Data breach reveals Chico State students seeking vaccine exemptions on religious grounds

Officials at California State University, Chico, are investigating a data breach that exposed confidential information from 130 students who requested religious exemptions from the COVID-19 vaccine.

The records, which included students’ names and email addresses, were breached Aug. 15 and published on an anonymous internet message board, said university officials. Officials were not aware of the breach until a reporter from the Sacramento Bee, which first reported the story, contacted the university Monday.

“Students’ medical and religious exemption requests are protected information,” said Andrew Staples, a Chico State spokesman, in a statement. “We are aware of the documents posted online and circulated among the media. We are investigating this incident, while also taking a number of proactive steps to protect students’ confidential information.”

The data from a leaked spreadsheet included the students’ self-reported explanations of how their religious beliefs conflict with the university’s vaccination requirements, according to university officials. A majority of students’ names, identification numbers and email addresses were scrubbed from the spreadsheet, but 24 students seeking religious exemptions were identifiable, officials said.

The students identifiable in the spreadsheet were notified of the breach Tuesday evening, according to Staples.

An internal investigation by the university’s Office of Information Security is underway, according to Andrew Miller, the acting vice provost of information resources.

California State University is requiring more than half a million students, staff and faculty across its 23 campuses to be vaccinated by Sept. 30. Some campuses, including Chico, required earlier inoculation dates for student athletes and students living on campus.

The Cal State COVID-19 vaccination policy allows students and employees to seek religious exemptions, which are not permitted in California’s K-12 education system, according to the National Conference of State Legislatures.

According to the Sacramento Bee, most of the Chico State exemption requests were filed by students citing Christian beliefs, with some quoting Scripture. Some exemption requests filed for religious reasons came from NCAA athletes, university officials said.

The university approved half the exemption requests on the document, according to the Sacramento Bee, and many of the denied requests were resubmitted for another chance at approval.

More students are seeking religious exemptions than medical exemptions, according to Dylan Saake, Chico State’s director of labor relations and compliance, who created the spreadsheet.

Students applying for religious exemptions are contacted by Saake’s team, which evaluates the validity of the requests and ensures they articulate “sincerely held beliefs, whether it’s religious or kind of similar to religion.”

Of the 16,000 students enrolled at Chico, 10,000 have notified the university of their vaccination status ahead of the Sept. 30 deadline, Staples said. Of those, 9,300 students, or 93%, declared that they have been vaccinated. The remaining 7% have requested a medical or religious exemption, or have certified that they do not intend to come to campus.