Skip to main contentSkip to main content
You are the owner of this article.
You have permission to edit this article.
Edit
top story breaking
lcs | covid-19

Lynchburg City Schools sent student info to COVID-19 testing firm in 'genuine error'

Personal information about Lynchburg City Schools students was provided to a COVID-19 testing firm last year in what officials called a “genuine error,” according to a letter sent to parents this week.

The letter says between Oct. 20 to 28, 2021, the school system “may have provided” the firm, Aegis Sciences Corporation, the following information about students as part of an “initial upload of directory information”: name; gender, ethnicity and race; address and phone number; date of birth; grade and school; and parent or guardian email.

Last school year, LCS partnered with the Virginia Department of Education and the Virginia Department of Health to participate in voluntary, weekly COVID-19 testing to any student or staff member who was willing to participate. Aegis provided testing supplies, on-site testing and results.

On about Aug. 9, the letter says, some LCS parents received emails saying their child was “previously registered to participate in Aegis Sciences Corporation’s weekly Covid-19 screening through the TestingWorks program.”

LCS sent a follow-up email later that day saying the email was only intended for “active participants” in the COVID-19 testing program. But, according to the letter, the email was sent to parents who did not register their children in the program as well.

After looking further into the incident, the letter says, LCS found “additional information regarding your child[ren] may have been provided to Aegis” during October 2021.

LCS Director of Student Services Derrick Brown said in an interview Thursday an employee with LCS last year who, while initiating the program, went ahead and uploaded student information to “try to provide an opportunity that was beneficial for all of our families.”

Brown said that person no longer is employed by the school division.

“As soon as we found out about that, we immediately went into remediation to try to remedy the situation and make sure we were being transparent and trying to build trust with our families and communities,” Brown said.

“That was not a decision made by our senior leadership or our superintendent,” Brown said about the move to upload all student information into the program. “That was a decision made by an individual.”

In the letter — signed by Brown, Superintendent Crystal Edwards and Division Health Testing Coordinator Tinisha Thomas — officials “sincerely apologize for any inconvenience or confusion this may have caused.”

“Once we became notified of what was going on, we immediately investigated to try to get to the bottom of it because, as superintendent, I was not aware that this was it,” Edwards said in an interview Thursday.

“We’ve been on the phone with the company to confirm that all of the information which was uploaded to a secure server was deleted, and that no other official other than those administering the testing program had access to it,” Edwards said.

Data was not shared or sold by Aegis, and a way for families to sign up to voluntarily share their information for the program going forward will be provided, the letter says.

On Wednesday night, Lynchburg City Council candidate Martin Misjuns issued a news release with a screenshot of an email that appears to be from an account manager at Aegis saying, “Lynchburg chose to upload all their student body for testing and in error on our team a message was sent to all participants instead of those actively testing.”

Misjuns said the error could have been a violation of the Family Educational Rights and Privacy Act, which requires school divisions to “obtain your written consent prior to the disclosure of personally identifiable information from your child’s education records.”

Misjuns added in his news release, “These irresponsible actions by Lynchburg City Schools violated our children’s privacy and warrants further investigation to determine if children were subjected to medical testing without the knowledge or consent of their parents or guardians.”

Asked about the possibility of a FERPA violation, Edwards said, “I would say we were concerned for a minute that our parents were alerting us that they had not participated and they received the email, so that prompted us to look into it, to call the company directly, speak with folks, find out exactly what information was shared, how did they get the information and when did they get the information.

“Our student data is very important to us. We keep it very secure, so you can imagine we do not want any data leaks, so we jumped right on that.”

Edwards said in the interest of transparency, LCS sent the letter out to families “immediately” after they confirmed steps of remediation with Aegis.

* I understand and agree that registration on or use of this site constitutes agreement to its user agreement and privacy policy.

Related to this story

Get up-to-the-minute news sent straight to your device.

Topics

Breaking News

News Alert