Board directs staff to draft breach‑notification policy after PCOE spreadsheet released Auburn student data

Trustees directed district staff to develop recommended breach‑notification language and policy after learning a Placer County Office of Education (PCOE) public‑records release included information for roughly 10 Auburn students.

The superintendent told the board she had worked with PCOE to identify affected students and that PCOE removed the document shortly after discovery. "They were able to get the names to us of the students whose information went out and exactly what information that was so that we could then reach out to our families and explain," she said. The district reported conducting follow‑up phone calls for families whose records included additional personally identifying or medical‑billing information.

Trustees pressed for a policy that meets California notification requirements and also gives the district a clear notification timeline and checklist. One trustee who said she discovered the spreadsheet via a public‑records request described the contents—clinician name, referral dates, date of birth, homelessness status, address, insurance carrier and policy numbers, treatment minutes—and urged parents to consider removing optional insurance information from school records. The CBO and district counsel (via staff) said the insurer SIG had been engaged and that sample policy language from SIG might be available in a two‑month timeframe; trustees asked the superintendent to coordinate with legal counsel and SIG and to bring recommended policy language for board review with a goal of including language in family handbooks before the next school year.

Board members stressed immediate family outreach had been conducted and asked for a clear plan for notification timelines, interim updates and legal review. The chair suggested an initial notice within 24 hours followed by a more detailed update within several business days while staff completes fact‑finding.