Town of Andover, CT · Student and staff privacy · Why the disputed preschool benefit figure cannot be released, and why that refusal is the law rather than a stonewall
A personal report by Scott Sauyet · scott@sauyet.com · Not an official town document
This report explains, in plain language and then in detail, why a specific request, for the aggregate benefit information of the eight preschool staff, cannot be filled in detailed form without disclosing private information about identifiable individuals, and why the same structural problem, in its clearest form, governs certain student data as well. It draws on federal statute and regulation (FERPA, the IDEA, and HIPAA), on published guidance from the U.S. Department of Education and the U.S. Department of Health and Human Services, on Connecticut’s Freedom of Information Act and the case law interpreting it, and on the two collective bargaining agreements that define the benefits at issue. It is a civic explainer, not legal advice; the Board of Education’s counsel speaks for the district on these questions, and where this report and that advice differ, the advice governs. Compiled June 6, 2026.
Introduction
At the June 2, 2026 town meeting, as at several gatherings before it, a familiar request came up again: the aggregate benefit information for the preschool staff, four teachers and four paraprofessionals, eight people in all. On its face it is a reasonable thing to ask. The preschool’s salaries are covered by tuition and state grants rather than the town’s general fund, but the staff’s benefits are charged to district-wide accounts the general fund does carry, so this is the one slice of the program’s cost that lands on the taxpayer, and residents and officials are right to want to know what it comes to. No one making the request is asking what health plan any individual chose. Let me say that plainly, because the rest of this report depends on it: no one is asking for any individual’s health information.
The difficulty is arithmetic, not motive. “Aggregate” is supposed to protect the individuals inside a total: report the sum, and no one can see any single person’s choices. But that protection depends entirely on the group being large enough. Shrink the group and the total begins to give the individuals away. Picture the extreme case. A benefit total for a single employee is that one employee’s benefit choice with the word “aggregate” in front of it. Make it two employees, one on a family plan and one who declined coverage, and the total together with the published cost-share rates lets a reader work out who did which. Once a group is large enough, an aggregate genuinely hides the people inside it; the trouble is how few it takes to fall short of that, and these groups fall well short.
For the eight preschool staff, that is not a remote risk, for reasons the contracts make concrete (Part 4). There is also an even clearer version of the same problem on the student side of the building, where the law is unambiguous: the dedicated one-on-one aide (Part 3). That case is worth walking through first, because it shows the principle in its sharpest form before we return to the staff request that is actually on the table.
None of this treats the request as a trick, or the people making it as acting in bad faith. The transparency interest is real, and for most of the budget the law favors disclosure: aggregate spending on large groups is public, and should be. The conflict is narrow and specific. It appears only where the group described is small enough that a total, combined with what the reader already has in hand, becomes a roster. The rest of this report shows where that line falls, which law draws it, and why the Superintendent’s “I can’t give you that” is the law speaking rather than a stonewall.
The argument has five parts:
The principle
Privacy law does not protect only names and Social Security numbers. It protects any information that can be linked back to a specific person, alone or in combination with other things a reader already knows. The federal student-privacy regulation defines protected “personally identifiable information” to include not just direct identifiers but indirect ones, and any other information that, alone or combined, is linked or linkable to a specific student such that a reasonable person in the school community could identify the student with reasonable certainty (34 CFR §99.3).
Two phrases in that definition do the heavy lifting. “In combination” means a fact that is harmless by itself can become identifying once it sits next to other facts. “Reasonable person in the school community” means the test is not whether a stranger in another state could identify someone; it is whether a neighbor, another parent, or a fellow resident who already knows a little about the program could. In a small town, people know a great deal.
This is why small groups are the crux. Aggregate data is meant to be a shield: report the total, hide the individuals inside it. But the shield only works when the group is large enough that knowing the total tells you little about any one member. Shrink the group and the shield dissolves. The federal Department of Education’s own guidance makes the point directly: aggregate tables with small cells can still contain protected information, because it can be possible to identify specific individuals from uncommon characteristics, and such tables should not be released until disclosure-avoidance steps have been applied.
Connecticut does not leave “how small is too small” to intuition. For public reporting of student outcomes, the state sets a minimum subgroup size below which it will not publish figures at all.
| Purpose | Minimum group size |
|---|---|
| Public reporting | 20 |
| Accountability calculation | 20 |
Notes: Connecticut uses the same threshold, 20 students, for both reporting and accountability, which is stricter than many states that use a lower number for reporting. The national range across approved state plans runs roughly 10–30. EdSight, the state’s accountability dashboard, states operationally that the minimum number of students needed to calculate an average or a percentage is 20. Source: Connecticut ESSA Consolidated State Plan (approved August 4, 2017); CT SDE EdSight.
It is worth being precise about what this number is and is not. The n = 20 threshold is a reporting and accountability convention; it is not itself a rule about answering a records request, and it does not declare every group under 20 legally secret. It is the state’s own judgment, applied to its own data, about the group size at which published figures begin to expose individuals. The legal duty to withhold comes from the privacy statutes covered below; the n = 20 line is simply the state’s own answer to the practical question those statutes raise, which is how small is too small. For staff, as Part 4 explains, there is no comparable number, and the analysis runs differently.
Which law applies
There is a near-universal habit of calling any health-related privacy question a “HIPAA” question. In a school, that habit is usually wrong, and the error is worth correcting carefully, because the right answer depends on which statute actually governs.
For records a school maintains about its students, the governing law is almost always FERPA, the Family Educational Rights and Privacy Act, not HIPAA. This is not an accident. The two laws are written to be mutually exclusive for any given record. HIPAA’s definition of protected health information specifically excludes records that FERPA covers, and the stated purpose of that exclusion, in the joint federal guidance, is to keep any single student health record under just one of the two regimes rather than both.
| The record in question | Governing law |
|---|---|
| A student’s IEP, services, disability status, school records | FERPA, plus the IDEA (the federal special-education law); see Part 3 |
| Health information a school nurse records about a student | FERPA, as an education record |
| A town employee’s benefit elections, held as employment records | Not HIPAA; see Part 4 |
| Records held by an outside clinical provider who bills insurance | Possibly HIPAA |
A public school can, in narrow circumstances, also meet HIPAA’s definition of a covered entity, for example if it runs a clinic and bills insurance electronically. But even then, the federal guidance is explicit that many such schools still do not have to comply with HIPAA, because their only health records are “education records” or “treatment records” under FERPA, which HIPAA expressly excludes. The practical upshot for the preschool: the students’ protected information is a FERPA matter, layered with the additional protections of the IDEA discussed next. Calling it “HIPAA” is a common shorthand, and the people using it have reached the right conclusion. It is simply not the statute that governs school records, and this report uses the one that does.
The mechanism
This is the principle in its clearest form, and it sits on the firmest legal ground, which is why it comes before the harder staff question.
Children with disabilities receive a second layer of privacy protection beyond FERPA, under the Individuals with Disabilities Education Act (the IDEA). The IDEA incorporates FERPA’s definition of education records and adds confidentiality requirements tailored to the special sensitivity of disability information (34 CFR Part 300, Subpart F, §§300.610–300.627). Both laws treat a child’s disability status and the contents of the child’s IEP as protected. And both use the same identifiability test from Part 1: information is protected if a child can be identified from it with reasonable certainty.
Now connect that to staffing. A dedicated one-on-one paraprofessional is, by definition, assigned to one particular child because that child’s IEP requires it. The aide’s position is not a free-floating budget line; it is the embodiment, in the staffing plan, of a service written into a specific student’s plan. Federal guidance for paraprofessionals makes the same point from the other direction: service logs showing that a student with a disability received specific supports can themselves be protected education records.
So a single fact, “the preschool employs N dedicated one-on-one aides,” lives in two places at once. It is a line on the personnel and budget ledger, which is the side residents legitimately want to see. And it is a fact recorded in N identifiable children’s special-education files, which is the side the law protects. The two cannot be separated, because there is no such thing as a one-on-one aide without a particular child on the other end of the assignment.
The preschool itself is not small; it serves about 67 children across four classrooms. But the number of children who have a dedicated aide is small, and that is the group that matters here. Disclose the aide staffing and you disclose, by inference, that specific children carry IEPs significant enough to require their own adult. Where the community can observe which child is always accompanied by an adult, “the budget shows two dedicated aides” closes the loop. That is identification with reasonable certainty. It is a disclosure of protected information under FERPA and the IDEA, made without parental consent, even though no name was ever spoken and no one intended harm.
And here the report’s central point is at its plainest: there is no wording of a request for one-on-one aide cost or assignment that does not reveal that a particular child needs one-on-one support. The disclosure is not in the phrasing. The disclosure is the aide’s existence. A request cannot be reworded around a fact.
The request at issue
This is the request actually in dispute: the aggregate benefit information for the eight preschool staff. It needs the most careful treatment in this report, both because it is the live question and because the law here is harder than on the student side. Getting it right means neither overstating the protection nor pretending the concern is imaginary.
Begin with what “benefits” actually consists of, because the word hides the problem. For these eight employees, a benefit figure is not one neutral number apiece. It is the sum of a set of individual elections, and the two collective bargaining agreements that govern them, the teachers’ agreement and the non-certified staff agreement, show that each election maps onto a private fact:
So a sufficiently detailed benefit breakdown for these eight people is not a financial abstraction. It is a set of facts about identifiable individuals’ households and health status.
The group is also smaller than eight in the way that matters. The four teachers fall under one agreement; the four paraprofessionals under another, where board-subsidized medical coverage depends on job classification and scheduled hours. Full-time and certain part-time classifications receive subsidized coverage; lower-hour classifications are grandfathered, pay a substantially higher share, or may only buy in at their own expense. So the subset of the eight for whom a particular subsidized-tier election even exists may be just two or three people. The smaller that subset, the more completely a total describes each person in it. The small-numbers problem is sharper here, not milder.
There is one honest limit on the reconstruction. The dollar premiums are not in the public contracts: the teachers’ insurance-rate grid is left blank in the posted copy, and both agreements state the employee’s share as a percentage rather than a dollar figure. A member of the public working only from the posted contracts and salary schedules would know each employee’s salary and cost-share percentage, but not the premium dollars needed to convert a total back into individual tiers. The reconstruction is not trivial from those documents alone.
That limit largely disappears for the people actually making this request. Andover’s employee health coverage is purchased through a pooled inter-municipal arrangement of the kind Connecticut authorized in Public Act 10-174 of 2010, which lets towns and school boards join together to buy employee health benefits. The negotiated rate results of such an arrangement are public records, and they are routinely in the hands of the town’s own financial officials. The requesters here include the First Selectman and members of the Board of Finance, who can obtain the per-tier premium schedule as a matter of course. For them, the aggregate plus the rate sheet plus the public salary and classification data is enough to recover the tier mix among a group this small.
This points to a principle worth stating plainly, and neutrally: the more financial detail a requester already holds, the less additional aggregate disclosure it takes to reconstruct the individuals inside a total. The privacy limit is therefore most binding, not least, for the best-resourced requesters. It does not bend because the person asking is an official; if anything it tightens.
Which law draws the line is the last question. Two points commonly get the statute wrong.
First, this is most likely not a HIPAA question. A town is generally not a HIPAA covered entity; its group health plan may be, but information the town holds as an employer, in payroll and budget records, is treated as employment records, which HIPAA’s own definitions exclude from protected health information. The benefit-cost figures in the town’s budget are, in all likelihood, employment records outside HIPAA’s reach. The claim is not wrong on a technicality; HIPAA does not govern these records in the first place.
Second, there is no fixed minimum group size for staff. The number 20 from Part 1 belongs to student reporting. HIPAA’s method for declaring data safe to release sets no group-size figure at all; it works by removing a defined list of identifiers, or by a documented expert judgment that re-identification risk is very small. The neat “the group is too small under the law” framing that fits the student case does not transfer here.
The protection that does apply comes from Connecticut’s Freedom of Information Act, which exempts “personnel or medical files and similar files the disclosure of which would constitute an invasion of personal privacy” (Conn. Gen. Stat. §1-210(b)(2)). That exemption is not automatic. Under the controlling state Supreme Court test (Perkins v. FOIC, 228 Conn. 158 (1993)), an agency withholding such a record must show both that the information does not pertain to a legitimate matter of public concern and that disclosure would be highly offensive to a reasonable person. The total cost of public employment is a legitimate public concern, and Connecticut courts have treated some numerical employee data as not private at all. The public-concern prong, in short, favors disclosure of the total.
What it does not favor is disclosure detailed enough to expose the tier mix, the decliners, or the HRA participants among eight people. Those are the private facts, household composition, coverage held elsewhere, Medicare or veterans’ status, and none of them is what “how much do we spend” requires.
The cure, though, is a larger group, not merely a coarser figure for this one. It is tempting to say “give the total for the eight, just with no breakdown,” but among eight people, two or three of them carrying a given tier, the total itself, set beside the rate sheet and the public salary and classification data, can still be inverted into the individual elections. Removing the line items does not help if the bottom line is recoverable. What does help is aggregating up to a group large enough to clear the line: the benefit total for all certified staff, or for all non-certified staff, or the district-wide benefit figure, the kind of number that already appears in the budget. Those answer the spending question without singling anyone out. It is the preschool-only slice, eight people or the two-or-three within them, that cannot be safely isolated.
Synthesis
Pulling the threads together: when the Superintendent says she cannot release this information, she is not choosing to withhold an answer she could give. She is reporting that the law leaves her no lawful answer to release. The obstacle is structural, a property of the data and the size of the group, and it does not yield to good intentions on either side.
It is understandable that a flat “I’m not allowed to share that” sounds like a stonewall. In most budget questions a refusal to produce a number is a choice, and pressing harder is the right response. This is the uncommon case where it is not a choice. The figure being asked for does not exist in any form she can lawfully hand over, because producing it for a group this small would disclose facts about identifiable people, an employee’s coverage tier or HRA status, a child’s need for a dedicated aide, that FERPA, the IDEA, and Connecticut’s privacy law place out of reach. Her “I can’t” is fidelity to those statutes, not opacity. Continuing to read the non-answer as a lack of transparency mislocates the cause: it is the law that is saying no, and she is the one obliged to say it out loud.
A useful way to see that the barrier is real, and not a matter of phrasing, is to imagine shrinking the group until the point is undeniable. Suppose the preschool had exactly one staff member. A request for “aggregate staff benefit cost,” however carefully it avoids the word “individual,” hands over that one person’s health-plan choice. Suppose exactly one child with a one-on-one aide. A request for “the cost of one-on-one support in the preschool,” however neutrally phrased, names that child to anyone who knows the program has one such child. At a group of one, everyone sees at once that no phrasing helps. Adding a second or a third person does not change the nature of the problem; it only changes how much outside knowledge a reader has to supply. The barrier was never in the language, so no better wording of the request, and no greater willingness on her part, could produce the number without breaking the law.
None of this forecloses the legitimate interest behind the request. Aggregate figures for groups large enough to stay anonymous are public, and the town should provide them: a benefit total for all certified staff, or all non-certified staff, or the district as a whole, the figures already carried in the budget. The line this report describes is narrow on purpose. It is only the small groups, the eight preschool staff, the two or three within them who carry a given tier, the dedicated aides, that the law puts out of reach, and only because at that size a total is recoverable into the people inside it. The underlying question, what the town spends, has an available answer. What is not available, from her or from anyone, is the preschool-only slice in a form fine enough to single people out.
At a glance
| Question | Short answer |
|---|---|
| What is actually being requested? | The aggregate benefit figures for the eight preschool staff (four teachers, four paraprofessionals). |
| Can the town release any benefit totals? | Yes, at a large enough aggregation (all certified staff, all non-certified staff, or district-wide); those figures already sit in the budget. |
| Why not a preschool-only total, then? | Eight is small enough that the bottom line, set beside the rate sheet, is recoverable into individuals. A coarser figure for a small group is not safe; a larger group is. |
| Why not a detailed breakdown? | Among eight people, the tier, decline, and HRA detail identifies individuals’ household and health status. |
| Isn’t this a HIPAA issue? | Probably not. Town-held benefit figures are employment records, which HIPAA excludes. The limit comes from CT FOIA. |
| Does it matter who is asking? | Yes, in one direction: requesters who can obtain the premium schedule can reconstruct more from a total, so the limit binds them more. |
| What about the students? | A dedicated one-on-one aide is an IEP service tied to one child; disclosing it identifies the child. That side is FERPA and the IDEA. |
| Is the Superintendent’s refusal a stonewall? | No. There is no lawful version of the preschool-only figure for her to release; the refusal is compliance with privacy law, not opacity. |
Analysis
“Benefits” for eight people is a set of individual elections, not one number. Plan tier, declining coverage, and the HRA-versus-HSA choice each encode a private fact about a person’s household or health status.
The HRA election is the sharpest example. Both agreements offer the HRA only to employees who cannot use the HSA because they receive Medicare or veterans’ benefits, so identifying HRA participants discloses that protected status.
The group is effectively smaller than eight. Subsidized-coverage eligibility varies by contract and classification, so the subset for whom a tier election even exists may be two or three people, which makes a total more revealing, not less.
Benefit spending is public at a large enough aggregation. District-wide or all-staff benefit totals, the kind already in the budget, answer the spending question; it is isolating the eight-person preschool slice that creates the problem, and a coarser figure for that small group is not a cure.
The limit binds well-resourced requesters more, not less. The more premium and rate detail a requester can already obtain, the less additional disclosure it takes to recover the individuals inside a total.
For students, this is FERPA and the IDEA, not HIPAA. A dedicated aide is an IEP service tied to one child, so the staffing line and the protected fact are the same fact, and no wording separates them.
A refusal here is the law operating, not an evasion. The Superintendent cannot release a lawful version of the preschool-only figure, so reading her “I can’t” as opacity mislocates the cause; the constraint is the statute, not her will.
Caveats
This is a civic explainer, not legal advice, and not every question it touches is fully settled here.
Documentation
Federal statute and regulation
Federal guidance (U.S. Department of Education and U.S. Department of Health and Human Services)
Connecticut sources
Local documents (public)
Download
This report is available in three formats, all located alongside this page: