Student Checklists - Uploaded items

Candi Roberts

We have been using Student Checklists to gather any needed documents that we didn't get during the application process or that we needed after enrollment. This has worked great for getting updated immunization forms and birth certificates (if they were accepted before uploading it in the admissions process - that checklist goes away so I had to have a way to remedy that).

Imagine my surprise when I impersonated a student recently (which I rarely do - usually staff or parents) and discovered those uploads were available to students on their Progress tab, not even tucked away in Files and Forms, and NOT to viewable to their parents. We're talking about children having access to their birth certificates, social security cards, or whatever I needed from the parents. Why would they provide access to students that parents don't have, especially of potentially sensitive information?

There was no warning from Blackbaud that this would happen when creating the upload checklist items. In fact, I have gone round and round with support trying to get a reasonable explanation. Why are you not permitting schools to determine what is being published in this instance? If I had known, I would have deleted the item as soon as I printed them and marked them complete for their permanent file. I am going through deleting those uploads now that have sensitive information. Just passing this on in case someone else needs to know and in hopes that Blackbaud will consider a remedy.

Candi Roberts

Here's a place you can vote on this idea.

Bryna Gleich

@Candi Roberts

This isn't my area, but I do have a question just so I can understand it better.

I thought the minor's birth certificate and social security card legally belonged to the minor. I thought that minors could request them from governments without parental consent as long as the minor had their paperwork and ID in order.

I remember this being important a long time ago when I had a teenage student (in public school) whose step father was abusing her and she needed access to her documents when she moved out of his house to a safer place. Basically it “belonged" to the teen and her caregivers were just supposed to keep it on her behalf, but if she was ready for it then it was legally hers. When the abuser tried to “hold her documents hostage,” that wasn't right, as they legally belonged to her.

If so, then maybe it's ok to protect the student and not to share with people the family doesn't want to have it, but it shouldn't necessarily prevent the student from accessing their own stuff. Does that sound right? Or maybe this varies by state?

Is there some other type of sensitive document or extenuating circumstance that's part of the concern that I'm not thinking of? For example was the student adopted but doesn't know that? Or is it perhaps a document about the parents' finances which the student shouldn't know, which doesn't belong to the student but does belong to the parent?

Updated: I see now that the linked Ideabank also mentions Parent's Driver's license as part of the concern. Thanks for this additional info!

Candi Roberts

@Bryna Gleich My concern is that young children, who don't know about identity theft, or other concerns, would have this access without their parents' knowledge. I only need these items for their permanent file and the student checklists was a simple way to receive them, but the intent was never to have them actually available to them in Blackbaud. The school should be able to determine what is viewable. I get to determine that everywhere else. If I created a file in Core, I could upload those same items and they wouldn't have access unless I gave it to them. In fact, when a birth certificate is uploaded during the application process as Age Verification, it doesn't load to the student's progress tab then either. It's very inconsistent.

Bryna Gleich

@Candi Roberts Thanks for the info. This helps contextualize the issue.

Kelsey Huijgen

@Candi Roberts Just wanted to jump into let you know our team is aware of this concern. We added a helplet in the checklist step setup to clarify that the Show To setting only applies to the checklist step itself and not to the associated file, which will hopefully help clarify what that setting controls. We are planning on reviewing security around files in the near future but we don't have any changes scheduled at this time. I have your idea on my list and will be sure to update the status if we're able to make any changes!

Thanks,
Kelsey Huijgen, Product Manager

Candi Roberts

@Kelsey Huijgen Thank you. I was aware the Show To only applied to the step but there was NO place that told me where the document would end up. I reasonably assumed it would just show up for us in Enrollment Management. That's a serious flaw. Thanks for looking into it.