Prince William County Schools Accidentally Exposes Parent and Student Data to Third-Party Vendor Prince William County Schools (PWCS) disclosed an unintended data exposure involving parent and student information shared with Hazel Health, a contracted provider of mental telehealth services. The incident occurred after the district mistakenly transmitted personally identifiable information (PII) for families who had not opted into the program. The error came to light on December 16, 2025, when affected parents received unsolicited welcome texts from Hazel Health. The exposed data included parent details—such as names, phone numbers, email and physical addresses, guardian status, and relationship to the student—as well as student information, including names, birth dates, gender, grade levels, student and district ID numbers, state testing IDs, and school-specific data (e.g., school name and address). PWCS confirmed that the disclosure was accidental and that Hazel Health, an approved vendor with verified data security standards, had already destroyed the improperly shared information upon discovery. The district has since corrected the data file and updated internal processes to prevent future incidents. Parents were notified via a letter outlining the breach and their rights under the Family Educational Rights and Privacy Act (FERPA), with contact information provided for further inquiries. No evidence suggests the data was misused, but the incident highlights risks in third-party vendor data handling within educational institutions.