Student Medical Records Exposed After LAUSD Breach

"Hundreds" of special education students' psych records have turned up on the Dark Web. School records like these are covered by FERPA, not HIPAA, so parents have little recourse.

Dark Reading Staff, Dark Reading

February 23, 2023

1 Min Read
A teacher leads her middle school students in the Pledge of Allegiance on the first day of middle school in Aliso Video, CA
Source: Marmaduke St. John via Alamy Stock Photo

On Feb. 22, the education news site The 74 Million revealed that the hacking group Vice Society had posted hundreds, if not thousands, of psychological evaluations of special education students in the Los Angeles Unified School District (LAUSD).

The leaked information reportedly includes personal information like names, diagnoses, family immigration status, and allegations of physical and sexual abuse.

Since The 74's story, the official @LASchools Twitter account has sent messages about Dream Act applications, Anti-Bullying Day, and Eva Longoria. The account of LAUSD Superintendent Alberto Carvalho has tweeted about school building improvements, Narcan, and a new Portuguese language center. The LAUSD website has not posted updates on the breach, first reported over Labor Day weekend in 2022, since Sept. 30.

Subsequent news stories refer to a written statement from IT infrastructure senior administrator Jack Kelanic, which was distributed upon individual request and not posted to the district site or Twitter. About Kelanic's statement, the Los Angeles Daily Mail wrote, "The 500 psychological evaluation forms analyzed by The 74 were primarily from former students born in the late 1980s and 1990s. Kelanic also said that 60 of the leaked student assessments were those of current students."

When a hospital system lets that kind of information go public, it faces fines and other repercussions under HIPAA. However, when a school leaks it, the breach is covered by the Family Educational Rights and Privacy Act (FERPA), meaning the responsibility to file complaints lies with individual parents.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights