Law / United States / 
Ohio
Education management information system, confidentiality of personally identifiable student data
In force.
A sensitive categories rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Prohibition
What it requires
- This binds the Department of Education and Workforce, which adopts the rules and guidelines for the statewide education management information system, the school districts, community schools and information technology centers that collect and report student data into it, and, under divisions (K) and (O), any person who handles that data (section 3301.0714(A), (D), (J), (K), (M) and (O)).
- If you are the Department of Education and Workforce, adopt rules for the statewide education management information system whose guidelines include standards that provide strict safeguards to protect the confidentiality of personally identifiable student data (section 3301.0714(A)(5)).
- If you are the Department of Education and Workforce, set guidelines that prohibit reporting a student's name, address and Social Security number to the department (section 3301.0714(D)(1)).
- If you are the Department of Education and Workforce, do not authorize school districts in the guidelines to request the Social Security numbers of individual students (section 3301.0714(D)(1)).
- If you are the Department of Education and Workforce, set guidelines that prohibit reporting personally identifiable information about any student to any other person, except for assigning the data verification code, unless the person is employed by the school district or the information technology center and is authorized by it to have access, or is employed by an entity with which the department contracts for the scoring or the development of state assessments (section 3301.0714(D)(1)).
- Except in the cases section 3301.0714(D)(2)(b)(ii) and the sections it lists allow, the department may not have access to information that would enable a data verification code to be matched to personally identifiable student data (section 3301.0714(D)(2)(b)(i)).
- If you are an information technology center or a school district, do not acquire, change or update your student administration software package for managing and reporting the data the department requires unless you convert to a student software package the department certifies (section 3301.0714(M)).
- Do not remove data from the education management information system for the purpose of releasing it to a person not entitled under law to have access to it; a person who does is subject to section 2913.42 of the Revised Code, which prohibits tampering with data (section 3301.0714(K)).
- Do not release or maintain any information about any student in violation of section 3301.0714; a violation is a misdemeanor of the fourth degree (section 3301.0714(O)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Releasing or maintaining information about a student in violation of the section is a misdemeanor of the fourth degree (section 3301.0714(O)); removing data from the system to release it to a person not entitled to it is subject to section 2913.42 of the Revised Code, which prohibits tampering with data (section 3301.0714(K)).
What this law does
Section 3301.0714 of the Revised Code requires the Department of Education and Workforce to adopt rules for a statewide education management information system. The guidelines the department establishes under those rules must include standards to provide strict safeguards to protect the confidentiality of personally identifiable student data. The guidelines must prohibit the reporting under the section of a student's name, address and Social Security number to the department.
The guidelines must also prohibit the reporting of any personally identifiable information about any student to any other person, except for assigning the data verification code, unless the person is employed by the school district or the information technology center and is authorized by it to have access, or is employed by an entity with which the department contracts for the scoring or the development of state assessments.
Except in the cases the section lists, the department may never have access to information that would enable a data verification code to be matched to personally identifiable student data.
Section 3301.0716 of the Revised Code is one exception: despite that bar, the department may have access to personally identifiable information about a student when an entity it contracts with to score state assessments notifies it that the student's written response included threats or descriptions of harm to another person or the student's self and the information is necessary to identify the student so the school district or school can be told of the potential for harm.
The guidelines may not authorize school districts to request the Social Security numbers of individual students. Any data collected or maintained under the section that identifies an individual pupil is not a public record under section 149.43 of the Revised Code. Any person who removes data from the system for the purpose of releasing it to a person not entitled under law to have access to it is subject to section 2913.42 of the Revised Code, which prohibits tampering with data.
No information technology center or school district may acquire, change or update its student administration software package for managing and reporting the data the department requires unless it converts to a student software package the department certifies. No person may release or maintain any information about any student in violation of the section, and a violation is a misdemeanor of the fourth degree.
The section's current text, as amended by Senate Bill 19 and House Bill 455 of the 136th General Assembly, took effect .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .