Schools Say Deeply Personal Survey Saved Lives. Then They Released Student Data.
The Tahoma School District participates in the Check Yourself survey, a mental health screening tool also used in Seattle-area schools—but Seattle’s experience should serve as a warning. While the survey was promoted as confidential, parents were able to obtain detailed student responses through public records requests, with at least one parent successfully identifying multiple students using basic online searches. This alarming failure to protect sensitive data raises serious concerns about transparency and security. If it happened in Seattle, could it happen in Tahoma? Read more to understand the risks and why this issue matters for our community.
March 3, 2025 Update: Tahoma Implicated in Data Breach Investigation – Discrepancies in Official Statements
One of the individuals investigating the recent data breach reached out with troubling new information: Tahoma School District was also affected. While student names were masked in the Check Yourself survey results, nearly all other personally identifiable information (PII) remained exposed. This included details such as age, grade level, school, race, gender identity, sexual orientation, and responses containing highly personal details—some related to self-harm, mental health struggles, and home life.
The implications of this breach are deeply concerning. Even without explicit names, basic deductive reasoning can be used to link responses to specific students. Consider this hypothetical scenario: a sixth grader at Summit Trail Middle School who identifies as biracial, female, and is questioning their sexual orientation. While their name may have been omitted, the combination of factors—age, school, racial identity, and gender preference—could significantly narrow down their identity. Once identified, others could easily read their deeply personal responses, including any struggles with depression, self-harm, or anxiety, and use that information against them.
Emails obtained by Tahoma Parents from 2022 show Public Relations Director, AJ Garcia, responding to inquiries regarding data security when concerns were expressed regarding this survey originally. Garcia stated that "no personally identifiable student information" is shared with King County or Tickit Health. However, this claim conflicts with the fact that individual students are assigned numbers through the screener, which can be linked to their responses. Additionally, while Garcia asserts that "no information is provided with any student name," the exposure of unique demographic identifiers makes it possible to quickly infer student identities.
Even more troubling, students as young as sixth grade at Summit Trail Middle School are being asked about their sexual orientation in these surveys—often without direct parental knowledge or involvement. The email from Garcia confirms that the survey is viewed by school counselors who use the information to identify students for follow-up interventions. Given the district’s inability to fully anonymize responses, this practice not only raises ethical concerns but also exposes students to potential breaches of their most private information.
The district's reassurances do not align with the realities of this data exposure. Parents deserve transparency, accountability, and immediate corrective action. This incident should serve as further warning to parents about an issue that’s been warned about for years.
All PII has been removed to protect the students. However, Tahoma Parents has confirmed that easy associations can still be made to students' identities based on their responses.
Key Discrepancies:
The district claims no PII is shared, yet students are assigned unique identifiers that counselors can link to their responses.
While names are masked, a combination of factors (age, school, race, gender identity) can still be used to quickly and publicly identify individuals through basic deduction. These are the datapoints that are publicly accessible.
Answers related to mental health, self-harm, and other deeply personal issue are not masked.
The survey responses are not part of the student’s official record, yet they are used for follow-up, contradicting the claim that the data remains detached from student identities.
The district states that only one data analyst has access to the system, yet school staff can still view and act upon student responses. While this may be the case for the raw data, much of the data is unmasked and publicly viewable, meaning anyone can access it.
Tahoma parents should be asking: Why was this data not properly secured? Who truly has access to it? And how will the district prevent this from happening again? The district's vague reassurances are not enough when student privacy and trust are at stake.
