Information Security: Press release

So Pea Ridge school district made a press release concerning media attention to a specific case. The press release went like this:

"The Pea Ridge School District is dedicated to providing a safe environment for our students, teachers and staff.

"As reported in the media, the district has recently required some students to provide test results regarding their HIV status in order to formulate a safe and appropriate education plan for those children. This rare requirement is due to certain actions and behaviors that place students and staff at risk. The district respects the privacy and confidentiality of all students. It's is very unfortunate that information regarding this situation is being released by outside organizations.

"Our goal is to provide the best education for every student, including those in questions, in a responsible, respectful and confidential manner."

The press release reveals more information than what has previously been known to the media, and also confirms that the incidence has taken place. In terms of personal information security, this is just wrong. A proper press release should be more like this:

"The Pea Ridge School District is dedicated to providing a safe environment for our students, teachers and staff. As reported in the media, the district has a policy that allows us to demand an HIV test in certain circumstances. The full text of the policy may be found on our web page.

Our goal is to provide the best education for every student, in a respectful and confidential manner. It is therefore unfortunate when a specific case concerning specific individuals is being printed by media, breaking the rule of confidentiality. This is not an issue that concerns the public at large. It is therefore in our policy not to discuss specific cases involving specific people with the media, as we shall also not comment on this specific case.

What is in the public's interest is the district's policy, which, again, may be found on our web page. It is also in the public's interest if we have broken a law. The latter is to be decided in the courts of law."

See the difference?