School Health Assessment and Performance Evaluation System

Privacy Policy

The privacy of students, their families, school-based staff, community partners, schools, and districts is of utmost importance to the National Center for School Mental Health and The SHAPE System. This Privacy and Security Policy ensures our commitment to protect all information entered in The SHAPE System and the privacy of all System users and related groups.

Who can access The SHAPE System and what is their role?
Each SHAPE System user will create his or her own account, accessed by a unique login name and password selected by that individual. This ensures that users will be provided with information, surveys and reports appropriate to their role only. 

SHAPE System users represent either a school district, "SHAPE System District Users," or an individual school "SHAPE System School Users." In addition, the National Center for School Mental Health and our technology partner, 3C Institute, are SHAPE System Administrators.

District users can view the School Mental Health and performance measure reports of the schools in their district IF those schools 1) are registered on The SHAPE System and 2) grant access to the district. Schools can view district team members' names, titles, email addresses, and last visit to SHAPE to inform their decision about data sharing. Districts can also view this information about school team members if the school has granted access.

Read more about the SHAPE System User and Administrator groups and their permissions.

What data are entered into the SHAPE System?

There are no individual student data entered into SHAPE. Any data about number of students screened or receiving services are entered in aggregate. SHAPE is a web-based system for school or district teams to self-report the performance of their school mental health system. 

The two types of data that can be entered into the SHAPE System are as follows:

1. SMH Profile

        • District and school versions
        • Entered in aggregate by district or school teams
        • No identifying student information
        • Includes information (name/e-mail/title) on the SHAPE system leader and team members, school building, and school mental health system (e.g., number of students served, data systems, professional team, and services provided)

2. Quality and Sustainability Performance Survey

        • District and school versions
        • Entered in aggregate by district or school teams
        • No identifying student information
        • Quality data include information about the quality status of the comprehensive school mental health system (CSMHS), such as school mental health system outcomes, screening information, evidence-based supports and implementation, needs assessment/resource mapping, teaming and data-informed decision making
        • Sustainability data include information about the sustainability status of the comprehensive school mental health system (CSMHS), such as funding and resources, resource utilization, program quality and implementation support, documentation and reporting of impact, and district policy and support

The SHAPE System Administrators (NCSMH and 3C Institute) access education data from the Department of Education website and link it with registration information. The types of data collected include school addresses and phone numbers, and type of school (e.g., public/private/charter, urban/rural/suburban location, percentage of students receiving free and reduced price lunch).

How are data used?
Whether or not a school or district has registered with The SHAPE System is publicly available information. The information that school or district teams enter into SHAPE (including the School Mental Health Profile, Quality or Sustainability Assessments, team member names) is not publicly available. Information entered into SHAPE by schools and districts may be compiled in aggregate by the Center for School Mental Health to understand:

        • Patterns of system use
        • Descriptive information about comprehensive school mental health system features nationwide (per the School Mental Health Profile)
        • Overall quality and sustainability performance for comprehensive school mental health systems nationwide. (per the Quality and Sustainability Performance Surveys)

How are data stored?

The SHAPE System uses website cookies and log files to store non-personal data only. Cookies on the SHAPE System are never set across websites to track movement from site to site. We will never sell personally identifiable information to a third party. We will never share information with a third party, except to comply with law enforcement, or if the user explicitly permits the use of this information for other purposes.

Our Commitment to Data Security
To prevent unauthorized access, maintain data accuracy, and ensure the correct use of information, we have put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect online, including but not limited to SSL security, encrypted databases, internal security audits, and staff policies.

We respect students', schools', and districts' rights to privacy. In recognition of the sensitive nature of school and district level data and student information collected through the use of any programs on the SHAPE platform, multiple access levels have been developed so that each type of user – district and school – are granted specific data permissions. The SHAPE System does not collect any personal health information or student data, and therefore does not require protection from either the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) or the Health Insurance Portability and Accountability Act (HIPAA).

To ensure the security and privacy of all data entered by School and District Users, several physical, network, hardware, and appropriate software safety precautions are in place. The firewall restricts access to data to those who have requisite permission levels. All logins have strong password rule enforcement and password expiration schedules. Data stored online are protected using algorithms and separation of encrypted data from keys.

Changes to Privacy Policy
This Privacy Policy was updated in April 2018. 3C Institute reserves the right to make minor changes to this policy at any time by posting the revised Privacy Policy on this site. Material changes to the Privacy Policy will not take effect without the consent of customers.

Contact Us
Questions about our privacy policy? Please contact us at or (410) 706-0980.