Student Disability Services accidentally sent out an email on Sept. 6 revealing the email addresses of 299 students who receive accommodations from SDS.
A Nursing senior who receives accommodations from SDS said the email, which was sent at 11:30 a.m., was just a “routine back-to-school email” that failed to Blind Carbon Copy its recipients, exposing the emails of students on the SDS email list.
The next day at 4:48 p.m., SDS sent an apology email assuring students that their “confidentiality is very important to [SDS].”
“We assure you that we are taking immediate steps to implement procedures to prevent this issue from happening again,” the email read, “including developing an appropriate listserv that does not disclose the identity of recipients and providing training to staff members on email communications involving sensitive information.”
SDS also asked students to delete the email in question without looking at the list or forwarding it to anyone else.
In response to a request for comment, Jesselson Director of the Office of Student Disabilities Services Susan Shapiro forwarded the apology email sent to students and added, "We deeply regret this mistake and have taken steps to ensure that it does not happen again."
Penn’s Policy on Confidentiality of Student Records states that “personally identifiable information from education records may not be disclosed to other parties without the student’s prior written or electronic consent." This applies to “documentation and disability-related materials,” according to the SDS website.
Screenshot of email from Student Disability Services
The Nursing senior mentioned above said that while she is open about her accommodations, this email was a “huge breach of confidentiality.”
“While SDS has rules about not doing things like this, once that email is out to those 300 students, it’s really unclear what those students could do with it,” she said. “It’s pretty hard to contain.”
She said that she feels lucky that Nursing is so supportive because if she were in a more academically competitive program or major, she would be “really concerned that a disability status could be used against [her].”
“The fact that Penn is so competitive definitely would concern some students,” she said.
In addition to the breach of confidence, she said she was unhappy with how long it took SDS to send the apology email.
“In that time, there was no direction to delete the original email, so that email could have been forwarded, and it still could be,” she said. “It doesn’t seem like they are taking it seriously as a breach of confidentiality. They are some students who probably scrolled past it and didn’t even read it — who had no idea there was a breach of their confidentiality for that long.”
Harold Atlas, a corporate lawyer with Sherman Wells who specializes in intellectual property and technology transactions, said the Family Educational Rights and Privacy Act ensures that student records remain confidential for all federally funded schools.
“It wouldn’t surprise me at all if this type of information, this release of emails, violates that type of law,” Atlas said.
He said he would call this email list “highly sensitive information” because it is likely personally identifiable information given the nature of email addresses, which typically includes users' first initial and full last name.
“When you have information that is personally-identifiable and highly sensitive like this, it creates problems,” Atlas said. “People have an expectation that it will be kept private, and the school likely has an obligation to keep it private.”
Atlas said SDS should work with their technology department to devise a system to make sure this information is kept private, even if that means not sending emails to listservs going forward.
“You hear about credit card information a lot, but I’ve never heard of this type of student data being released,” Atlas said. “It’s very unusual and unfortunate.”
In a written statement following her interview, the Nursing senior expressed concern about those in need of accommodations feeling discouraged from registering with SDS in the future. She wrote that she already knows some people who choose not to register “because they do not want to be seen as different.”
“I worry that this breach in our confidentiality will cause students to not register for the accommodations they need because they feel they cannot trust the institution,” she said.
The Daily Pennsylvanian is an independent, student-run newspaper. Please consider making a donation to support the coverage that shapes the University. Your generosity ensures a future of strong journalism at Penn.
Donate