Hicksville Public Schools

Data Privacy & Security

New York State Education Law 2-D

Pertains to the unauthorized release of personally identifiable information.

The Board of Regents adopted Part 121 of the Regulations of the Commissioner of Education on January 13, 2020. These rules will implement Education Law Section 2-d and provide guidance to educational agencies and their third-party contractors on ways to strengthen data privacy and security to protect student data and annual professional performance review data. The regulation went through multiple sets of revisions and three rounds of public comments and will go into effect January 29, 2020. It will apply to both charter and traditional public schools. We thank the members of the Data Privacy Advisory Council, implementation planning and drafting workgroups that supported the Department’s Chief Privacy Officer, Temitope Akinyemi, through this process.

Source: Data Privacy and Security

Internet Safety Policy (Abridged): It is the philosophy of the Hicksville Public Schools that the integration of technology with the curriculum is an essential part of instruction. At the same time, there is an inherent responsibility on the part of users to conduct themselves in an appropriate and considerate manner when using this medium. The internet contains a rich array of educational content as well as information that is illegal or inappropriate for children. Therefore, internet resources are filtered for inappropriate content, students are educated about internet safety and appropriate online behavior, and student use is monitored and supervised by staff. However, the security, accuracy and quality of information that is available through our network cannot be guaranteed. While the guidelines that follow have been developed to ensure responsible use of our computer network and the internet, we respect each family’s right to deny independent internet use by their children in school.

Parent/Guardian Option: A parent/guardian may deny their child independent access to the internet at any time by submitting a letter to the school. However, teacher-directed internet activities are part of our curriculum and not subject to parent/guardian authorization. Such activities may include the use of various online educational Web sites and services that may require students to set up individual user accounts, with the minimum required personal information, solely for the purpose of accessing such services in connection with approved classroom instruction. Unless a parent/guardian denies such access for their child, students will be permitted to set up their accounts, with the consent of their teachers, in accordance with the Children’s Online Privacy Protection Act.

Complaints should be directed to Information Technology Department OR to the New York State Education Department online at Data Privacy and Security.

PowerSchool Data Breach

January 8, 2025 - Superintendents Message to the Community

January 14, 2025 - Second Message About PowerSchool

On January 8, 2025, we wrote to inform you about a recent data security breach involving PowerSchool, the District’s Student Information System. Since that time, more information has become available and the Hicksville Schools have taken necessary action as detailed in our Disaster Recovery and Business Continuity plans.

Hicksville was one of the first Long Island school districts that made this information available to our community. We take pride in providing you with the transparency that these types of situations require. While we hope that these situations never occur, our plans for a response start with informing you as soon as we know.
- We filed the required disclosure of a data breach to the New York State Department of Education. Additional filings will likely be required due to the number of school districts affected in New York State.
- We continue to gather information from PowerSchool, NYSED, Nassau BOCES as well as other regional groups.
- We have contacted the district's Cyber-Insurance provider to initiate a claim should that be necessary.
- We are in regular contact with legal counsel to ensure that we have the most up to date information.
The Hicksville Public Schools does NOT collect, store or otherwise use social security numbers (SSN) in the PowerSchool system.

Data Potentially Exposed: PowerSchool has provided the district with the following information that can be found on their website at https://www.powerschool.com/security/sis-incident/assigned school, email address, TEACH ID number,

Hicksville Is Prepared: The Hicksville Technology Department has established plans and procedures to address cyber incidents, including informing the Hicksville community. We are committed to transparency and will continue to share information as it becomes available. We want to assure you that we are prepared.

Our Commitment to Data Security: Working with experts: We are working closely with Nassau BOCES and PowerSchool to address this situation. We anticipate more information from both organizations and will continue to share that with you.

Protecting your child's information: In partnership with Nassau BOCES, we have a Data Privacy Agreement (DPA) with PowerSchool that mandates the protection of student data.

Staying Informed: We will continue to provide updates as we learn more.

Change your password: As a precaution for parents, we will be initiating required password resets for the PowerSchool Parent Portal. Student PowerSchool and Google passwords will be reset as well. You may also initiate a password reset for the PowerSchool.

Stay vigilant: Be mindful of any suspicious emails or activity related to your PowerSchool account.

We understand this news may be concerning. Please know that we are committed to protecting the privacy and security of our students' information. We will continue to keep you informed and provide updates as they become available.
Education Law Section 2-D Definitions

“Educational agency” means a school district, board of cooperative educational services, school, or the education department.

“Personally identifiable information,” as applied to student data, means personally identifiable information as defined in section 99.3 of title thirty-four of the code of federal regulations implementing the family educational rights and privacy act, section twelve hundred thirty-two-g of title twenty of the United States code, and, as applied to teacher or principal data, means “personally identifying information” as such term is used in subdivision ten of section three thousand twelve-c of this chapter.

“School” means any public elementary or secondary school, universal pre-kindergarten program authorized pursuant to section thirty-six hundred two-e of this chapter, an approved provider of preschool special education, any other publicly funded pre-kindergarten program, a school serving children in a special act school district as defined in section four thousand one of this chapter, an approved private school for the education of students with disabilities, a state-supported school subject to the provisions of article eighty-five of this chapter, or a state-operated school subject to the provisions of article eighty-seven or eight-eight of this chapter.

“Student” means any person attending or seeking to enroll in an educational agency.

“Eligible student” means a student eighteen years or older.

“Parent” means a parent, legal guardian, or person in parental relation to a student.

“Student data” means personally identifiable information from student records of an educational agency.

“Teacher or principal data” means personally identifiable information from the records of an educational agency relating to the annual professional performance reviews of classroom teachers or principals that is confidential and not subject to release under the provisions of section three thousand twelve-c of this chapter.

“Third party contractor” shall mean any person or entity, other than an educational agency, that receives student data or teacher or principal data from an educational agency pursuant to a contract or other written agreement for purposes of providing services to such educational agency, including but not limited to data management or storage services, conducting studies for or on behalf of such educational agency, or audit or evaluation of publicly funded programs. Such term shall include an educational partnership organization that receives student and/or teacher or principal data from a school district to carry out its responsibilities pursuant to section two hundred eleven-e of this title and is not an educational agency as defined in paragraph c of this subdivision, and a not-for-profit corporation or other non-profit organization, other than an educational agency.

NYS ED
Federal Laws that Protect Student Data

Family Educational Rights and Privacy Act (FERPA) – The foundational federal law on the privacy of students’ educational records, FERPA safeguards student privacy by limiting who may access student records, specifying for what purpose they may access those records, and detailing what rules they have to follow when accessing the data.

Student Records

Under the Family Education Rights and Privacy Act (FERPA), parents of students under age 18, and students or graduates age 18 or older, may review, obtain copies (for a nominal fee), and challenge the accuracy or fairness of the student’s educational records. Requests to review instructional materials should be directed to the building Principal. Upon receipt of such request, arrangements shall be made to provide access to such material to within 30 calendar days after the request has been received. Complaints should be forwarded to the Superintendent’s Office, 200 Division Avenue, Hicksville, NY 11801-4800. Subsequent complaints
may be filed in writing to:

The Family Education Rights and Privacy Act Office
Department of Education
330 Independence Avenue, S.W.
Washington, D.C. 20201.

Student Directory Information

The district has the option under FERPA of designating certain categories of student information as “Directory Information,” including a student’s name, address, telephone number, date and place of birth, major course of study, participation in schools activities and sports, weight and height if a member of an athletic team, dates of attendance, degrees and awards received, most recent school attended, photograph/image (still or moving), audio clips, grade level, email address and class roster.

Once FERPA notification is given by the district, the parent/guardian will have 14 days to notify the district of any objections they have to any of the “Directory Information” designations. If no objection is received, the district may release this information without prior approval of the parent/guardian. Once the parent/guardian provides the “opt out” notice, it will remain in effect after the student is no longer enrolled in the district. The district may elect to provide a single notice regarding both directory information and
information disclosed to military recruiters and institutions of higher education.

Protection of Pupil Rights Amendment (PPRA) – PPRA defines the rules states and school districts must follow when administering tools like surveys, analysis, and evaluations funded by the US Department of Education to students. It requires parental approval to administer many such tools and ensures that school districts have policies in place regarding how the data collected through these tools can be used.

Children's Online Privacy Protection Rule (COPPA) – COPPA imposes certain requirements on operators of websites, games, mobile apps or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.
NYS Required Documents

Click on the following links to view PDF.
Report an Improper Disclosure

Parents have the right to file complaints about possible breaches of student data. Parents may submit a complaint regarding a potential breach by the District to:

Daniel Friedman
Director of Educational Technology
Data Protection Officer
200 Division Avenue, Hicksville, New York 11801

The School District shall promptly acknowledge any complaints received and commence an investigation into the complaint, while taking the necessary precautions to protect personally identifiable information. The School District shall provide a response detailing its findings from the investigation no more than sixty (60) days after receipt of the complaint. Complaints pertaining to the State Education Department or one of its third party vendors should be directed in writing to:

Chief Privacy Officer
New York State Education Department
89 Washington Avenue, Albany, NY 12234

OR email to privacy@nysed.gov,
OR by telephone at 518-474-0937

NYSED Data Privacy and Security

Report an Improper Disclosure through NYSED Data Privacy and Security

GENERAL INSTRUCTIONS:

Please do NOT include any information in this form that would constitute student personally identifiable information (PII).** SED will contact you if additional information is needed. By filing this form, you are filing a complaint with the Chief Privacy Officer alleging that PII has been disclosed to or accessed by an unauthorized person.

Please complete the form thoroughly, including sufficient detail that will allow the complaint to be investigated.

To submit a complaint or report, please access the form from the following link:

Report an Improper Disclosure Form

Report an Improper Disclosure to Hicksville Public Schools

GENERAL INSTRUCTIONS:

Please complete the form thoroughly, including sufficient detail that will allow the complaint to be investigated.

To submit a complaint or report, please access the form from the following link:

Report an Improper Disclosure Form to Hicksville Public Schools
- List of Approved Software

Data Privacy & Security

Data Privacy & Security

Information Technology Department

Chief Privacy Officer

PowerSchool Data Breach

NYS Education Law Section 2-D Definitions

Federal Laws that Protect Students

NYS Required Documents

Report an Improper Disclosure

List of Approved Software