It’s a good article and makes the point that where there’s a need, the industry will find a way to fulfill the need. But that brings me to the here and now. With the advent of online learning and hosted learning management systems and the move towards SaaS LMS systems in the cloud, there are some real issues regarding security of information that I don’t think most educational technology teams are even aware of. The medical industry is well aware of HIPAA, but I find that at medical/health provider training schools the ed tech team sometimes forgets about the necessity of data and privacy protection. Or, they are simply overwhelmed by the topic and prefer to pass-the-buck of ownership onto the faculty – meaning, make the faculty responsible for privacy and security of information in their course.

I think this is backwards thinking. I believe that the issue needs to first be addressed on a systems-level and then implemented on an individual level. That means decision makers, policy makers, systems administrators, and trainers all need to know the security of the hardware and software on the system to varying degrees based upon role, and then they need to educate their end-users on how to use the system in ways that aid in maintenance of that security.

For example, one can imagine that in an online component of a medical course that emphasizes discussion, that PHI (patient health information) may be shared as a fundamental component of the learning environment, especially in case studies or in residency programs as a part of write-ups on rounds. Now, in this case, what are the possible security breaches and violations of HIPAA? Let me lay out a few:

1. Use of open source software for the LMS

• Okay, open source software can be made secure, but has it?
• Has the institution gone to the lengths to ensure security of the system?
• For example, has Google indexing of the system been disabled at a site level? (Especially for Moodle….)

2. Roles and permissions on the system (ACL – Access control lists)

• Does the system allow “guest” (as in public, Internet accessible, guest) access? If so, then already there may be a breach of security if that “guest” has been assigned access to this course where PHI is being discussed.
• Are the students and/or faculty aware of any “guests” accessing their course and reading their interactions (especially discussions)?

I have actually seen this happen. The teaching institution wants to allow guest faculty, residents, interns, access to what is being taught. However, there aren’t procedures in place that educate the decision makers (from departments to faculty) on how to allow access to the course for these guests without also opening up their course to the general public, and the students are not informed of who is viewing their participation in the course – so the PHI data is publicly out there on the Internet (and may even be Google indexed) which is a violation of HIPAA, AND the student’s own FERPA (Family Educational Rights and Privacy Act) rights have been violated as well.

It is EASY to fall into this breach of security trap for an institution that does not understand the practical ramifications of not having policies, procedures, and training in place to prevent this scenario.

So what’s my point? The scenario above was on a hosted environment, not a SaaS environment, but could easily be translated to that SaaS environment. So, not only does the SaaS need to have security protocols in place but the USERS must also be educated on system settings and role assignments and the misnomer of “guest” access. If the system is secure and FERPA and HIPAA compliant, then the easiest way to do a second-line defense is to simply not allow guest access on the system. Instead, implement a way for each user on the system to have a unique login (that’s just good sense, on many levels). That way each user on the system can be tracked. It may sound “big brother-ish” but where the integrity and privacy of data on your system is concerned, this is important. (And further, anything conducted on the Internet can be tracked – never assume that anything you do online is 100% fool-proof secure, and act accordingly. All “we’re” responsible for is protecting your data to the extent reasonably possible; there are always new hackers out there….) The third-line defense is to educate your users (faculty, TAs, students, staff, etc.) on what can and cannot be posted on the system as well as who is observing or shadowing in a course. PHI can be protected by anonymizing the data posted.

So, that’s my thoughts on data protection today – and the Cloud…in a round about way.

Cheers!

The question I pose is in regards to the new European Data Law: “How will new this new law impact online education in the United States where the servers are located in the United States yet the students are international students?” This would transcend beyond private/public institution status in the U.S. The new law may come into effect as early as within two to three years. The greatest point of contention seems to be the “right to be forgotten” for the user – meaning personal information must be deleted – and not upon request, but as a right and condition of the service being utilized.

In regards to this, I believe a conflict in higher education with this new law is the need for academic records keeping in a tech-enhanced, blended, or online learning environment. I find many U.S. institutions that utilize blended or tech-enhanced learning do not maintain archives of the online portion of the learning – especially when that learning occurs within a learning management system (which is the easiest place to maintain archival records). No one has yet defined for me what the statutes and regulations are for “blended or online course records-keeping”. Indeed, I believe that the technology far outpaces the law and localized policies in these cases.  As a former systems administrator and learning management site administrator, I made it my job to maintain and preserve data, so the thought that folks don’t keep records personally boggles my mind. Yet, it is a foreign concept to many. How long must data be maintained? How secure is the medium for data preservation and protection? What are the parameters for accessing archival information? What are the legalities for preserving and maintaining this data? These are questions that run through my mind – yet the Data Protection Law addresses not archival data, but on demand, instantaneous data from my rudimentary interpretation. That specification should certainly draw the attention of folks who use online as a business practice.

Which brings me to those educational institutions that foster the use of Twitter, Facebook, and other social media and networking platforms in their coursework. How is privacy of student data managed in these instances – for U.S. users as well as international ones?

I may be postulating on many cross-referenced topics, but I must note that any work done online in any medium and that is assessed is a part of an academic record, no? Privacy of information can be minimally protected if done on a system that requires authentication, but the reality is that once you post something online, there are any number of means for someone to capture and share this information. Laws must either be in place to protect your information, or you need to assume (or be explicitly informed) that your participation is open to public sharing. Ultimately, I believe that the key to all of this – for education and private industry alike – is the need for education of the users or at least a place for informing the users; how users choose to share their information is a choice they make, but how institutions save and use their information is subject to legislation.

I need to educate myself more and think on this, but if you have any insight please share with us in the comments!  

I may even look back on this post and split it into more posts on individual topics I’ve brought up here. Forgive me, for this is my first attempt at a brain-dump on this topic and obviously other topics that have been ruminating in my mind for some time.

The actual text for the European Data Law is here:

• http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:NOT

Wikipedia’s comparison of European Data Law and US Laws is here (but may be dated and not include the most recent changes in EDL):

• http://en.wikipedia.org/wiki/Data_Protection_Directive

Then again, this may all be “moot” as the education sector is so far behind the times and there is usually bigger fish to fry in the corporate sector. An interesting historical perspective on the European Union Privacy Directive (2003) and references to education is located here for a good read: http://www.law.northwestern.edu/journals/njtip/v2/n1/5/

There is a solution – it is the DownThemAll! Firefox extension. If you install it, you can go to your Moodle course, click on the assignment, click on the view # submitted link at the top right and then on the table of submissions page, use this extension to download all of the files on the page. Make sure you do this step for each page of students or set your preferences to display all students on one page. The Firefox extension allows you to set a pre-defined downloads folder, and when you run it, you can specify the file type you wish to download (such as .pdf, .doc, .docx, etc.). If you don’t specify, it will download all downloadable objects on the page – such as .jpgs and extraneous features of the webpage and not the actual student submissions.

This would be classified as a workaround or a hack but once you get the knack of using it, it will save you multiple clicks to download your student assignment files.

You can find this DownThemAll! extension here: https://addons.mozilla.org/en-US/firefox/addon/downthemall/

Tips for configuring DownThemAll! on a Mac (once installed):

• In Firefox, click on the Tools Menu
• Hover over the DownThemAll! Tools link and select the Preferences menu and a pop-up window will appear
• On the General tab, leave all of the default settings, but make sure that the setting for If a filename already exists is Ask.

Tips for using DownThemAll! on a Mac:

• Navigate to your course, click on the assignment, click on the view # submitted link to view the assignments
• In your browser, click on the Tools menu, choose DownThemAll! tools, and select the DownThemAll!.. link.
• In the pop-up window there are a few sections to configure (click to view larger image):

DownThemAll! setting options

1. Link View: this displays how many links are on the page.
2. You can check individual links to download from or check the box at the top of the column to select them all.
3. You can choose where to save the files you are downloading to your computer (recommended).
4. In the filters you can choose only those items to download that have the extension you specify. By default the software will scan the page and choose the settings relevant to content on the page but if you just wish to download documents or pdfs, only check the “Documents (pdf, odf, …) box (this will apply to .doc and .docx as well). Jump to #6 – if you have checked what you need. If not, go to #5.
5. If you want to download just pictures and media, click this tab in the pop-up window. In the list displayed will only be image or media files.
6. Click on the Start! button to begin downloading your files.

• Consumer time on mobile apps surpasses time on Web. (Flurry)
• 2.1bn HTML5 browsers will be on mobile devices by 2016. (ABI Research)

What does this mean for eLearning? It means our audience is untethered from the typical desktop or laptop and that most users want information and learning at their fingertips. This means that when developing eLearning content and assessments, we need to look to the future and pay attention to the technology we are using to publish this content and assessment.

I’m already a big proponent of SCORM – Shareble Content Object Reference Model – standards for producing reusable content. There are also quite a few easy to use software applications out there that make creating this content relatively easy for the lay user, such as Articulate Presenter, Captivate, Lectora Publisher, and even UDUTU. However, many of these applications produce SCORM in Flash output, and therein lays the conflict.  In 2010, Adobe announced the death of Flash for the mobile platform. In my opinion, this was largely in part because of the on-going tiff between Apple and Adobe. Apple refused to support Flash on its ever-popular iOS platform, thus rendering any iPad and iPhone users in a Flash-less mobile user experience.  Instead, Apple began promoting HTML5.

Well, where does that leave those of us who love SCORM as well as have trained our user-base in being somewhat self-sufficient in Articulate and UDUTU and Captivate? Here’s your answer:

• SCORM by design does not require Flash
• SCORM generally makes use of HTML, XML, and JavaScript

The death of Flash for the mobile platform will NOT mean the death of SCORM. Rather, companies will seek out new ways to produce their SCORM packages using HTML5. Already, companies like DominKnow (makers of Claro) and Lectora (Online) have adopted their SCORM packager to be HTML5 compliant. Additionally, Articulate is in beta development on Storyline – an iOS compatible software for producing HTML5 compliant content (and most likely, SCORM, too). This is great news because now the content we produce will work across desktop and mobile devices – reaching our users where they are and how they want to learn.

Additional Resources:

• For a nice outline of Flash versus HTML5 (although a wee-bit dated) see: Strengths and Weaknesses of HTML5 and Flash by Heather Thomas on the Lectora Online website.
• For a basic HTML5 Mac software tool, try Hype (this is not a SCORM packager, just a way to build HTML5 objects).
• For kicks, test out the Google Swiffy extension for Adobe Flash Professional CS4 to convert Flash to HTML5 (or use their converter right on the linked page if you own the content).

It looks like a German company named edu-sharing* has solved my main problems:

• one central external repository (Alfresco – not copied into Moodle)
• updates to assets in the repository update all links in Moodle
• use of metadata for searching
• no accidental deletion of files
• use of files across courses
• a simple user-interface from within Moodle so the Moodle user doesn’t have to switch between systems to load to Alfresco first and then login to Moodle to link
• SSO between Moodle and Alfresco
• and so much more!

Seriously – this is the solution I have been looking for and will be excited to test!!!

Thank you edu-sharing! And thank you to Geoffrey Roland for posting about this in the Moodle.org forums.

*English translation: click on flag at top right corner of screen.

The EXCITING news is that they have released a beta version of Unity game-based-simulation SCORM packager, built on SCORM 2004, 4th edition, standards:

• Overview: http://www.adlnet.gov/adl-releases-the-unity-scorm-integration-toolkit-version-1-0-beta
• Download: http://www.adlnet.gov/scorm-unity-integration
• QuickStart Guide online: http://www.adlnet.gov/unity-scorm-quick-start-guide.

Please note, you need to have a developer with Unity authoring skills install this on your system first (see Unity). The above information is for developer’s only. Once installed and configured, then your Unity developer can publish a SCORM package using this tool (and this is a beta release – this is not for your production environment). So, this software is not for your typical educator – you still need to know how to build simulations using the Unity software first.

Now we just need the LMS community to catch up and provide SCORM 2004, 4th edition compliant players and reporting within their LMS! Thanks to Rustici, that reality may not be far off….

And, you really should check out SCORMpool’s blog post on this topic: http://scormpool.com/wordpress/?p=245. It has lots of goodies embedded in the post, including a link to testing 2004, 4th edition content!

Update 01/06/12:

• Here is the link to Rustici’s SCORM Cloud that Tammy Rutherford mentions in her comment: http://scorm.com/scorm-solved/scorm-cloud/
• and here is the clickable link to eLearning Atlas she mentions as well: http://elearningatlas.com/

*Taleo purchased Learn.com in 2010 and forged Taleo Learn learning content management system (Learn.com was 2004 SCORM compliant in the past, so I can’t imagine it wouldn’t be in the present rendition but you should independently verify this).

That’s where all of the different “players” for storing knowledge come in: wikis, learning management systems, content management systems, email, Google Docs, etc.  Many organizations use multiple systems for storing and sharing content, but many operational units need access to this data. So, how to make the systems “play nicely” together so different units can have their data but share it and access it too?

I highly recommend reading up on the proposed CMIS (Content Management Interoperability Services) standard. It’s not new (2008), but is now more important than ever in our mobile digital world. Check out the free whitepaper on the topic by EMC2: http://info.emc.com/mk/get/16292_LAND_RL?CMP=KNC-Google. You can also learn more here: http://en.wikipedia.org/wiki/Content_Management_Interoperability_Services. OASIS approved the standard in May of 2010 and it’s posted on their site here: http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=cmis

Of note, Alfresco uses this standard.

I’ll be posting updates on my discoveries in Moodle2 on the blog.