PowerSchool Media Alert 3/7/25

ATTENTION VIRGINIA HOMESCHOOLERS: You may receive a notice from PowerSchool, a student information software provider for K–12 schools, in regard to a recent nationwide data breach. When the news broke, HEAV contacted PowerSchool directly. Since then, HEAV has also been in communication with several Virginia school districts, parents, Home School Legal Defense Association (HSLDA), and Delegate Phillip Scott, who sponsored HEAV’s privacy bill, HB2598. We would like to share the following information with parents:

Approximately 65% of Virginia public school districts use PowerSchool.
Not all PowerSchool member districts were affected by the breach. Although the company has not made each member’s status public, some districts have posted a press release or sent notices to parents.
Although some member districts do house homeschoolers’ private information in the PowerSchool system, the extent of such use is currently unclear.
Districts affected by the PowerSchool data breach and house homeschoolers’ information in their system have provided the company with homeschoolers’ private contact information so that PowerSchool can (1) advise parents of the breach and (2) offer two years of credit monitoring service through Experian IdentiyWorks.
If your child was ever enrolled in one of the member districts as a public school student, you may also receive a notice from PowerSchool.

As noted in our 02/17/25 social media alert, we have enlisted HSLDA to address potential legal concerns that have arisen from this unfortunate PowerSchool event. If you learn that your family has been adversely affected by your public school district’s use of PowerSchool, please contact HSLDA for legal consultation.

Homeschool Privacy Protections
To ensure privacy protections for homeschool minors and their families, in 2016 HEAV initiated SB780. Since becoming law, homeschool families’ private information has been protected under the home instruction statute, § 22.1-254.1(G). The law states:

“No division superintendent or local school board shall disclose to the Department or any other person or entity outside of the local school division information that is provided by a parent or student to satisfy the requirements of this section or subdivision B 1 of § 22.1-254. However, a division superintendent or local school board may disclose, with the written consent of a student’s parent, such information to the extent provided by the parent’s consent.” (emphasis added)

Through our annual superintendent’s letter, HEAV regularly reminds all 131 public school districts of the homeschool privacy law and their statutory responsibility to adhere to these essential privacy protections. Additionally, when privacy violations occur, HEAV immediately responds to address the issue and ensure privacy violations are promptly corrected. To stay informed about such incidents, please be sure to sign up for HEAV communications.

Public School District’s Use of K12 Student Information Systems
Due to the recent SchoolStatus and PowerSchool breaches, HEAV has become increasingly concerned about the use of K12 student information systems to house homeschoolers’ information—usually without parents’ knowledge or written consent.

In both the SchoolStatus and PowerSchool incidents, homeschoolers’ legally protected information was given to outside entities. Worse, in the PowerSchool incident, a cybersecurity hack occurred that has resulted in the potential for very serious problems for homeschool minors and their family members. Further, in an effort to resolve the privacy breach, PowerSchool was empowered to contact homeschoolers directly using private and protected information that should be inaccessible outside the district.

HEAV strongly discourages use of such systems to house homeschoolers’ information. Information provided through the Notice of Intent, evidence of progress, religious exemption, and other written and verbal correspondence must be kept confidential and remain inside the public school division.

HEAV’s Legislative Work
Recognizing that serious privacy violations are becoming more common across the state, during this year’s legislative session, HEAV initiated HB2598 with the patronage of Delegate Phillip Scott (R-63). The bill requires the Superintendent of Public Instruction to include an explanation of a public school division’s legal obligation as indicated in § 22.1-254.1(G) in the annual superintendent’s memo. The bill is awaiting the governor’s signature, and the memo should go out before the start of the 2025-2026 school year.

We must also remind parents about Senator Perkarsky’s (D-36) recent effort to remove all privacy protections afforded to homeschool and religiously exempt families through SB1031. Had SB1031 passed, personal information of homeschool minors and their families would be threatened by tracking and public access. This includes all information parents provide to a public school district in communication about the home instruction and religious exemption laws including names, ages, birth dates, grade levels, physical address, phone number, email, curriculum used, test scores, evaluations, sacred religious beliefs, and more. Although the homeschool community and its supporters are relieved SB1031 did not pass this year, HEAV cannot overstate the threat this bill was to children and family’s safety and privacy. Further, both the patron and the organization that requested the bill have both indicated they intend to reintroduce the measure.

Please sign up for HEAV’s legislative updates to stay informed on issues relating to HEAV’s legislative work.

Know Your Rights
According to the U.S. Department of Education, the Family Educational Rights and Privacy Act (FERPA) applies to schools that receive funding under any program administered by the U.S. Department of Education. As such, homeschool minors and their families rely on state privacy protections to help keep their private information protected. Since the home instruction and religious exemption laws are administered through local superintendents and school boards, it is the sole responsibility of public school districts to know the privacy law and protect homeschool children and their families by adhering strictly to it.
HEAV is sending correspondence to each superintendent in the state to address this ongoing concern. As we continue to monitor the situation and events unfold, we will provide additional updates.

HEAV is always available should you ever have questions or need assistance. Please contact us anytime at 804-278-9200 or via our contact form.

Patricia Beahr
HEAV Director of Government Relations