade level and details related to the child鈥檚 school including school code, school name and school address.

As soon as the incident was discovered, the school system 鈥渢ook immediate steps to ensure Hazel Health destroyed the information,鈥� according to the school system鈥檚 notification.

鈥淗azel Health is an approved vendor of PWCS and has met the division鈥檚 standards for data security,鈥� the division said. 鈥淧WCS has corrected the data file to prevent this error in the future and updated internal processes to prevent similar incidents in the future.鈥�

The school system was unable to provide further information due to most employees being on leave for winter break.

Parent reacts

One parent in the school division, Rochelle, told InsideNoVa she was among the parents who received a text message from Hazel Health despite not enrolling her two children in the service.

Rochelle, who did not want to publicly disclose her last name for fear of retribution by the school system, said she and her husband chose not to enroll their children in the Hazel Health services because she trusted her children to come to them if they needed help.

The opt-out process, she said, was complicated. In the back-to-school packet, parents had the option to opt-in to a number of programs, including the Hazel Health service.

If a parent wanted to opt-out of any of the programs, parents were meant to leave those boxes unchecked. With several opt-in and opt-out options on one page and an electronic signature required to move to the next page, Rochelle said it would have been easy for a parent who鈥檚 not tech savvy to accidentally opt-in.

The data leak incident, Rochelle said, gives her 鈥渮ero faith鈥� in the county to handle and protect her children鈥檚 personal information.

While the school system said it took steps to destroy the information shared with Hazel Health, Rochelle was skeptical.

鈥淭hey can say that they destroyed it. How do you prove that, though?鈥� Rochelle said.

While she said it鈥檚 necessary for schools to maintain records on students and hold personal information such as medical history, contact information and beyond, Rochelle said she鈥檇 like to see the school system stop including additional services and programs in the back-to-school packet.

Instead, she suggested, if somebody needs access to any of the services the school system provides, they can go directly to the school and ask for the necessary resources.

鈥淟et it be your kids鈥� information, medical information, emergency detail information, emergency pickup information and that鈥檚 it,鈥� Rochelle said of the back-to-school packet.

太子探花