FY 2020

Privacy Impact Assessment (PIA) 

for the 

Text ED: Study of Text Messaging to Improve College Enrollment 

Rates Among Disadvantaged Adults

November 22, 2019

For PIA Certification Updates Only: This PIA was reviewed on November 19, 2019 by 

Melanie Ali certifying the information contained here is valid and up to date.

Contact Point 

Contact Person/Title: Melanie Ali

Contact Email: Melanie.Ali@ed.gov

System Owner 

Name/Title: Melanie Ali

Principal Office: Institute of Education Sciences (IES)

Please submit completed Privacy Impact Assessments to the Privacy Office at 

privacysafeguards@ed.gov 
Fiscal Year 2020 Privacy Impact Assessment -Page 1

Please complete this Privacy Impact Assessment (PIA) on how personally identifiable 

information (PII) is collected, stored, protected, shared, and managed electronically by your 

system. You may wish to consult with your ISSO in completing this document. 

If a question does not apply to your system, please answer with N/A.

1. Introduction 

1.1. Describe the system including the name, acronym, and a brief description of the program 

or purpose for the system. 

The project, “Text Ed: A Study of Text Messaging to Improve College Enrollment Rates 

Among Disadvantaged Adults,” is rigorously evaluating whether the use of a promising, 

low cost text messaging strategy can help Education Opportunity Center (EOC) grantees 

meet the program’s goal of increasing college enrollment among disadvantaged adults. 

EOCs, which are part of the TRIO family of programs, provide informational services 

related to the college-going process and financial aid options. Many of the clients 

served by EOCs are adults who are low-income and potential first-generation college 

goers. This study is being conducted under legislative mandate to study promising 

practices with the potential to improve outcomes for the Department’s TRIO programs. 

TRIO programs are federal outreach and student services programs designed to identify 

and provide services for individuals from disadvantaged backgrounds

The project will examine the implementation of the text messages within the 18 EOCs 

that volunteered to participate in the study, and the impact of the messages on clients’ 

rates of completion of the Free Application for Federal Student Aid (FAFSA) and 

enrollment in college. The text messages are delivered through a messaging service 

provided by Signal Vine. 

Study data will be stored at the following locations: 

MDRC, 19th floor, 16 East 34th Street, New York City, NY 10016-4326. 

Signal Vine, 811 North Royal Street, Alexandria, VA 22314-1715. 

1.2. Describe the purpose for which the personally identifiable information (PII)1 is collected, 

used, maintained or shared. 

1

 The term “personally identifiable information” refers to information which can be used to distinguish or trace an 

individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined 

with other personal or identifying information which is linked or linkable to a specific individual, such as date and 

place of birth, mother's maiden name, etc. OMB Circular A-130, page 33
Fiscal Year 2020 Privacy Impact Assessment -Page 2

The data will be used to describe the implementation of the study’s text messaging 

intervention and to estimate the impact of the intervention on study participants’ rates of 

FAFSA completion and college enrollment. Along with enrolling in college, helping 

clients to access financial aid is a key goal of EOCs. The study complies with the 

legislative mandate that ED conduct studies of strategies to improve outcomes for TRIO 

programs. 

PII is being collected in order to randomly assign the clients who volunteer to participate 

in the study to a group that gets the evaluation’s text messages or a group that does not, 

to obtain outcome data on FAFSA completion and college enrollment from the Office of 

Federal Student Aid and the National Student Clearinghouse, to describe the background 

characteristics of study participants, and potentially to create subgroups for analysis 

based on background characteristics. For clients who are assigned to receive the 

evaluation’s text messages, information on the text messaging is also being collected 

and maintained in order for the evaluation to describe implementation and appropriately 

interpret impact estimates. 

Ultimately, the findings from this evaluation will be used to determine whether 

systematic, personalized text messaging is a useful enhancement to EOCs’ existing 

services. Aggregate findings from the study will be presented in a written report that will 

be publicly available and shared with the EOCs and relevant Department of Education 

offices. The data from the evaluation with PII will not be publicly released. 

1.3. Is this a new system, or one that is currently in operation? 

Currently Operating System 

1.4. Is this PIA new, or is it updating a previous version? 

Updated PIA 

1.5. Is the system operated by the agency or by a contractor? 

Contractor 

1.5.1. If the system is operated by a contractor, does the contract or other acquisitionrelated documents include privacy requirements? 

N/A

Yes
Fiscal Year 2020 Privacy Impact Assessment -Page 3

2. Legal Authorities and Other Requirements 

If you are unsure of your legal authority, please contact your program attorney. 

2.1. What specific legal authorities and/or agreements permit and regulate the collection and 

use of data by the system? Please include name and citation of the authority.

The study is authorized under sections 171(b) and 173 of the Education Sciences Reform 

Act of 2002 (ESRA)(20 U.S.C. 9561(b) and 9563) and under Section 402(H) of the 

Higher Education Opportunity Act of 2008 (20 U.S.C. 1070a–18). These pieces of 

legislation provide IES with authority to conduct studies of promising strategies with 

potential to improve outcomes for TRIO programs. 

SORN 

2.2. Is the information in this system retrieved by an individual’s name or personal identifier 

such as a Social Security Number or other identification? 

Yes 

2.2.1. If the above answer is YES, this system will need to be covered by Privacy Act 

System of Records Notice(s) (SORN(s)).2

 Please provide the SORN name, number, 

Federal Register citation and link, or indicate that a SORN is in progress. 

N/A

“Text Ed: A Study of Text Messaging to Improve College Enrollment Rates Among 

Disadvantaged Adults (18-13-41)” was published in the Federal Register on 

December 14, 2018. 83 FR 64338. 

https://www.federalregister.gov/documents/2018/12/14/2018-27144/privacy-act-of1974-system-of-records

2.2.2. If the above answer is NO, explain why a SORN was not necessary. For 

example, the information is not retrieved by an identifier, the information is not 

maintained in a system of records, or the information is not maintained by the 

Department, etc. 

N/A

Click here to enter text. 

2

 A System of Records Notice (SORN) is a formal notice to the public that identifies the purpose for which PII is 

collected, from whom and what type of PII is collected, how the PII is shared externally (routine uses), and how to 

access and correct any PII maintained by ED. https://connected.ed.gov/om/Documents/SORN-Process.pdf 
Fiscal Year 2020 Privacy Impact Assessment -Page 4

Records Management 

If you do not know your records schedule, please consult with your records liaison or send 

an email to RMHelp@ed.gov

2.3. What is the records retention schedule approved by National Archives and Records 

Administration (NARA) for the records contained in this system? Please provide all 

relevant NARA schedule numbers and disposition instructions. 

IES is currently working with the Records Management Division to draft an appropriate 

records retention schedule for the data collected. Until a retention schedule is approved, 

all records will be held indefinitely. 

2.4. Is the PII contained in this system disposed of appropriately, and in accordance with the 

timelines in the records disposition schedule? 

Yes 

3. Characterization and Use of Information 

Collection 

3.1. List the specific PII elements (e.g., name, email, address, phone number, date of birth, 

Social Security, etc.) that the system collects, uses, disseminates, or maintains. 

The project includes personally identifying information on adults who volunteer to 

participate in the study, including name, contact information, date of birth, sex, 

race/ethnicity, income, Social Security Number, educational background and plans, 

whether the participant is a caretaker for children, parents’ educational background, 

primary language spoken, FAFSA completion status, and college enrollment status. For 

the subset of adults who volunteer to participate in the evaluation and are randomly 

assigned to receive the study’s text messages, the project will also include information 

related to the text messages. This includes the following: the direction of the message 

(sent to client / received by client), the verbatim message content; and the date and time 

the message was sent. 

3.2. Does the system collect only the minimum amount required to achieve the purpose 

stated in Question 1.2? 

Yes 
Fiscal Year 2020 Privacy Impact Assessment -Page 5

3.3. What are the sources of PII collected (e.g., individual, school, another agency, 

commercial sources, etc.)? 

The study includes individual-level data on adults who volunteer to participate in the 

study. The sources of these data are EOC sites’ administrative records, a survey 

administered to and regarding adults who volunteer to participate in the study, FSA 

administrative records, National Student Clearinghouse records, and the text messaging 

platform provider’s records. 

3.4. How is the PII collected from the stated sources listed in Question 3.3 (e.g., paper form, 

web page, database, etc.)? 

Data from the Federal Student Aid (FSA) Office, the National Student Clearinghouse 

and the text messaging platform provider, and study EOCs will be collected 

electronically. FSA data will be obtained through a data pull conducted on-site at the 

FSA Office. Data from the National Student Clearinghouse (NSC), the text messaging 

provider and study EOCs will be collected via a secure transfer file transfer website. A 

small amount of background information on participants not available through EOC 

records will be collected via a participant survey. The participant survey is electronic, 

although paper copies are available for situations in which participants do not have 

internet access. 

3.5. How is the PII validated or confirmed to ensure the integrity of the information 

collected?3

 Is there a frequency at which there are continuous checks to ensure the PII 

remains valid and accurate? 

PII is validated upon data entry by using restricted form filling within the participant 

survey for name, date of birth, social security number, and telephone number(s); name 

data must contain more than two letters and must match data on second confirmation 

screen, date of birth must indicate that someone is greater than either 17 years old and 

less than 100 years old and must match date provided on second confirmation screen, 

SSN must contain 9 digits, and telephone number must contain 10 digits and must match 

data provided on second confirmation screen. The text messaging platform provider 

checks for duplicate cell phone numbers and flags cell phone numbers that have been 

marked as invalid by cell phone carriers. Validation of integrity for the PII that is 

sourced from administrative records of EOCs, FSA, the National Student Clearinghouse, 

or the text messaging platform provider will rely on the methods of those entities. 

3

 Examples include restricted form filling, account verification, editing and validating information as it’s collected, 

and communication with the individual whose information it is. 
Fiscal Year 2020 Privacy Impact Assessment -Page 6

All PII is reviewed for odd and outlier values on a quarterly basis. Study participants are 

not routinely contacted to confirm whether their PII changes over time. Participants who 

receive the texting intervention may have their names and phone numbers verified and 

updated through their ongoing contact with EOC staff. 

Use 

3.6. Describe how the PII is used to achieve the purpose stated in Question 1.2 above. 

The information collected will be used to describe the implementation of the study’s text 

messaging intervention and to estimate the impact of the intervention on study 

participants’ rates of FAFSA completion and college enrollment. The study addresses 

the following research questions: Does providing personalized messages to EOC 

participants increase FAFSA completion rates? Does it increase college enrollment 

rates? What are participants’ experiences with the text messages (for instance, how often 

do they receive the messages? How often do they text back in response?)? To what 

extent does the effectiveness of the messaging vary across EOC grantee sites? To what 

extent does the effectiveness vary across participant subgroups? 

3.7. Is the system using PII for testing/researching new applications or information systems 

prior to deployment or for training employees? 

No 

3.7.1. If the above answer is YES, what controls are in place to minimize the risk and 

protect the data? 

N/A

Click here to enter text. 

Social Security Numbers 

It is the Department’s Policy that, in order to collect Social Security Numbers, the System Owner 

must state the collection is: 1) authorized by law, 2) necessary for an agency purpose, and 3) 

there is no reasonable alternative. 

3.8. Does the system collect Social Security Numbers? Note that if the system maintains 

Social Security Numbers but does not explicitly collect them, answer 3.8.1 to address the 

purpose for maintaining them. 

Yes 
Fiscal Year 2020 Privacy Impact Assessment -Page 7

3.8.1. If the above answer is YES, explain the purpose for its collection, and how the 

SSN will be used. 

N/A

Many, but not all, EOCs already collect Social Security Numbers from clients, and 

only EOCs who are willing to do so are included in the study. This is necessary 

for the evaluation to be able to accurately match study participants to records 

maintained by the Office of Federal Student Aid and the National Student 

Clearinghouse. Study participants provide active consent to the disclosure of 

Social Security Numbers to the National Student Clearinghouse. 

3.8.2. Specify any alternatives considered in the collection of SSNs and why the 

alternatives were not selected. 

N/A

Without the collection of Social Security Numbers, the evaluation will not be able 

to adequately examine impacts on FAFSA completion and college enrollment 

rates, which are key outcomes for the EOC program. Matching study participants 

to Federal Student Aid and National Student Clearinghouse records based on name 

and date of birth alone would substantially reduce the study’s ability to detect 

impacts and meet the legislative mandate to evaluate strategies to improve TRIO 

program outcomes. 

4. Notice 

4.1. How does the system provide individuals with notice about the collection of PII prior to 

its collection (e.g., direct notice, such as a Privacy Act Statement (if applicable) or 

public notice, such as a SORN, PIA,)? If notice is not provided, explain why not. 

As noted under 2.2.1, a SORN was published on December 14, 2018. 

In addition, study participants provide active consent through an informed consent form 

provided by EOC staff prior to the study’s collection of PII. 

4.2. Provide the text of the notice or the link to the webpage where the notice is posted if 

notice is provided other than by SORN or PIA. 

N/A

The study’s informed consent form contains the following language: 

“If you agree to take part in the study, the information you provided at intake (name, 

date of birth, contact information, Social Security Number, and other 
Fiscal Year 2020 Privacy Impact Assessment -Page 8

background/demographic information) will be shared with the Manpower 

Demonstration Research Corporation (MDRC) study team. You will also be asked to 

provide some additional information via a Study Enrollment Form. This information 

will also be shared with the MDRC study team. Updates to the information you provide 

via the Study Enrollment Form may also be shared with the MDRC study team by EOC 

staff. 

Using some of the information you provided when you signed up at the EOC –

specifically, your name, date of birth, and Social Security Number -- the study team will 

obtain college enrollment information from educational institutions and the National 

Student Clearinghouse (NSC) database, as well as financial aid information (whether or 

not you submitted the Free Application for Federal Student Aid (FAFSA) and the award 

amount) from the Department of Education’s Federal Student Aid (FSA) database. If you 

are placed in the “EOC Services plus Text Ed Group,” the study team will also collect 

details of the Text Ed text messages. 

...Your participation in the study is voluntary, and will not affect your access to the 

regular EOC programs and services at [site]. If you join the study and are selected to 

receive the Text Ed messages, you may choose to stop receiving the messages at any 

time. You may also ask to opt out of the study at any time. If you withdraw from the 

study, any information collected by the study team before that time may still be used for 

the study. If you choose not to participate in the study, you may still access regular EOC 

programs and services, but you will not have the opportunity to receive the Text Ed text 

messages. 

4.3. What opportunities are available for individuals to consent to uses (including new uses 

of previously collected PII), decline to provide PII, or opt out of the project? 

Participation in the study is voluntary. Clients may choose not to participate in the 

evaluation and thus not to provide PII to the project. Clients opt out of the project by not 

signing the informed consent. Clients who opt out can continue to receive EOCs’ typical 

services. 

4.4. Is the notice referenced in Question 4.1 reviewed and revised when there are changes in 

the practice, policy, or activities that affect the PII and privacy to ensure that individuals 

are aware of and can consent to, where feasible, these changes? 

Yes 
Fiscal Year 2020 Privacy Impact Assessment -Page 9

5. Information Sharing and Disclosures 

Internal 

5.1. Will PII be shared internally with other ED principal offices? If the answer is NO, please 

skip to Question 5.4. 

Yes 

5.2. What PII will be shared and with whom? 

N/A

The names, dates of birth, and Social Security Numbers of study participants will be 

shared internally with the Federal Student Aid Office. 

5.3. What is the purpose for sharing the specified PII with the specified internal 

organizations? 

N/A

This is for the purpose of matching participants to the administrative records of the 

Federal Student Aid Office, in order to obtain FAFSA completion outcomes for study 

participants. This aligns with the stated purpose in Question 1.2—specifically, 

estimating the impact of the text messaging on FAFSA completion rates among EOC 

participants, in order to inform improvements to the EOC program. 

External 

5.4. Will the PII contained in the system be shared with external entities (e.g. another agency, 

school district, the public, etc.)? If the answer is NO, please skip to Question 6.1. 

Yes 

5.5. What PII will be shared and with whom? List programmatic disclosures only.4

 

Note: If you are sharing Social Security Numbers externally, please specify to 

whom and for what purpose. 

N/A

Each study EOC will be provided the names of the EOC’s study participants assigned to 

receive text messages. 

Signal Vine, the text messaging platform provider, will be provided the names of the 

study participants assigned to receive text messages, as well as those participants’ 

4

 If this information is covered by Privacy Act System of Records Notice (SORN) please list only relevant 

programmatic disclosures listed under the Routine Uses section. 
Fiscal Year 2020 Privacy Impact Assessment -Page 10

unique research ID, cell phone number, information related to the status of their college 

and FAFSA applications, information related to their work and childcare plans, and the 

EOC at which the participant receives services. 

The names, dates of birth, and Social Security Numbers of study participants will be 

shared with the National Student Clearinghouse in order to collect information from the 

Clearinghouse on college enrollment. 

As required by the Education Sciences Reform Act of 2002 (ESRA) (20 U.S.C. 9561(b) 

and 9563), a restricted use data file with study created identifiers will be available to 

researchers who are approved license holders and are in compliance with NCES data 

security procedures. The data file will exclude direct identifiers, including participant 

name, date of birth, and Social Security Number. 

5.6. What is the purpose for sharing the PII with the specified external entities? 

N/A

In order to permit EOC staff to communicate via text message with participants assigned 

to receive text messages, study EOCs will be provided with the names of participants 

who are randomly selected to receive the messages. 

The information described above regarding participants assigned to receive text 

messages will be shared with Signal Vine for the purpose of Signal Vine sending the 

automated text messages to the participants. 

The names, dates of birth and Social Security numbers of study participants will be 

shared with the National Student Clearinghouse in order to match participants to the 

National Student Clearinghouse’s administrative records on college enrollment. This 

will allow the study to estimate the impacts of the text messaging on college enrollment 

rates, consistent with the stated purpose in Question 1.2. 

The restricted use data file will be for the purpose of allowing licensed researchers to 

replicate the study’s findings and for further research purposes 

5.7. Is the sharing with the external entities authorized? 

N/A

Yes
Fiscal Year 2020 Privacy Impact Assessment -Page 11

5.8. Is the system able to provide and retain an account of any disclosures made and make it 

available upon request? 

N/A

Yes 

5.9. How is the PII shared with the external entity (e.g. email, computer match, encrypted 

line, etc.)? 

N/A

The names of study participants who are randomly selected to receive the text messages 

will be disclosed to study EOCs through Signal Vine’s secure website. 

Data shared between the contractor and Signal Vine occurs through secure file transfer. 

Study participants’ names, dates of birth, and Social Security Numbers will be 

transmitted electronically from the contractor to the National Student Clearinghouse, 

using a secure file transfer protocol. The MDRC study team maintains an MOU with the 

National Student Clearinghouse. 

The restricted use data file will be provided to licensed researchers on encrypted, 

password-protected CD. Researchers must sign a memorandum of understanding with 

the Department before being granted access to the data file 

5.10. Is the sharing pursuant to a Computer Matching Agreement (CMA), 

Memorandum of Understanding (MOU), or other type of approved sharing agreement 

with another agency? 

N/A

Yes

5.11. Does the project place limitation on re-disclosure? 

N/A

Yes 

6. Redress 

6.1. What are the procedures that allow individuals to access their own information? 

Individuals may access their information by calling, emailing, or visiting the EOC 

grantee site through which they are enrolled. Individuals may also send an email to: 

IES_SORN@ed.gov as indicated in the SORN listed in Section 2. 
Fiscal Year 2020 Privacy Impact Assessment -Page 12

6.2. What procedures are in place to allow the subject individual to correct inaccurate or 

erroneous information? 

Individuals may correct inaccurate contact and background information by calling, 

emailing, or visiting the EOC grantee site through which they are enrolled. Individuals 

may also send an email to: IES_SORN@ed.gov as indicated in the SORN listed in 

Section 2. 

6.3. How does the project notify individuals about the procedures for correcting their 

information? 

Individuals are notified of the procedures for correcting their information through their 

EOCs and through the publication of the SORN and this PIA. 

https://www.federalregister.gov/documents/2018/12/14/2018-27144/privacy-act-of1974-system-of-records 

7. Safeguards 

If you are unsure which safeguards will apply, please consult with your ISSO. 

7.1. Does the principal office work with their CSO/ISSO to build privacy & security into the 

system and build privacy extensions to the extent feasible? 

Yes 

7.2. Is an Authority to Operate (ATO) required? 

No 

7.3. Under NIST FIPS Pub. 199, what is the security categorization of the system: Low, 

Moderate, or High? 

N/A

Moderate

7.4. What administrative, technical, and physical safeguards are in place to protect the 

information? 
Fiscal Year 2020 Privacy Impact Assessment -Page 13

Data are collected and stored in compliance with federal standards for the use, 

protection, processing, and storage of data consistent with the Privacy Act and the 

Education Sciences Reform Act of 2002. Access to individually identifying data will be 

strictly controlled. Safeguards include password-based and two-factor authentication, 

role-based access control, data encryption and physical data center security. The 

contractor’s employees who “maintain” (collect, maintain, use, or disseminate) data in 

this project will comply with the requirements of the confidentiality standards in section 

183 of the ESRA (20 U.S.C. 9573). The contractor employees undergo privacy 

awareness and protecting information training. The training includes information on 

what constitutes PII and Sensitive PII (SPII) and how to maintain, protect, and safeguard 

it, as well as the steps to perform if PII/SPII is unlawfully accessed. 

7.5. Is the information in the system appropriately secured in accordance with the IT 

security requirements and procedures as required by Federal law and policy? 

Yes 

7.6. Has a risk assessment been conducted where appropriate security controls to protect 

against that risk have been identified and implemented? 

Yes 

7.7. Please describe any monitoring, testing or evaluation conducted on a regular basis to 

ensure the security controls continue to work properly at safeguarding the PII. 

The contractor provides regular updates to the system owner regarding access to data, 

data management, and date security procedures. This includes personnel updates and use 

of data more generally. 

The contractor conducts vulnerability assessments of the information system by 

performing authenticated operating system scans on a monthly basis. The contractor 

also performs database and web application scans on a monthly basis using 

authenticated credentials. On a monthly basis, the contractor validates that the functions, 

ports, protocols and services are limited to those that are defined as permitted functions, 

ports, protocols and services. 

 

Vulnerability scans are conducted routinely by the contractor’s Security System 

Administrators or designee. Vulnerability scans are authorized and conducted on all 

virtual network resources, virtual servers, applications: 

• Monthly 
Fiscal Year 2020 Privacy Impact Assessment -Page 14

• Randomly 

• Prior to resources, servers, and applications entering the network 

• Prior to web applications moving into production 

• When significant new vulnerabilities potentially affecting the system(s) are 

identified and reported. 

8. Auditing and Accountability 

8.1. How does the system owner assess and ensure that the PII is used in accordance with 

stated practices in this PIA? 

The system owner is in frequent contact with the contractor. An updated list is kept that 

identifies individuals on the contractor's staff with access to the data and the contractor 

must clear with the system owner any addition of data elements or use of data for 

analysis. 

8.2. Does the system owner continuously monitor and audit the privacy controls to ensure 

effective implementation? 

Yes 

8.3. What are the privacy risks associated with this system and how are those risks 

mitigated? 

The primary risk is that adults participating in the study will be identified and their 

Social Security Numbers compromised. To mitigate these risks, study participants are 

assigned an ID that is not based on their Social Security number. Directly identifying 

information such as SSNs are maintained in a separate file from other study data. The 

risk of identification and compromise of SSNs is further mitigated by granting access to 

only authorized individuals based on their respective position and need-to-know basis, 

limiting users to those who are screened, utilizing least privilege principles, and 

encrypting all data in transmission.