FERPA updates: Recommendations for Safeguarding Education Records

On March 24th, the Department of Education released 34 CFR Part 99, "Family Educational Rights and Privacy; Proposed Rule". This is a proposed update to FERPA (the Family Educational Rights and Privacy Act of 1974).

The document lists a number of recent incidents, ranging from grade exposures to SSN and personally identifiable information disclosures, and suggests that a number of steps are available to organizations after exposure. Most organizations should have similar steps in their incident response plan - if you don't, this provides at least a basic overview of the steps you'll want to take.

Remember, FERPA does not have a specific requirement regarding notification of students in the event of unauthorized release or theft of their education records - but organizations are required to maintain a record of each disclosure. This is very different many existing SSN and other PII disclosure laws.

As noted in the document, the Office of the Inspector General does provide a student focused identity theft resource site: http://ed.gov/about/offices/list/oig/misused/idtheft.html as well which includes a list of steps to take for victims: http://ed.gov/about/offices/list/oig/misused/victim.html. The FTC's identity theft guide is still an excellent resource as well: http://www.ftc.gov/bcp/edu/microsites/idtheft/

DHS: CFATS - have you accounted for your chemicals?

Many higher education institutions will be preparing their lists of "chemicals of interest" for the Department of Homeland Security early next year. The rule stipulates that listings be delivered 60 days after the release of the final rule meaning lists will have to be provided by January 19th unless you request and receive a 60 day extension. Chemicals range from chlorine to aluminum chloride to propane, meaning that many departments on campus will likely have to report their totals.

If you haven't thought about what the chemicals on your campus could be used for, take a look. Each chemical lists what it would be potentially useful for, providing a convenient overview of what risks your campus might face.

The Chemical Facility Anti-Terrorism Standards require a variety of things, ranging from risk assessments to reporting of chemical amounts on hand . These apply to many higher education institutions, and responsibility for detailing may have fallen to risk management or facilities staff. If you're an information security staffer, you may want to check with the appropriate department at your school to see how that data is being stored and secured.

Where did all of this come from? It is part of the Department of Homeland Security Appropriations Act of 2007, which President Bush signed in October, 2006. Section 550 of the Act gave DHS the authority to enact the rules above. The Act defines the covered entities as "chemical facilities that, in the discretion of the Secretary, present high levels of security risk." More details can be found in the final rule here.