Student Data Privacy in Tier 2 & Tier 3 Programs
Overview
In CharacterStrong’s Tier 2 and Tier 3 programs, educators can input and manage sensitive student information to support behavioral, social skills, and attendance interventions. This may include:
- Participation in small group interventions
- Attendance support needs
- Behavioral challenges
- Environmental documentation related to intervention plans
- Student progress monitoring information
This information is considered personally identifiable and highly sensitive under applicable privacy laws.
Your Role in Data Privacy
Schools are primarily responsible for ensuring compliance with the Family Educational Rights and Privacy Act (FERPA). This means:
- What you collect is determined by your school or district policies.
- Who has access is determined by your school’s user permissions settings within CharacterStrong.
- How the data is used within the school must follow FERPA requirements for educational records.
How CharacterStrong Protects Student Data
While you, as an educator, input and manage this data:
- We do not sell student data.
- We do not share student data with anyone who does not have a legitimate educational purpose.
- We do not store student data inappropriately or outside approved, secure systems.
- Access to data is limited to the roles and permissions assigned by your school’s administrators.
Best Practices for Educators
- Input only necessary information for the intervention or program.
- Review your school’s policy on what information should be entered into CharacterStrong.
- Check user permissions to ensure only authorized staff have access to sensitive records.
- Avoid including unnecessary personal details that are not relevant to the intervention.
Remember: CharacterStrong provides the secure platform and safeguards, but schools control what is collected and who can access it. Following FERPA and local policies ensures we keep student information safe and used only for its intended educational purposes.
Best Practices: FERPA, HIPAA, and Trauma-Based Instruction
- Know Which Law Applies
- In K–12 schools, FERPA typically governs student records, including most mental health information held by the school.
- HIPAA usually applies only to external medical providers, not to school employees, unless the school operates a health clinic that bills electronically for services.
- If an outside mental health practitioner is working with the student and providing information to the school, once the school maintains that information, it is generally protected under FERPA, not HIPAA.
- In K–12 schools, FERPA typically governs student records, including most mental health information held by the school.
- Share on a Need-to-Know Basis
- Educators who directly serve the student—such as the student’s teacher, counselor, or intervention specialist—can receive information about mental health supports, including trauma-focused supports, if it is relevant to their role in providing educational services.
- Avoid sharing specific diagnoses or unnecessary details—focus on actionable strategies and supports.
- Educators who directly serve the student—such as the student’s teacher, counselor, or intervention specialist—can receive information about mental health supports, including trauma-focused supports, if it is relevant to their role in providing educational services.
- Obtain Consent When Possible
- If sharing information from an external provider to the school or vice versa, secure parent/guardian written consent unless an exception applies under FERPA (e.g., health and safety emergency).
- Use consent forms that clearly outline what information will be shared, with whom, the time frame/expiry date, and for what purpose.
- If sharing information from an external provider to the school or vice versa, secure parent/guardian written consent unless an exception applies under FERPA (e.g., health and safety emergency).
- Document Appropriately
- Keep records of what was shared, when, by whom, and under what authority or consent.
- Store mental healt plans, including trauma-related support plans, securely and limit access to authorized personnel.
- Keep records of what was shared, when, by whom, and under what authority or consent.
Good to Know
- FERPA > HIPAA in Schools
In most school-based scenarios, FERPA protections apply even to mental health information, meaning that parents generally have the right to access the student’s educational records, including trauma-informed instruction notes. - Teachers Can Know the Supports—Not the Diagnosis
Teachers may be informed of trauma-informed strategies or accommodations for a student (e.g., seating changes, behavior supports, flexible deadlines), but they do not need to know the specific trauma history or clinical diagnoses (if present) to implement those supports effectively. - Crisis and Safety Exceptions
In an immediate health or safety emergency, schools can disclose necessary information to appropriate parties without prior consent to protect the student and/or others.
Outside therapists or counselors may share relevant support strategies with the school when parental consent is in place. The goal is to align interventions, not to duplicate or over-disclose sensitive history.