Glossary
Every abbreviation, in plain English
79 terms used across the site, from laws like FERPA and HIPAA to certifications and AI security ideas. Anywhere you see a dotted underline on the site, it links here.
79 terms shown
#
- 1EdTechOrganizations
- A nonprofit of schools, universities and vendors that writes interoperability and data privacy standards.
- 1EdTech Related:TrustEd Apps
A
- A4LAccess 4 Learning CommunityOrganizations
- A community of schools, states and vendors working on education data standards.
- A4L Related:SDPCNDPA
- AHIMAAmerican Health Information Management AssociationOrganizations
- A professional association for people who manage health information.
- AHIMA Related:CHPS
- AIArtificial intelligenceAI & security
- On this site, usually means generative AI: tools that write, summarize or answer questions in plain language.
- Related:LLM
- AI RMFNIST AI Risk Management FrameworkAI & security
- Organizes AI risk work into four functions: govern, map, measure and manage. A Generative AI Profile applies it to tools like chatbots.
- NIST Related:NISTISO 42001
- AICPAAmerican Institute of Certified Public AccountantsOrganizations
- SOC 2 reports are prepared by independent CPA firms following AICPA standards.
- AICPA Related:SOC 2CPA
- AIGPArtificial Intelligence Governance ProfessionalCertifications
- Tests how to manage AI systems responsibly across their lifecycle, including risk, accountability and the law.
- IAPP Related:IAPPCIPP/USAI RMF
- AUPAcceptable use policyLaws & agreements
- Many schools and organizations now add AI rules to their acceptable use policy rather than writing a separate AI policy.
B
- BAABusiness associate agreementLaws & agreements
- Required when a vendor handles protected health information on behalf of a HIPAA covered entity. Without one, the covered entity generally cannot share that information with the vendor.
- HHS: business associates Related:HIPAA
C
- CFRCode of Federal RegulationsLaws & agreements
- Laws passed by Congress are often carried out through detailed regulations published in the CFR. Citations look like 34 CFR Part 99, which holds the FERPA rules.
- eCFR
- CHPSCertified in Healthcare Privacy and SecurityCertifications
- For people who run privacy and security programs that protect health information.
- AHIMA Related:AHIMAHIPAA
- CIPMCertified Information Privacy ManagerCertifications
- Focuses on building and operating an organization's privacy program, rather than on the law itself.
- IAPP Related:IAPPCIPP/US
- CIPP/USCertified Information Privacy Professional/United StatesCertifications
- Covers US federal and state privacy law, including health, education and children's privacy. The most widely recognized privacy credential in the US.
- IAPP Related:IAPPCIPMAIGP
- CISSPCertified Information Systems Security ProfessionalCertifications
- Aimed at experienced security leaders. Candidates need several years of paid security work in addition to passing the exam.
- ISC2 Related:ISC2
- CMOCharter management organizationOrganizations
- Often handles technology, data and vendor contracts for the schools it runs.
- CompTIAComputing Technology Industry AssociationOrganizations
- Publishes vendor-neutral IT and security certifications.
- CompTIA Related:Security+SecAI+
- COPPAChildren's Online Privacy Protection ActLaws & agreements
- Requires websites, apps and online services aimed at children under 13, or that knowingly collect their data, to get verifiable parental consent first. The FTC enforces it.
- 16 CFR Part 312 (eCFR) Related:Verifiable parental consentFTCFERPA
- CoSNConsortium for School NetworkingOrganizations
- Represents school district technology leaders and publishes guidance on student data privacy.
- CoSN Related:TLE seal
- CPACertified Public AccountantOrganizations
- SOC 2 reports must be issued by an independent CPA firm, which is part of why they carry weight.
- Related:SOC 2AICPA
- Cross-tenant leakageAI & security
- The worst failure for a multi-customer AI product. Prevented by enforcing access checks in code, never by asking the AI to keep secrets.
- Related:RAGRed teaming
D
- Data minimizationAI & security
- The most reliable privacy protection: information that was never collected or sent cannot leak.
- Related:PIIRedaction
- De-identified dataLaws & agreements
- Removing names is often not enough: small groups, rare details and combinations of fields can still point to one person.
- Related:PIIRedaction
- DIRTexas Department of Information ResourcesOrganizations
- Writes the AI rules in Texas Administrative Code Chapter 219 and keeps the list of certified AI awareness training programs.
- Texas DIR Related:HB 3512SB 1964TAC
- Directory informationLaws & agreements
- A FERPA category for details such as name, grade level and activities. Each school decides what counts and must let families opt out.
- 34 CFR 99.37 (eCFR) Related:FERPA
- DPAData privacy agreementLaws & agreements
- Says what data the vendor receives, what it may do with it, how it is protected and when it is deleted. The NDPA is a standard DPA for schools.
- Related:NDPASub-processor
E
- EDU.S. Department of EducationOrganizations
- Its Student Privacy Policy Office publishes guidance and free training on student privacy.
- Student Privacy Policy Office Related:FERPAPPRA
- ESCEducation service centerOrganizations
- Texas has 20 regional education service centers that provide training and services to districts.
F
- FERPAFamily Educational Rights and Privacy ActLaws & agreements
- Federal law that gives parents, and students once they turn 18, rights over education records, and requires schools to get consent before sharing them, with specific exceptions. It applies to schools that receive U.S. Department of Education funding.
- 34 CFR Part 99 (eCFR) Related:School official exceptionDirectory informationCOPPAPPRA
- FPFFuture of Privacy ForumOrganizations
- Ran the voluntary Student Privacy Pledge for edtech companies until retiring it in April 2025.
- FPF
G
- garakAI & security
- Runs batteries of known attack prompts against a model and reports what got through.
- GitHub Related:Red teamingPyRIT
H
- HallucinationAI & security
- Happens because models predict likely text rather than look facts up. Anything an AI says about a real person, law or policy needs checking against the source.
- Related:LLM
- HB 3512Texas House Bill 3512 (2025)Laws & agreements
- Requires certain state and local government employees and officials, including school district cybersecurity coordinators, to complete DIR-certified AI awareness training each year.
- Texas DIR: AI awareness training Related:DIRTRAIGA
- HHSU.S. Department of Health and Human ServicesOrganizations
- Its Office for Civil Rights handles HIPAA complaints and enforcement.
- HHS: HIPAA Related:HIPAA
- HIPAAHealth Insurance Portability and Accountability ActLaws & agreements
- Its Privacy and Security Rules protect health information held by covered entities (health plans, most health care providers and clearinghouses) and their business associates. It does not apply to most schools or nonprofits.
- HHS: covered entities Related:BAAHHSHITRUSTCHPS
- HITRUSTCertifications
- Offers assessments at several levels of rigor; the most thorough (r2) is often requested by health care organizations.
- HITRUST Related:HIPAASOC 2
- HMISHomeless Management Information SystemOrganizations
- HUD-funded systems come with their own privacy and security standards for the people whose data they hold.
- Related:HUD
- HSAIHeightened-scrutiny AILaws & agreements
- AI that makes or materially influences decisions about people's rights, services or opportunities gets extra review under Texas rules. Tools that only help a person work faster generally do not count.
- Related:SB 1964TAC
- HUDU.S. Department of Housing and Urban DevelopmentOrganizations
- Funds housing programs and sets privacy and security standards for homeless management information systems.
- Related:HMIS
I
- IAPPInternational Association of Privacy ProfessionalsOrganizations
- The largest global association for privacy professionals.
- IAPP Related:CIPP/USCIPMAIGP
- iKeepSafeOrganizations
- Reviews a product's privacy practices and awards badges such as FERPA and California student privacy certification.
- iKeepSafe Related:FERPACOPPA
- ISC2Organizations
- A nonprofit membership association for cybersecurity professionals.
- ISC2 Related:CISSP
- ISDIndependent school districtOrganizations
- Texas public school districts are typically named as ISDs, such as Leander ISD.
- ISOInternational Organization for StandardizationOrganizations
- Organizations are certified against ISO standards by independent auditors, not by ISO itself.
- ISO Related:ISO 27001ISO 27701ISO 42001
- ISO 27001ISO/IEC 27001Certifications
- Requires an organization to run a managed security program and be audited against it regularly.
- ISO Related:ISOISO 27701SOC 2
L
- LEALocal education agencyOrganizations
- Used in laws and agreements like the NDPA to mean the district or school system signing the contract.
- LLMLarge language modelAI & security
- Trained on large amounts of text to predict likely next words, which makes it fluent and fast, and also able to sound sure while being wrong.
- Related:HallucinationPrompt injectionRAG
N
- NDPANational Data Privacy AgreementLaws & agreements
- A model data privacy agreement maintained by the Student Data Privacy Consortium, so districts and vendors do not have to negotiate privacy terms from scratch each time.
- Access 4 Learning: NDPA Related:DPASDPCA4L
O
- OWASPOpen Worldwide Application Security ProjectOrganizations
- Its Top 10 for LLM Applications is the shared vocabulary for how AI features fail.
- OWASP GenAI Security Project Related:Prompt injection
P
- PIIPersonally identifiable informationLaws & agreements
- Names, ID numbers, addresses and birth dates are the obvious examples. Details that seem harmless alone, like a grade, a school and a rare condition, can identify someone together.
- Related:De-identified dataData minimizationRedaction
- PPRAProtection of Pupil Rights AmendmentLaws & agreements
- Requires parental consent before students take part in surveys funded by the U.S. Department of Education that ask about protected topics such as family income, religion or mental health.
- U.S. Department of Education Related:FERPACOPPA
- PresidioAI & security
- Combines pattern matching and language models to detect details like names and ID numbers, and can be extended with your own formats.
- Microsoft Related:RedactionPII
- PromptAI & security
- Anything in a prompt should be treated as shared with the company that runs the model, unless an agreement says otherwise.
- Related:Prompt injectionRedaction
- Prompt injectionAI & security
- Can arrive in a document, email or web page the AI is asked to read. It is the top risk on the OWASP list for LLM applications, and there is no complete fix.
- OWASP Top 10 for LLM Applications Related:OWASPRed teamingLLM
- PyRITAI & security
- Helps automate and organize attempts to make an AI feature misbehave or leak data.
- GitHub Related:Red teaminggarak
R
- RAGRetrieval-augmented generationAI & security
- Useful for answering from your own files, and a common source of leaks if access controls are not enforced when documents are retrieved.
- Related:Cross-tenant leakageLLM
- Red teamingAI & security
- For AI, this means trying prompt injection, data extraction and misuse against a feature before it ships.
- Related:Prompt injectionPyRITgarak
- RedactionAI & security
- Automated redaction tools catch common patterns like names and ID numbers, and miss unusual ones, so they work best alongside sharing less in the first place.
- Related:PresidioPIIData minimization
S
- SAIFSecure AI FrameworkAI & security
- A practitioner's view of AI security that complements the NIST AI RMF.
- Google Related:AI RMF
- SB 1964Texas Senate Bill 1964 (2025)Laws & agreements
- Directed the Texas Department of Information Resources to set rules for government AI, including an AI Code of Ethics and extra review for heightened-scrutiny AI.
- Texas Legislature: bill analysis Related:HSAITACDIR
- School official exceptionLaws & agreements
- Lets a school share education records without consent with a contractor or vendor that performs a school function, is under the school's direct control, and uses the data only for that purpose.
- 34 CFR 99.31 (eCFR) Related:FERPADPA
- SDPCStudent Data Privacy ConsortiumOrganizations
- Also runs a public registry of signed data privacy agreements between districts and vendors.
- SDPC Related:NDPAA4L
- SecAI+CompTIA SecAI+Certifications
- Covers securing AI systems, using AI in security operations, and AI governance. CompTIA recommends prior security experience.
- CompTIA Related:CompTIASecurity+
- Security+CompTIA Security+Certifications
- A widely used entry point for IT and security staff, covering core security concepts and practices.
- CompTIA Related:CompTIASecAI+
- SNAPSupplemental Nutrition Assistance ProgramOrganizations
- Information about applicants may only be used and shared for purposes connected to running the program.
- 7 CFR 272.1 (eCFR)
- SOC 2System and Organization Controls 2Certifications
- Done by a CPA firm under AICPA standards. A Type II report checks that controls worked over a period of time, not just on one day.
- AICPA: SOC suite Related:AICPAISO 27001
- SOPIPAStudent Online Personal Information Protection ActLaws & agreements
- Bans K-12 edtech operators from targeted advertising, building non-school profiles and selling student data, and requires security and deletion on request. Many states copied it.
- California Legislative Information Related:FERPASOPPA
- SOPPAStudent Online Personal Protection ActLaws & agreements
- Illinois law that requires written agreements between schools and edtech vendors, public lists of those vendors, and breach notification within set time frames.
- Student Privacy Compass: state laws Related:SOPIPA
- Sub-processorAI & security
- Should be listed in your agreement with the vendor and bound by the same privacy terms.
- Related:DPA
T
- TACTexas Administrative CodeLaws & agreements
- DIR's AI rules, including the AI Code of Ethics, are in Title 1, Chapter 219.
- Related:DIRSB 1964
- TEATexas Education AgencyOrganizations
- Sets state education policy and oversees Texas school districts.
- TEA
- TLE sealTrusted Learning Environment sealCertifications
- Earned by school systems, not vendors, after showing measurable practices across leadership, business, data security, professional development and classroom use.
- CoSN Related:CoSNFERPA
V
- Verifiable parental consentLaws & agreements
- Before collecting personal information from a child under 13, an operator must make a reasonable effort to confirm that the person consenting is actually the child's parent.
- Related:COPPA