ITR001 – Information Classification Rule

Purpose

The purpose of the Information and Data Classification Rule is to provide guidance for the classification of digital information and data created, stored, accessed, maintained, secured and retired by Lincoln Public Schools staff and students. . These classifications are used to inform further decisions about systems that store this information, such as which security controls apply, priority and protection levels in disaster recovery plans, and other rules.

Classification Levels
Lincoln Public Schools information and data are classified into three categories: Public, Sensitive, and Confidential.

Public Information/Data
This information/data is suitable for release to the general public. Examples are press releases or content made available on Lincoln Public Schools websites for public use.

Sensitive Information/Data
This information/data is not classified as Confidential, but is also not Public information. Disclosure of this information could potentially cause harm to an individual or Lincoln Public Schools. Examples are employee home phone numbers or student ID numbers.

Confidential Information/Data
This information/data is private. Unauthorized disclosure of this information could violate State or Federal laws or contribute to financial or identity fraud.

Information systems are authorized to store designated pieces of information and data. Information systems are classified based upon the highest classification level of the information and data they store. Moving sensitive or confidential data manually, or via any automated procedure, routine, script, or program to an unauthorized system is a violation of this rule subject to disciplinary action.

FERPA Directory Information

Lincoln Public Schools designates certain personally identifiable information contained in a student’s record as “directory information” in Policy 5360.

Directory information includes, but is not limited to:

  • Student’s name, address, telephone listing and the name, address, telephone listings (if not unlisted), e-mail address and work or other contact information of the student’s parent/guardian or other adult acting in loco parent or with authority to act as parent or guardian in educational matters for the student,
  • School and dates of attendance,
  • Student’s current grade,
  • Student’s enrollment status (e.g., full-time or part-time),
  • Student’s date of birth and place of birth,
  • Student’s extracurricular participation,
  • Student’s achievement awards or honors,
  • Student’s weight and height if a member of an athletic team,
  • Student’s photograph, and
  • School or school district the student attended before he or she enrolled in the Lincoln Public Schools.

Directory Information can either be Public Information (i.e. an athletic team roster published on a public website) or Sensitive Information (i.e. information shared with a provider to provision accounts for use within a district approved service).

Student Information Classification

Student Name Public or Sensitive
Student ID Sensitive
Social Security Number Confidential
Home Phone Number Public or Sensitive
Home Address Public, Sensitive, or Confidential
Ethnicity Sensitive
Free/Reduced Meal Program Status Confidential
ELL Status Sensitive
Special Education Status Confidential
Medical Conditions Confidential
Grades Confidential
Attendance Confidential
Discipline Confidential
Standardized Test Scores Confidential

Employee Information Classification

Employee Name Public or Sensitive
Employee ID Number Sensitive
Social Security Number Confidential
Home Phone Number Sensitive
Home Address Sensitive
Ethnicity Sensitive
Medical Conditions Confidential
Certifications Sensitive
Attendance Confidential
Evaluations Confidential
College or School Transcripts or grades Confidential
Professional Development Records Sensitive
Benefits Confidential
Salaries Public

What does this mean to me?

Not all student data is the same. While Federal laws compel us to protect most information about students, some information can be shared with the public. Other data should be guarded even though Federal law does not demand it. It is good to know which is which.

We make security decisions every day, even if it may not feel that way. Make sure your Google Docs or web pages are not oversharing the very types of data it is important for us to protect:

  • Many buildings use Google Sheets to make spreadsheets that help us track and analyze behavioral or academic data. Are you sharing that Google Doc with only the specific people who need it, or was it shared to “Anyone with the link”, which may include students and beyond?
  • Are you aware of the data on your screen when you project in front of students?
  • Are you sharing photos or video of students online? Are their names or other identifying information in the background of your photos or in the names of the files themselves?