Office of Management Privacy Safeguards Division

 

Privacy Impact Assessment

For

Impact Evaluation of Training in Multi-Tiered Systems 

of Support for Behavior (MTSS-B) 

Date: August 1, 2016

Point of Contact and Author: 

Lauren Angelo

Lauren.Angelo@ed.gov

System Owner: 

Audrey Pendleton

Audrey.Pendleton@ed.gov

Institute of Education Sciences

U.S. Department of Education
Privacy Impact Assessment

2 

1. System Information. Describe the system - include system name, system acronym, 

and a description of the system, to include scope, purpose and major functions. Indicate 

whether the system is new or existing, and whether or not the PIA is new or being 

updated from a previous version; specify whether the system is ‘agency’ or ‘contractor.

This is a new system and a new Privacy Impact Assessment. The system name is the “Impact 

Evaluation of Training in Multi-Tiered Systems of Support for Behavior (MTSS-B).” The 

system, which is housed by a contractor and its subcontractors, will maintain records on 

approximately 38,000 students and 3,600 teachers and other school staff from 12 school 

districts. These records will be used to conduct a study to examine the effectiveness of 

providing school staff with training in multi-tiered systems of supports for behavior. 

2. Legal Authority. Cite the legal authority to collect and use this data. What specific 

legal authorities, arrangements, and/or agreements regulate the collection of 

information? 

 The study is authorized under the Individuals with Disabilities Education Improvement Act 

of 2004, Section 664(b)(2) (20 U.S.C. 1464(b)(2)), which instructs the Institute of Education 

Sciences, as part of the “national assessment of activities carried out with Federal funds 

under this title,” to assess “the implementation of programs assisted under this title and the 

impact of such programs on...improving the academic achievement of children with 

disabilities.” It is also authorized under the Education Sciences Reform Act of 2002, Part D, 

Section 171(b)(2) (20 U.S.C. 9561(b)(2)), which authorizes the Institute of Education 

Sciences to “conduct evaluations of Federal education programs administered by the 

Secretary (and as time and resources allow, other education programs) to determine the 

impact of such programs (especially on student academic achievement in the core academic 

areas of reading, mathematics, and science).” The collection of information is regulated by 

the Education Sciences Reform Act of 2002, the Privacy Act of 1974, and the Family 

Educational Rights and Privacy Act. 

3. Characterization of the Information. What elements of personally identifiable 

information (PII) are collected and maintained by the system (e.g., name, social security 

number, date of birth, address, phone number)? What are the sources of information 

(e.g., student, teacher, employee, university)? How is the information collected 

(website, paper form, on-line form)? Is the information used to link or cross-reference 

multiple databases?

 The system will contain personally identifying information on approximately 38,000 students 

and 3,600 teachers and other school staff from 12 school districts and will include, but not 

necessarily be limited to, data on: (1) for students, standardized math and English/Language 

Arts test scores, age, sex, race/ethnicity, grade, eligibility for free/reduced-price lunches, 

English Learner status, individualized education program status, school enrollment dates, 

attendance, discipline records, school engagement, and student behavior, and (2) for teachers 

and other school staff, school assignments, positions, grades and subjects taught, any 

available teacher and staff background characteristics, including age, sex, race/ethnicity, 
Privacy Impact Assessment

3 

certifications, and years of teaching experience, and classroom management and behavior 

support practices. 

 The sources of information are through district records, surveys of students as well as 

teachers and other school staff, observations of classrooms, and ratings of student behavior. 

Data will be collected and maintained in secure electronic form that complies with all federal 

security requirements (see response to question 11). Data will not be used to link or crossreference databases that are external to the study. 

4. Why is the information collected? How is this information necessary to the mission 

of the program, or contributes to a necessary agency activity? Given the amount and

any type of data collected, discuss the privacy risks (internally and/or externally) 

identified and how they were mitigated.

 This information is being collected for statistical purposes. The central purpose and reason 

why the Department is establishing this system of records is to examine the effectiveness of 

providing school staff with training in multi-tiered systems of supports for behavior. In 

particular, the study will address the following primary research questions: (1) What are the 

impacts on school climate, school staff practice, and student outcomes of providing training 

in MTSS-B that includes universal supports (Tier I)? (2) What are the impacts on school 

climate, school staff practice, and student outcomes of providing training in MTSS-B that 

includes universal supports (Tier I) plus targeted interventions for at-risk students (Tier II)? 

(3) What is the impact of additional training in targeted interventions for at-risk students 

(Tier II) for schools already trained in MTSS-B that includes universal supports (Tier I)? (4) 

What are the impacts for relevant subgroups including students with at-risk behavior, 

students with disabilities, and teachers with less experience? (5) Which strategies are 

correlated with improvement in student outcomes? 

 The potential privacy risks from this system include any adverse consequences such as 

embarrassment to students or teachers from having their privacy-protected information used 

and disclosed by unauthorized means. To mitigate these risks, the system establishes strict 

rules, procedures and security requirements related to the collection, maintenance, use, 

disclosure, and destruction of the data, that are outlined in responses to other questions in this 

Privacy Impact Assessment (PIA) and in the System of Records Notice (SORN), which 

together will protect the sensitive student and teacher data collected for the purposes of this 

study from unauthorized use and disclosure. 

5. Social Security Number (SSN). If an SSN is collected and used, describe the purpose 

of the collection, the type of use, and any disclosures. Also specify any alternatives that 

you considered, and why the alternative was not selected. If system collects SSN, the 

PIA will require a signature by the Assistant Secretary. If no SSN is collected, no 

signature is required.

 This system does not collect SSNs. 

6. Uses of the Information. What is the intended use of the information? How will the 
Privacy Impact Assessment

4 

information be used? Describe all internal and/or external uses of the information. 

What types of methods are used to analyze the data? Explain how the information is 

used, if the system uses commercial information, publicly available information, or 

information from other Federal agency databases.

 The intended use of the information is to evaluate the impact of providing school staff with 

training in multi-tiered systems of supports for behavior on school climate, school staff 

practice, and student outcomes. See response to question 4 for information on the specific 

research questions that the information will be used to address. See response to questions 7 

and 8 for information on internal and/or external uses and sharing of the information. The 

system will contain records on approximately 38,000 students and 3,600 teachers and other 

school staff from 12 school districts. To analyze the data and generate findings that meet 

Institute of Education Sciences (IES) research standards, a randomized experimental study 

design and quantitative statistical methods will be used. Data analysis will be conducted 

using data that have been stripped of identifiers (e.g., names), other than encrypted 

identifiers. Data or results that are reported or published will not contain any personally 

identifiable information (PII). Any disclosures of information from the system will be made 

only in compliance with the requirements of section 183 of the Education Sciences Reform 

Act of 2002 (20 U.S.C 9573), the Privacy Act of 1974, as amended (5 U.S.C 552a) and the 

Family Educational Rights and Privacy Act (20 U.S.C. 1232g). 

7. Internal Sharing and Disclosure. With which internal ED organizations will the 

information be shared? What information is shared? For what purpose is the 

information shared?

The Department may disclose information contained in a record in this system of records 

under the routine uses listed in this system of records without the consent of the individual if 

the disclosure is compatible with the purposes for which the record was collected. Any 

disclosure of PII from a record in this system must comply with the requirements of section 

183 of the Education Sciences Reform Act (ESRA) (20 U.S.C. 9573), which provides 

confidentiality standards that apply to all collection, reporting, and publication of data by 

IES.

8. External Sharing and Disclosure. With what external entity will the information be 

shared (e.g., another agency for a specified programmatic purpose)? What information 

is shared? For what purpose is the information shared? How is the information shared 

outside of the Department? Is the sharing pursuant to a Computer Matching Agreement 

(CMA), Memorandum of Understanding or other type of approved sharing agreement 

with another agency?

 The Department may disclose information contained in a record in this system of records 

under the routine uses listed in this system of records without the consent of the individual if 

the disclosure is compatible with the purposes for which the record was collected. Any 

disclosure of PII from a record in this system must comply with the requirements of section 

183 of the Education Sciences Reform Act (ESRA) (20 U.S.C. 9573), which provides 
Privacy Impact Assessment

5 

confidentiality standards that apply to all collection, reporting, and publication of data by 

IES.

(1) Contract Disclosure. The Department may contract with a contractor to perform certain 

functions on behalf of the Department, which could require the disclosure of records in the 

system. The Department may disclose records to contractors (i.e., government 

contractors/employees) who have received the appropriate security clearance level from the 

Department. However, before entering into such a contract, the Department will require the 

contractor to establish and maintain adequate safeguards required with respect to the records 

in the system.

(2) Research Disclosure. The Director of IES may license de-identified confidential 

information from this system of records to qualified external researchers solely for the 

purpose of carrying out specific research that is compatible with the purpose(s) of this system 

of records. The researcher shall be required to maintain the confidentiality of the licensed 

data and to use it only for statistical purposes. All licensing shall be accomplished pursuant to 

the National Center for Education Statistics Licensing Program, described on the following 

website: http://nces.ed.gov/statprog/instruct.asp.

9. Notice. Is notice provided to the individual prior to collection of their information (e.g.,

a posted Privacy Notice)? What opportunities do individuals have to decline to provide

information (where providing the information is voluntary) or to consent to particular

uses of the information (other than required or authorized uses), and how individuals

can grant consent?

A Privacy Notice on data collection forms that meets the requirements of the Privacy Act, 5 

U.S.C. 552a(e)(3), is not required in this study since identifying information, included in 

the district records, is being collected from the district and not directly from the teachers or 

students. No notice is required for student participation in the teacher ratings of student 

behavior or the student survey since the parents of these students are provided with a 

consent form which informs them that student’ participation in the teacher ratings of student 

behavior and students completion of the student survey is voluntary and that the students do 

have the right to skip any questions that they do not wish to answer. Additionally, the 

students are also informed that the student survey is voluntary and that they do have the 

right to skip any questions that they do not wish to answer. No notice is required for 

teachers since those individuals are provided a consent form, as part of the teacher ratings 

of student behavior as well as the teacher survey, which informs them that the data 

collection is voluntary and that they do have the right to skip any question that they do not 

wish to answer. 

10. Web Addresses. List the web addresses (known or planned) that have a Privacy

Notice.

None are planned.
Privacy Impact Assessment

6 

11. Security. What administrative, technical, and physical security safeguards are in place 

to protect the PII? Examples include: monitoring, auditing, authentication, firewalls, 

etc. Has a Certification and Accreditation (C&A) been completed? Is the system 

compliant with any federal security requirements?

All physical access to the Department’s site and to the sites of the Department’s contractor 

and subcontractors where this system of records is maintained, is controlled and monitored 

by security personnel. The computer system employed by the Department offers a high 

degree of resistance to tampering and circumvention. This security system limits data access 

to Department and contract staff on a need-to-know basis and controls individual users’ 

ability to access and alter records within the system. The contractor is required by contract to 

establish a similar set of procedures at their sites to ensure confidentiality of data. The 

contractor will maintain security of the complete set of all master data files and 

documentation. Access to individually identifying data will be strictly controlled. At each 

site, all print data will be kept in locked file cabinets during nonworking hours; all work 

regarding hardcopy data will take place in a single room requiring a key to access which has 

only been granted to data entry staff. At each site, all print data will be kept in locked file 

cabinets during nonworking hours and work on hardcopy data will take place in a single 

room, except for data entry. Physical security of electronic data will also be maintained. 

Security features that protect project data include: password-protected accounts that authorize 

users to use the contractor’s system but to access only specific network directories and 

network software; user rights and directory and file attributes that limit those who can use 

particular directories and files and determine how they can use them; and additional security 

features that the network administrators will establish for projects as needed. The 

Department’s contractors who “maintain” (collect, maintain, use, or disseminate) data in this 

system must comply with the requirements of the Privacy Act and the confidentiality 

standards in section 183 of the ESRA (20 U.S.C. 9573), which provides criminal penalties 

for violations. 

12. Privacy Act System of Records. Is the information within the system retrieved by 

personal identifier? Is a system of records being created or altered under the Privacy 

Act, 5 U.S.C. 552a? Is this a Department-wide or Federal Government-wide SORN? 

If a SORN already exists, what is the SORN Number? 

The system will be covered under an altered SORN, “Impact Evaluation of Training in 

Multi-Tiered Systems of Support for Behavior (MTSS-B)” (18-13-38) which was published 

on March 30, 2015. The information in the system will not include a personal identifier, other 

than a code created specifically for this study 

13. Records Retention and Disposition. Is there a records retention and disposition 

schedule approved by the National Archives and Records Administration (NARA) for 

the records created by the system development lifecycle AND for the data collected? If 

yes – provide records schedule number:

Records are maintained and disposed of in accordance with the Department’s Records 

Disposition Schedules ED 068.a (NARA Job Number N1-441-08-18).