“I visited with the different departments just to get a feel for the frequency that they were using Virtru. And there wasn't one individual that I talked to that said anything other than, ‘I use this every single day, multiple times a day.'” – Troy Lunt, Technology Director and Data Privacy Manager, Iron County Schools
This Utah school district puts student data privacy at the forefront. With so many interconnected systems handling student data — including student information systems, school lunch management, bus routing software, and data that needs to be shared with state and local government — Iron County Schools ensures that students’ and families’ private information remains protected.
With Virtru, Iron County School District is able to:
As Technology Director and Data Privacy Manager for Iron County Schools, Troy Lunt oversees the teams who implement and maintain the district’s software and systems, as well as the privacy and security of student data. For Lunt, ensuring his district remains compliant with state and federal regulations for data security — while safeguarding student privacy and streamlining communication workflows — is continually top of mind.
“Getting into education really opened my eyes to the problems that could arise if student data were to get into the wrong hands,” Lunt said. “Data privacy is a huge responsibility for us.”
“For example, if a parent incorrectly enters a contact phone number, we need procedures to help identify this before it becomes a privacy issue.” Lunt recalled a previous experience where an incorrect phone number ultimately resulted in a stranger attempting to contact a student. “We now have tools in place for our district to make sure something like that doesn't happen again. We're constantly implementing new procedures, developing new processes, and putting in tools that strengthen compliance and give parents a sense of confidence that their kids’ data is secure, and that it’s not going to be shared in a way that may compromise a student’s privacy.”
This attention to detail extends to documents like class rosters, programs for student recitals, and pictures in school yearbooks. Lunt and his team put a system in place to assess what types of student directory information exist, what types of information can be shared publicly, and what kinds of data specifically require parental consent before being shared. For data that’s been designated for public use, parents are given an opportunity to opt out from the district’s use of directory information data.
Iron County Schools started using Virtru because its Special Education program needed to communicate securely with the State of Utah. “Our Director of Special Programs, Kevin Garrett, would regularly receive encrypted files from the state, and required student data being sent back to also be encrypted and sent via email,” Lunt said. Garrett championed the need for data protection within the Special Programs department and worked closely with Lunt to find a solution. The team ultimately selected Virtru for its ease of use and comprehensive security. “We needed to determine how many users might need encryption, so we started to compile a list. I believe there may have been 30 employees to begin with, and that grew to 40, and then 50 as he continued to assess the opportunity.”
Lunt started asking other managers, and he quickly found that a wide variety of departments had sensitive data that they needed to share securely — from nurses to administrators and the registrar’s office, and beyond. “I think we’re up to 200 licenses, which have greatly exceeded our original expectations and have blown that number out of the water. Once somebody hears about Virtru, they raise their hand and say, ‘I’ve got the same problem. I need this.’”
“When we first got into it, the need seemed small and isolated,” Lunt recalled. “I didn’t realize how far and how big this would grow.”
The evaluation team chose Virtru because of its simplicity. “It’s very easy to manage, and it’s a very easy click for the user,” Lunt said. “Because we had the backing of the state (Virtru being on Utah’s state purchasing contract), it turned out to be extremely cost effective. You look at that and say, ‘Why wouldn’t we do that for anybody who really needs it?’ After our evaluation team saw the Virtru demo, they looked at each other around the room and all said, ‘This is the solution we want.’”
Users have enjoyed having access to Virtru, as well. “A couple of weeks ago, I visited with the different departments just to get a feel for the frequency that they were using Virtru,” Lunt said. “And there wasn't one individual that I talked to that said anything other than, ‘I use this every single day, multiple times a day.’”
Iron County Schools are part of the Student Data Privacy Consortium (SPDC), which works with the state’s data privacy team to standardize agreements with vendors. This ensures that a data privacy agreement is in place for all third-party software and apps that collect and store students’ data (that are maintained by the district). “Because the State of Utah is using Virtru, we’ve been able to piggyback on their experience: They’ve already validated Virtru’s data security and that we can make it available for everybody who needs to encrypt and send student data.”
Virtru has equipped Iron County Schools to quickly and securely share information with state and local government entities without giving away more information than is necessary. Lunt described the need for School Resource Officers (SROs), who manage physical security, to share information with local law enforcement or the court system when needed, including snippets of video surveillance footage. Lunt recalled the data-sharing challenges that existed before a formalized policy was put in place around sharing this video footage: “Some smaller districts had turned their entire video surveillance system over to law enforcement,” he said. “And that was alarming to a data privacy manager, because there was nothing in FERPA that we believed, at the time, would allow that to happen.
Since then, our state data privacy team has researched and identified an area of FERPA that would enable local law enforcement to obtain critical information needed to support district SROs. After the state assisted our efforts to utilize this section of FERPA, we put a policy in place to enable SROs to create a law enforcement record separate from students’ school records.”
With Virtru, School Resource Officers can accelerate an investigation by sending encrypted data, including video incidents, rather than granting unrestricted access to law enforcement. “It was really tough determining how to manage that data while maintaining student privacy, and Virtru makes it possible to securely transmit that information. Virtru is one of the tools available to SROs to communicate with local law enforcement, any time there’s student PII that needs to be shared.”
In addition to ensuring students’ data remains secure, Virtru also empowers the school with greater visibility into communications that go out, and whether they’ve been read. “There are students’ data shared in a classroom setting that come from these different systems and apps, or through other communications that may need to be shared with parents,” Lunt said. “Previously, that information was either not communicated or it went home on a piece of paper with the student. Often, that information would not actually make it into the parents’ hands.”
Because Iron County Schools use Virtru, parents have fewer crumpled-up forms that get lost in the bottom of students’ backpacks. “Virtru provides a trail that logs what was sent and when it was read. We can see all of the tracking information, so that we find ourselves on the leading edge of communication, rather than trailing from behind.”
Located in Utah, Iron County School District consists of seven secondary schools, nine elementary schools, three preschools, and two online schools. The district’s mission is to support families in developing college and career readiness by building knowledge, skills and relationships for all students.
/resource%20-%20anonymous%20threat%20intelligence%20case%20study/anonymous-threat-intelligence-case-study.webp)
