All it takes is one click to create a disaster. That is exactly what happened when Ruth Payne, the University of Virginia School of Law’s Director of Judicial Clerkships, sent out an email attachment last Wednesday containing the personal information of 155 law school students to the school’s clerkship listserv. Payne originally intended to send an email with an attachment of clerkship listings in Maryland. However, after forgetting to attach the clerkship listings in the original email, she hastily sent a followup. Unfortunately for her and the 155 students, she sent the wrong file–instead of sending the clerkship listing, she accidentally sent out a file called the “2015 Applicants Workbook.” It was a spreadsheet containing the students’ GPA’s, class ranks, and other biographical information. Six minutes later, Payne frantically sent a third email ordering the students to delete the previous email and the attached file.

However, the damage had already been done. The entire email listserv now had access to confidential information about themselves and their classmates. While the spreadsheet did not contain any students’ social security numbers or financial information, this incident caused alarm among UVA students–both those affected and those not–that their personal information could so easily be released. According to UVA Law’s Spokeswoman Mary Wood, affected students have been individually contacted and apologized to by the dean and other law school officials. She said, “We are deeply distressed that this mistake occurred, and we are in the process of reviewing our data management procedures to build in more safeguards against unintentional disclosures.” The UVA Law Vice Dean George Geis followed up and sent out another apology email to the affected students. He wrote, “Ruth and I both deeply regret this situation and apologize to all of you, we take the safeguarding of your personal information very seriously and will conduct a full review of our communication practices and our management of confidential student information.”

But how many second chances do they get? This is not the first time that UVA has accidentally released confidential student information to the public. Just last summer, the social security numbers of about 18,700 UVA students were mistakenly included in health insurance brochures that were mailed out nationwide. In December 2012, a handheld device disappeared from UVA’s medical center. It likely contained patients’ personal information and social security numbers. Later that year, about 350 grade transcripts were publicly posted to a UVA website. In 2007, the university discovered that confidential records of about 5,700 current and former faculty members had been hacked. Before that, in 2006, a spreadsheet containing the social security numbers of 632 students was erroneously sent out. While it would be easy to place blame for these security issues on one individual, it is clear that this is a systemic issue that is affecting each of the individual schools at UVA. This seems to be a constant problem for the top university, and it’s clear that major changes need to be made to their security procedures. It’s one thing to say that they’re working on creating safeguards, but it’s another to actually implement them.

In fairness, UVA is not the only school that has had issues like this. In April of 2012, Baylor Law School accidentally sent out admissions information, including names, grades, and LSAT scores, to every single student admitted to the class of 2015. Loyola Law School in Los Angeles sent out an email containing the financial information, including social security numbers and loan amounts, for the entire graduating class in March of 2014.

While there is no guarantee that any real measures will be taken to prevent this type of incident from happening again, hopefully the personnel at UVA will at the very least be a bit more careful when dealing with confidential information.  In his email, George Geis said, “Ruth or I are available if you have any questions or concerns.” I can guarantee you one thing UVA, there will be at least 155 students taking you up on that offer.

—

Brittany Alzfan (@BrittanyAlzfan) is a student at the George Washington University majoring in Criminal Justice. She was a member of Law Street’s founding Law School Rankings team during the summer of 2014. Contact Brittany at staff@LawStreetMedia.com.

Featured image courtesy of [Bob Mical via Flickr]

Brittany Alzfan

Brittany Alzfan is a student at the George Washington University majoring in Criminal Justice. She was a member of Law Street’s founding Law School Rankings team during the summer of 2014. Contact Brittany at staff@LawStreetMedia.com.

The post UVA Law Leaks Confidential Student Information…Again appeared first on Law Street.