Protecting Your Child's Personal and Health Data Against Identity Theft

On and after October 20, 2020, Iowa parents whose school districts had contracted with Timberline Billing Service, LLC, an Iowa-based company providing Medicaid billing services, began receiving letters from Timberline informing them that their children's data had been subject to a data breach between February 12, 2020 - March 4, 2020, when an unknown attacker had accessed Timberline’s network and exfiltrated students' personally identifiable information (PII) and personal health information (PHI) stored in its system before deploying ransomware.  On October 30, 2020, Timberline reported to the U.S. Department of Health and Human Services that the breach had affected the PII and PHI data of 116,131 students.  

The Iowa Attorney General's Office provides the following information for parents who are seeking to protect their children's PII and PHI against identity theft: 

Placing a Security Freeze on Your Credit Report or Your Child's

Credit to Protect It from Identity Theft 

Each of the three major credit reporting agencies (Equifax, Experian, and TransUnion) offers consumers the ability to place a “security freeze,” or deny access to, their credit reports. A security freeze means that your credit file cannot be shared with potential creditors. A security freeze can help prevent identity theft because businesses will not open credit accounts without first checking a consumer’s credit history. If your credit files are frozen, even someone who has your name and Social Security number probably will not be able to obtain credit in your name.  Placing a security freeze does not affect your credit score – nor does it keep you from getting your free annual credit report.

Frequently Asked Questions (FAQ)

 How much does it cost?

There is NO COST to place or lift a security freeze on your credit reports. There are no joint credit reports.  Everyone has their own, which means a couple would need to place six (6) security freezes (3 for one partner and 3 for the other partner at Equifax, Experian and TransUnion). Parents may want to consider placing security freezes on credit files for children under age 16 and assisting older children. 

How do I place a security freeze?

To place a freeze, you must make a separate request to EACH of the three credit reporting agencies. You must provide identifying information listed below. 

 Write to the addresses listed below, call using the automated system, or log online and provide the following documentation:

#1        Equifax Security Freeze

 P.O. Box 105788, Atlanta, GA 30348

800-685-1111  

To request a security freeze online, go to www.Equifax.com

 Make a request for a security freeze to the address listed above with the following:

• Include name, current and former addresses for the last two years, Social Security number, and date of birth.
• Copy of a utility bill, insurance or bank statement, etc., showing your name and current mailing address.

#2        Experian Security Freeze

 P.O. Box 105788, Atlanta, GA 30348

800-685-1111  

To request a security freeze online, go to www.Experian.com

Make a request for a security freeze to the address listed above with the following:

·       Include name, current and former addresses for the last two years, Social Security number, and date of birth. Enclose a copy of a government identification card, such as a driver’s license, state ID card or military ID card.

·       Copy of a utility bill, insurance or bank statement, etc., showing your name and current mailing address. 

#3        TransUnion Security Freeze

 P.O. Box 2000, Chester, PA 19022-2000

800-685-1111  

To request a security freeze online, go to www.TransUnion.com

800-916-8800

Make a request for a security freeze to the address listed above with the following:

·       Include name, current and former addresses for the last five years, Social Security number, and date of birth.

How long will the security freeze remain on the credit report?

A security freeze will remain until you request its removal.

Can I open new credit accounts if my files are frozen?

Yes, but you have to lift the freeze to obtain a new credit card or loan. You can lift it for a period of time, you can lift it for a specific creditor, or you can lift it permanently. After you send your letter asking for the freeze, each of the credit reporting agencies will send you a Personal Identification Number (PIN). You will also get instructions on how to lift the freeze. There are a variety of ways to lift the freeze (by mail, phone, or Internet) using your PIN. There is no cost for lifting the freeze.

What will a creditor who requests my file see if it is frozen?

A creditor will see a message or a code indicating that the file is frozen.

Can a creditor get my credit score if my file is frozen?

No. A creditor who requests your file from one of the three credit reporting agencies will only get a message or a code indicating that the file is frozen.

 Will a freeze lower my credit score?

No.

 Can an employer do a background check on me if I have a freeze on my credit file?

No. You would have to lift the freeze to allow a background check or to apply for insurance, just as you would to apply for credit. The process for lifting the freeze is described above.         

Can I order my own credit report if my file is frozen?

Yes. To obtain a FREE copy of your credit report from each of the three credit reporting agencies (Equifax, Experian, and TransUnion) once every 12 months, call toll-free 877-322-8228, or order online at www.AnnualCreditReport.com, or write to P.O. Box 105281, Atlanta, GA 30348-5281. Please note: A free copy of your credit report does not contain your credit score.           

Can anyone see my credit file if it is frozen?

Your credit report can still be released to your existing creditors or to collection agencies acting on their behalf. They can use it to review or collect on your account. Other creditors may also use your information to make offers of credit‑unless you opt-out of receiving such offers. See below for how to opt-out of pre‑approved credit offers. Government agencies may have access for collecting child support payments, taxes, or in the course of a legal proceeding. 

Does freezing my file mean that I won’t receive pre‑approved credit offers?

No. You can stop the pre‑approved credit offers by calling 888‑567‑8688 or go online at www.optoutprescreen.com. This will stop most of the offers that go through the credit reporting agencies. The opt-out is good for five years or you can make it permanent by returning the Opt-out Election Form which will be provided after you initiate your opt-out request.

Do I have to freeze my file with all three credit reporting agencies?

Yes. Different credit issuers may use different credit reporting agencies. If you want to stop your credit file from being viewed, you need a security freeze with Equifax, Experian and TransUnion.

Do I have to lift the security freeze at all three credit reporting agencies?

No. You can ask the potential creditor which credit reporting agency it is going to utilize. Then place a global lift (with a start and end date) or a specific third party lift with that credit reporting agency.

Does my partner’s credit file have to be frozen, too?  What about my children?

Yes. Everyone has their own which means a couple would need to place six (6) security freezes (3 for one partner and 3 for the other partner for Equifax, Experian and TransUnion). Parents may want to consider placing security freezes on credit files for children under age 16 and assisting older children. 

Does a security freeze guarantee that I will not be a victim of identity theft?

No. While a security freeze can help keep an identity thief from opening most new accounts in your name, it will not prevent all types of identity theft (such as; criminal, driver’s license, government benefit, insurance, medical, and Social Security). It will not protect you, for example, from an identity thief who uses your existing credit cards or other accounts. The freeze won’t be able to stop fraudulent activity that has already taken place before the security freeze was initiated. While a security freeze may not be able to protect you in these kinds of cases, it can protect you from the vast majority of identity thefts that involve opening new lines of credit.

You can get more information about identity theft by going to the Federal Trade Commission's website at: www.FTC.gov or our website at: www.IowaAttorneyGeneral.gov

If you have complaints or questions, contact our office:

Iowa Attorney General's Office

Consumer Protection Division

1305 East Walnut Street, 2nd Floor

Des Moines, Iowa 50319

Phone:  515-281-5926

Toll-free:  888-777-4590

Email: Consumer@AG.Iowa.gov

 Sample Letter for Disputing Billing Errors 

[Date]

Letter sent Certified with a Return Receipt Requested

[Name of Creditor]
Attention: Disputes and Billing Inquiries
[Address]
[City, State, Zip Code]

            RE: [Your Account Number]

Dear Sir or Madam:

I am writing to dispute a billing error in the amount of [$______] on my account. The amount is inaccurate because [describe the problem]. I am requesting that the error be corrected, that any finance and other charges related to the disputed amount be credited as well, and that I receive an accurate statement.

Enclosed are copies of [use this sentence to describe any information you are enclosing, like sales slips or payment records] supporting my position. Please investigate this matter and correct the billing error as soon as possible.

Sincerely,

[Your Name]
[Your Address]

[Cell Phone & Email Address]

 Enclosures/   [List the enclosures] 

Report Identity Theft and Get a Recovery Plan 

On the Federal Trade Commission’s website:  www.IdentityTheft.gov, you can click on “Get Started” to make an identity theft report and receive a recovery plan or you can click on “or browse recovery steps”  to get information about special forms of identity theft such as income tax, child, medical and others, scroll to the bottom of the webpage.

Due Process Complaint Against Child’s Former School District in Iowa?

[Note:  Because I frequently receive questions from Iowa parents about whether they can file due process complaints against their children's former school districts, with the permission of the parent who sent the following question to me by email, I am publishing the question and my response.]

Q:      May I file a due process complaint against the Iowa school district in which my daughter was enrolled last year? In grades 1-2 she struggled with reading so I asked the school and AEA several times to evaluate her for special education services, and gave them copies of her long-term video EEG reports showing that absence and focal seizures (which are seldom evident to observers) occur during school hours, and explaining that they interfere with her memory and concentration. They told us that because her reading score wasn’t below “proficiency” she didn’t have an “educational disability.” We asked again in 3^rd grade when her score fell below proficiency, but they still refused to evaluate her, stating that school personnel hadn't noticed seizure activity. Before the end of the year we moved to another Iowa community across the state. When we gave the new school district and AEA the same medical reports, they immediately evaluated our daughter, found that she has a reading disability and started special education services.

          The difference in our daughter is like night and day. Instead of making self-depreciating remarks when asked about school, she’s excited to talk about what she’s learning and says she’s beginning to feel “smart.” While her former teachers talked about her “poor attitude,” her new teachers talk about how bright she is and how hard she is working to catch up in math and reading.

          We want to hire a tutor to help her catch up. But we think her previous school district and AEA should pay this because we don’t think she would have needed the help if they had provided her with special education services.

A:       The IDEA statute doesn’t prohibit parents from filing a due process complaint against a former school district for denial of a free appropriate public education (FAPE). The only restriction is that parents must file their due process complaint within two years of the date they “knew or should have known” of the alleged violation, except in limited circumstances when certain equitable tolling provisions built into the statute apply.

          However, Iowa is subject to precedent-setting decisions of the Eighth Circuit Federal Court of Appeals, which has held that parents forfeit the right to challenge educational services (or the lack there of), unless the parent requests a due process hearing before the student changes school districts. See Thompson by & Through Buckhanon v. Board of the Special Sch. Dist. No. 1, 144 F.3d 574, 579 (8th Cir. 1998). In 2010, the Eighth Circuit confirmed that a student must "request a due process hearing before transferring from a delinquent district if the student wishes to preserve his or her right to challenge the educational services provided by that district." See C.N. v. Willmar Pub. Sch., Indep. Sch. Dist. No. 347, 591 F.3d 624, 631, n.6 (8th Cir. 2010).

          The majority of decisions in cases involving this question by federal district courts outside the Eighth Circuit have concluded that when a student leaves a school district alleged to have failed to provide a FAPE, the district remains subject to a due process complaint whether or not the parent filed it before transferring the child to a new district. For example, in a Pennsylvania case in which the parents did not file the due process complaint until after transferring their child to a different school district, when the school district argued that point, the court found that in order to ensure that the student receives a FAPE, compensatory education must be available for a student who has moved from the school district after he has already been deprived of a FAPE, and further explained that otherwise "a school district could simply stop providing required services to a student with the underlying motive of inducing this student to move from the district, thus removing any future obligation under IDEA which the district may owe to the student. Such a result would frustrate the purposes of IDEA in that a student would be denied his right to a FAPE. Surely, Congress, in creating and ensuring a disabled student's right to public education, would not allow a school district to suspend the educational rights of a disabled child without a remedy." See Neshaminy Sch. Dist. v. Karla B. ex rel. Blake B., No. 96-3865, 1997 U.S. Dist. LEXIS 3849, at *13-18 (E.D. Pa. Mar. 20, 1997).

          Returning to the Iowa and other states covered by the Eighth Circuit, in the above-mentioned C.N. case, the parent filed a due process complaint after transferring her daughter, C.N., who had autism, from a public school at which the child’s special education teacher used seclusion and restraint procedures contained in C.N.'s BIP, The parent alleged that the teacher used those procedures improperly and excessively, and mistreated C.N., including yelling and shouting at her, demeaning and belittling her, pulling her hair, making her sit at a "thinking desk" and either hold a physical posture for a specified time or suffer restraint or seclusion, and once denied C.N. use of the restroom, causing an accident. A state investigation had previously found that the teacher had violated a number of C.N.’s rights as a child with a disability and had maltreated her by denying her access to the restroom. Despite these allegations and findings, the Eighth Circuit concluded that the parent’s due process complaint failed as a matter of law because she did not file it until after transferring her daughter out of the school district.  

        After reading this, you may think the the Eighth Circuit “got it wrong,” and wonder if it might modify its position. While this seems unlikely absent a decision of the U.S. Supreme Court that would require such a change, it is worth noting that in his written concurrence with the decision, one of the judges indicated that that the court might consider an exception if the facts of a case demonstrated that the continued enrollment of the child while a parent filed a due process complaint before transferring the child would likely would result in physical harm or serious emotional harm to the child.