Back to School Alert:
Is Your School Protected from a Data Breach?
Recent Data Breaches
According to news reports, several Massachusetts public schools and districts have recently been impacted by significant cyberattacks that have had substantial impacts on their operations. In light of these recent cyberattacks, it is important for all schools – including charter schools, private schools, and other education entities - to ensure that they have in place a robust Written Information Security Plan (“WISP”) for protecting confidential information and establishing procedures for addressing cyber security incidents.
What is a WISP
The purpose of a WISP to have effective administrative, technical, and physical safeguards for the protection of Personally Identifiable Information (“PII”) retained by your school. PII includes information such as first and last names, dates of birth, social security numbers, employment data, financial accounts, email address, non-listed phone numbers, and other contact information. The WISP outlines procedures for evaluating electronic and physical methods of accessing, collecting, storing, using, transmitting, and protecting PII.
Why Having a “WISP” is Important
Massachusetts law requires entities that store or maintain PII adopt a WISP.1 A WISP is also beneficial as it sets clear expectations regarding data security for employees and third party vendors, and step-by-step instructions on how to address a potential cyberattack or data breach. Moreover, implementing a WISP can provide an organization with a defense to liability in the case of a cyber security incident or breach. In addition to having a WISP, it is also important for schools to have a detailed Record Retention Policy to ensure PII is organized, stored securely, and retained for the required amount of time but not longer than is necessary or required by law.
If you need assistance with adopting or updating your school’s WISP or Record Retention Policy, please reach out to K&B Education attorneys Bettina Toner (btoner@kb-law.com) and Heather Ducharme (hducharme@kb-law.com). Krokidas & Bluestein LLP’s Education Law Practice provides a full array of advice and guidance to charter schools and other education entities on a wide range of legal matters, including student discipline, special education, employment, governance, tax, regulatory and compliance matters, real estate, financing, and litigation.
1 See M.G.L. c. 93H and 201 CMR 17.00.
