Audit Findings: Fixing, Tracking, Closing

The first thing to settle in audit findings: fixing, tracking, closing is the identity of the confidentiality audit file and the reason it is retained, because every later question regarding consent, exemption or contract depends on those two facts. Where the file is unclear, the rest of the analysis wobbles with it; where the file is clear, the determination usually follows without drama.

AI tutors used by younger students raise both COPPA and FERPA issues, and both analyses must be done before the pilot, not following it.

Cloud hosting does not move responsibility: the institution remains answerable for a file even when another company stores it.

Design-stage review catches problems when they are still cheap to fix, and late review catches them when they are expensive to undo.

Access rights matter because errors in records have consequences, and a student who cannot see a record cannot challenge it.

Residence hall surveillance involves students in their homes, and the confidentiality standard there ought to be higher than in a public quad.

Releases to other schools where a student seeks to enroll are permitted, but the student should be told that such releases occur, through the yearly notification.

Voice data in support and proctoring platforms is biometric in substance, even when vendors describe it as audio processing.

Systems that feed directory information to outside directories need an opt-out verify built into the feed, not added as a manual afterthought.

An education file is defined by how it is maintained and whom it is about, not by the folder it sits in or the platform that retains it.

Biometric templates ought to be deleted when a student leaves, on a specified timetable, and the deletion ought to be verifiable.

Limit accommodation letters to what a lecturer needs to provide the accommodation, and do not contain the underlying diagnosis.

Handle transfer and withdrawal files with care, since a student's rights over files previously held do not end when enrollment ends.

Assess new platforms before purchase, with privacy review as a gate, not as a comment added following the contract is signed.

Detect events early via monitoring, because early detection limits the number of students affected.

Protect applicant records on a specified schedule, even though applicants never become students in the usual sense.

Distinguish employee files from student files for student employees, since the capacity in which a record was created matters.

Include subprocessors in vendor contracts by name or by category with notification of alters, because an unnamed chain is an uncontrolled chain.

Test the actual data flow of an integration, rather than trusting a diagram, since integrations routinely pass more than intended.

The contract in that illustration names the data, limits use to the university's objectives, bans advertising use, and sets deletion ninety days after the contract ends.

In that illustration the removal is logged, and the office can demonstrate a reviewer that the schedule was followed.

Consider a researcher who asks for identifiable student records and is offered a de-identified extract instead, with a documented agreement for the study.

In that illustration the tutor discloses the summary, the colleague's advice improves, and no record leaves the tutor's department.

In that illustration the merged college reconciles the schedules before migrating data, and deletes records that both schedules agreed had expired.

Adopting a free tool without reviewing its information practices is an error, because the price is often paid in information uses nobody reviewed.

The most common mistake is treating a record as informal because it lives in an email thread, a chat log or a shared drive rather than in the platform of record.

Sharing a disciplinary outcome beyond the limits for that offence and recipient is an error that can harm a student long after the process ends.

Accepting a checkbox as verifiable parental permission is an error, since a checkbox that anyone may tick verifies nothing.

Excluding students from privacy oversight is an error, since students notification problems that staff have normalised.