Exclusive: Virginia’s Fairfax Schools Expose Thousands of Sensitive Student Records

Virginia’s Fairfax County Public Schools disclosed tens of thousands of sensitive, confidential student records, apparently by accident, to a parent advocate who has been an outspoken critic of its data privacy record.  

The documents identify current and former special education students by name and include letter grades, disability status and mental health data. In one particularly sensitive disclosure, a counselor identified over 60 students who’ve struggled with issues like depression, including those who have engaged in self-harm or been hospitalized. 

A letter from the district to the state provides copious details about the condition and care of a medically fragile fourth grader. And a document containing “attorney work product” marked “privileged and confidential” references a pair of Title IX cases. It identifies two students as “Jane Doe” — a common practice with alleged victims of sexual assault or harassment — but then names the students in parentheses.

The disclosure of private student data is likely the largest since 2020, when the hacker group MAZE obtained records, including Social Security numbers and birthdates, on over 170,000 students and employees in the nation’s 13th-largest district. But this time, it looks like human error, rather than ransomware, was to blame. 

“Why worry about people from the outside?” asked Callie Oettinger, who received the recent document collection. “They’ve got the door wide open from the inside.”  

Oettinger, a parent and special education advocate with a long and contentious relationship with Fairfax administrators, went to a school on three consecutive days last month to examine her children’s files — data such as test scores, attendance records and audio recordings of meetings she’s been requesting for years. In addition to boxes of paper files, the district provided her with thumb drives and computer discs that Oettinger estimates include personal data on roughly 35,000 students.

Parents who have challenged the district over special education services said the leak opens their children to further harm. Among the records released to Oettinger was a 2019 email exchange in which officials questioned the cost of an independent educational evaluation for Julie Melear’s son, who has dyslexia. 

“Is my kid, for the rest of his life, going to have to look over his shoulder to see what Fairfax is putting out there?” asked Melear, who had three children in the district and now lives in Denver.

The latest disclosure is not an isolated incident. Oettinger, who also runs a special education watchdog website, said the district has repeatedly released information on her now 19-year-old son to other parents and unauthorized staff and, on at least six occasions between 2016 and 2021, provided her with documents on children who are not her own. One was a 2020 internal document on special education that included students’ names, their attorneys and costs for services.

But those instances seem small compared to the volume of records she received in October, which span the years 2019 to 2021. It also comes four years after the district’s former superintendent apologized to Oettinger for a similar disclosure and two years after a county judge ruled against Fairfax in a case related to leaked student records. 

Contacted last week, Fairfax officials — who pledged to improve security after the 2020 breach — appeared unaware they had given Oettinger access to students’ personal data. The district’s communications office forwarded an inquiry from The 74 to Molly Shannon, who manages the district’s public records office. In an email, Shannon asked a reporter to identify who accessed the records and where it occurred ”so we can investigate and remediate the issue at the school, notify any affected families, and work with the parent to ensure other students’ information is properly secured.” 

Under state law, the district is required to alert parents “as soon as practicable” if there’s a violation under the Family Educational Rights and Privacy Act, or FERPA.

The records release is the latest dilemma for Virginia’s largest school system, which has come under intense scrutiny for its handling of special education. Following a federal civil rights probe last year, the district agreed to make up for services it failed to provide to students with disabilities during the pandemic. For years, federal officials have urged the state to improve its monitoring of districts to ensure they’re complying with all special education laws. As recently as February, they told former state Superintendent Jillian Balow that protecting student confidentiality remained a sticking point.

Data leaks linked to employee error are not unique to Fairfax. In 2017, for example, the Chicago Public Schools posted confidential student information, including health conditions and birthdates, to unsecured websites. Time-consuming records requests to school districts have also skyrocketed in recent years, fueled in part by controversies over COVID protocols, library books and curriculum. Many districts have struggled to keep up, but one expert said Fairfax shouldn’t be one of them.

“I have a lot more sympathy for the many, many small districts,” said Amelia Vance, founder and president of the Public Interest Privacy Center. But with an annual $3.5 billion budget, Fairfax, she said, “certainly seems to have the resources and they’ve had these requests for years. If they don’t have a system to respond in a protective manner, in an efficient manner, that’s on them.”

Phyllis Wolfram, executive director of the Council of Administrators of Special Education, a national organization, said she doesn’t think it’s common for districts to release students’ files to the wrong parent. But if record requests are increasing, she said, security should be tighter. 

“Given the shortage of school staff all around, we must be extra vigilant and ensure high-quality training for all staff,” she said. 

‘Process and protocols’ 

FERPA is a federal law that gives parents the right to examine their children’s educational records. Oettinger said she asked to see original documents in person — after the state overruled the district’s initial refusal — because past responses have been incomplete or contained electronic files that didn’t open. 

She said she is unsure who in the district ultimately signed off on the recent release. On Oct. 16th, she received an email from Shannon saying the records were ready. From Oct. 17 to 19, she sat in a small room next to the main office of her local high school and viewed the files. A paralegal from the central office supervised as she copied records to thumb drives and scanned paper documents on her phone, Oettinger said. He offered assistance and even called in an IT expert when a media file didn’t open. She recorded everything and shared audio files of her visit with The 74. Ironically, she said, some of her own children’s records are still missing.

At one point, she spotted an unredacted document with a teacher’s notes and suspected there were more. But she said she didn’t realize the full scope of the disclosure until she began reviewing the files at home. 

She filed a complaint with the U.S. Department of Education’s Office for Civil Rights on Oct. 20 and contacted a handful of parents she knows with children named in the documents.

Oettinger said she didn’t report the leak to district officials because she doesn’t trust them — a skepticism that has only intensified over time. When her son had reading difficulties in elementary school, educators responded three times that an evaluation “is not warranted,” according to district records and, she said, told her that boys learn to read slower than girls. 

“You get one chance with your kid, and there’s no handbook,” she said. “In special education especially, nobody knows what to do. All you know is that you’re fighting.”

It took an independent evaluation for her son to be diagnosed with dyslexia, and by seventh grade, he had an Individualized Education Program, a plan that outlines the services a district is obligated to provide students with disabilities. Like thousands of Fairfax parents, she also complained that the district failed to follow that plan during the pandemic. He graduated in 2022, but her daughter remains a Fairfax student.

As she navigated the system for her son, she became a sounding board for other families. She launched her website, Special Education Action, in 2020. She’s filed at least 100 complaints with the state education department over special education services in the district and another dozen with the federal civil rights office, of which at least two have resulted in investigations. Her persistence — sending detailed, sometimes biting, emails and pressing for answers to all her questions — has earned her a reputation for “berating” staff, according to one 2019 email from Dawn Schaefer, director of the district office that handles special education complaints.

“It’s obvious you don’t know what you’re talking about, so let me break it down for you,” Oettinger wrote in a 2020 email to a staff person regarding a diagnosis for her son.

In addition to requests for documents on her own children, she submits Freedom of Information Act requests with the district each year for more general data that she uses in her advocacy role. In one internal 2020 email she obtained, John Cafferky, an attorney who handles special education cases for the district, said she files them because she’s “waiting for someone to slip up.” 

District officials have promised her they would do a better job of safeguarding student privacy. In a 2019 email exchange with former Superintendent Scott Brabrand, Oettinger reported multiple cases of school staff forwarding information about her son to the wrong people. 

“I am sorry to report that the school did make a mistake and unintentionally provided information about your son to another parent,” he responded. “We take student privacy very seriously. Following our process and protocols is paramount to ensuring we protect student information.”

Following the 2020 ransomware incident, the district notified affected families and released a statement saying it was “committed to protecting the information of our students, our staff, and their families.” The state also stepped in to help the district clean up its “internal practices, and ensure it should not happen again,” state Superintendent Lisa Coons told The 74.

But it did. 

In 2021, another Fairfax parent, Debra Tisler, filed a public records request seeking invoices for legal services in an attempt to learn how much Fairfax was spending on attorneys’ fees related to students with disabilities. The district released records that included personal information on about a dozen students. 

Tisler shared the files with Oettinger, who posted the records, with names blacked out, on her website. The district sued them to get the records back, but lost the case. 

Judge Richard Gardiner, who heard the lawsuit in a Fairfax County district court, said the records were “obtained quite lawfully.” 

“The [district], for whatever reason — maybe it was ineptness, I don’t know; I have no evidence on that — made the decision to turn over the information, and they’re stuck with that,” he said, according to a transcript of the hearing. 

Following the lawsuit, an internal audit from December 2022 showed the district’s in-house attorneys didn’t finish redacting students’ personal information before its records office released the documents. Fairfax instituted new procedures to ensure records go through multiple reviews, including checks by a paralegal and a staff attorney. The district also hired additional staff to keep up with demand.

‘Basic data protection’

But it appears the system broke down. Some parents whose records ended up in the recently released files said they weren’t surprised because they, too, have previously received documents pertaining to other students.

“Some of the information I found out about other people’s children I don’t want to know,” said Melear, the parent who relocated to Denver. 

In the files released to Oettinger, Torey Vanek’s daughter was included on a spreadsheet of students who receive special education services or accommodations for a disability. A ninth grader at Woodson High School, her daughter has dyslexia. 

 “There is a joint frustration among many parents in Fairfax,” Vanek said. “Part of me is not surprised, but part of me is like this is just basic data protection.” 

Help fund stories like this. Donate now!