IT for Schools and Daycares: Student Data, Tablets, and Answering Parents

A parent stops you at pickup with a reasonable question. She saw a new app mentioned in a classroom newsletter, and she wants to know who can see her daughter’s information. Not accusingly. She just wants to know. And you realize, standing in the parking lot, that you are not entirely sure. A teacher signed up for it. It seemed useful. Nobody asked you, because nobody knew they were supposed to.

That moment happens constantly, and it is not a discipline problem. It is what happens when good people adopt helpful tools faster than anyone can track them. One important note first: this is general information, not legal advice. Which privacy rules apply depends on what kind of program you run and how you are funded, and a qualified attorney or advisor has to confirm that for you. What follows is the technology and process side.

Knowing What You Actually Hold

Schools and daycares collect an unusual amount of sensitive information about people who cannot consent for themselves: names, birthdates, addresses, photographs, allergies and medications, custody arrangements, pickup authorizations, and sometimes behavioral notes. That is a heavier file than most small businesses ever handle.

The Family Educational Rights and Privacy Act is the federal law governing student education records at schools that receive funding from the US Department of Education. Whether it reaches your program is a legal question, but the ideas behind it are a sound framework for anyone caring for children. In its parent guide to FERPA, published July 9, 2021, the Department’s Student Privacy Policy Office describes education records as records “directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution.” Note that last phrase. Records a vendor holds for you are still your responsibility.

Write down where child information lives. Management system, sign-in tablet, parent app, staff phones, the paper file, and any spreadsheet on a director’s laptop. Note who can reach each one, because that is where the surprises turn up.
Ask what you can stop collecting. As the Federal Trade Commission puts it in its August 2023 guidance “Start with Security,” no one can steal what you do not have.
Decide how long you keep things. Records for a child who left four years ago should not sit in an active shared folder.

Parent Communication Apps and the Click-Wrap Problem

Here is the pattern behind the parking lot conversation. A teacher finds a useful app, clicks through the terms of service, and starts using it with their class. Nobody reviewed the terms. Nobody knows what the company does with the data.

The Department of Education addressed this directly. In “Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices,” published February 2014, the guidance recommends that “schools and districts should develop policies outlining when individual teachers may download and use Click-Wrap software,” and advises them to “conduct an inventory of the online educational services currently being used.”

That inventory is the most useful hour you can spend, and it usually produces surprises. Then set a simple approval path.

Make approval easy and fast. If it takes three weeks, staff route around it and you are back where you started.
Prefer written agreements over checkbox terms. The Department’s guidance advises using a written contract or legal agreement when possible.
Ask about deletion. That guidance says contracts should include data archival and destruction requirements, so information no longer sits on the provider’s systems once the contract ends.
Keep one list parents can see. Answering the pickup question in ten seconds is worth the effort by itself.

The Tablet Cart Nobody Manages

Almost every school and center has one: a cart of tablets, some bought, some donated, some inherited from a family that upgraded. Nobody is quite sure which still receive updates, which are signed into someone’s personal account, or how many are actually in the building.

Count and label them. A numbered list on the cart, checked monthly. Unglamorous and effective.
Retire anything that no longer gets updates. A tablet the manufacturer stopped supporting should not handle child information.
Wipe donated devices properly. They often arrive still signed into the previous owner’s accounts.
Use school accounts, not personal ones. When staff sign in with personal accounts, the organization’s data leaves with them.
Turn on passcodes and remote wipe. A tablet that walks out should be a hardware loss, not a data loss.

Staff Accounts, Turnover, and Background Checks

Childcare and education have real turnover, and account cleanup never keeps pace. A former aide with a live login to the parent app and child records is a gap nobody intends and everybody has.

The access side deserves the same rigor as your hiring side. FERPA’s parent guide explains that school officials may access records without consent when they have a “legitimate educational interest,” meaning the official “needs to review an education record in order to fulfill his or her professional responsibility.” Whether or not that rule applies to you, it is a good test: does this person need this information to do their job today?

Add account closure to offboarding. Same list as the key, the badge, and the final timesheet.
Give access by role. A classroom aide, a lead teacher, and a director should not all see the same records.
Individual logins only. Shared logins make it impossible to answer who looked at what.
Turn on multi-factor authentication. Especially for email and child records. We compared the options in YubiKey versus passkeys versus standard MFA.

Tight Budgets and Donated Equipment

Nobody in this field has spare money, and donated equipment is a lifeline. It is still worth being choosy. A donated computer that can no longer receive security updates is not savings. It is a future problem sitting on a desk where staff enter family information.

Ask one question when equipment is offered: can it still get updates from the manufacturer? If yes, wipe it and set it up properly. If no, thank the donor warmly and decline, or use it for a job that never touches child data. Also ask every vendor you pay whether they offer education or nonprofit pricing. Many do, and the savings can fund what you have been putting off.

When a Parent Asks Who Can See Their Child’s Information

Have a real answer ready, because the question is coming. Under FERPA, the Department of Education’s parent guide states that a school or state educational agency “must provide a parent with an opportunity to inspect and review their child’s education records within a reasonable period of time, but not more than 45 calendar days,” that parents may seek amendment of records they believe are inaccurate, and that a school “generally may not disclose PII from a student’s education records to a third party unless the student’s parent has provided prior written consent.” Whether these rules bind your program is a legal question for your advisor.

Regardless of what applies, being able to say “here are the systems we use, here is who has access, and here is how you review your child’s records” turns an uncomfortable moment into a trust-building one. Write that answer down once and give it to your front desk.

The Bottom Line

The work here is mostly organizational rather than technical. Know what you hold and where. Keep one list of the online services in use and put a light approval step in front of new ones. Manage tablets like equipment you own. Close accounts the week people leave. Be choosy about donated hardware. Have a clear answer ready for parents. To repeat: this is general information, not legal advice, and a qualified attorney or advisor must confirm which requirements apply to your program. For broader context, see why cybersecurity is no longer optional for mid-sized businesses.

We work with schools, childcare centers, and nonprofits across Denton County, and we know the budget is real and the day is already full. If you want help building that inventory or tightening staff accounts, we are glad to start small. Contact us today.

Sources:

Data Privacy Hardware Passwords and MFA Small Business IT

Comments are closed