HQ Portal Privacy Policy

California Cadet Corps — Commandant Portal (hq.cacadets.org)

Effective date: pending adoption · Last updated September 22, 2026

Draft — legal review received, pending adoption. This policy has been reviewed for FERPA and HIPAA compliance and the review’s recommendations are included below. It is not yet final. Before adoption, CACC and the California Military Department must identify in writing which entity is the FERPA-covered educational agency or institution for HQ Portal cadet records, and whether CACC acts as that entity’s school official or service provider. That determination controls parts of Sections 1, 4, 8, and 9.

1. Who we are & who this policy covers

The California Cadet Corps (CACC) is a state-authorized youth leadership and citizenship program under the California Military Department, operating cadet units in partnership with school districts and other host organizations across California. The HQ Portal (hq.cacadets.org) is the internal system CACC adult staff use to manage rosters, service records, training, travel, supply, and related program administration for cadets and adult volunteers.

For purposes of this Policy, the term “educational agency or institution” means a participating school, school district, or other educational entity that is subject to FERPA and is legally responsible for applicable education records. Where CACC maintains, accesses, or processes education records on behalf of such an educational agency or institution, CACC and authorized persons acting for CACC will handle those records in accordance with applicable FERPA requirements.

This policy applies to personal information the HQ Portal collects about: (a) cadet members, the large majority of whom are minors; (b) adult staff, volunteers, and cadre; and (c) parents/guardians and other individuals who interact with the portal through a tokenized, no-account link (for example, a media-consent request or a travel-claim intake form).

Not all information maintained in the HQ Portal is necessarily an “education record” under FERPA, and not all health-related information is necessarily “protected health information” (“PHI”) under HIPAA. The applicable legal classification depends on the nature of the information, the person to whom it relates, the purpose for which it is maintained, and the identity and role of the entity maintaining or receiving the information.

Where HIPAA applies to information handled through the HQ Portal because CACC, a participating organization, or a service provider is acting as or on behalf of a HIPAA covered entity, applicable HIPAA Privacy, Security, and Breach Notification requirements will apply to the PHI within the scope of that covered relationship.

Nothing in this Policy shall be interpreted to waive or limit rights provided under FERPA, HIPAA, or other applicable privacy laws.

2. Information we collect

Depending on your role, the HQ Portal may collect:

Identity & contact information: name, rank, date of birth, phone, email, and (for cadets) school/grade level.
Guardian & emergency contact information: parent/guardian name, relationship, phone, and email, collected for cadets under 18.
Service & personnel records: unit assignment history, promotions and promotion testing, awards, and Personnel Action Requests (PARs) — including administrative, corrective, and disciplinary actions, which are logged with an audit trail.
Physical fitness performance data: Cadet Fitness Test (CFT) event scores (e.g., mile run, push-ups, curl-ups) recorded as training/performance results. The HQ Portal does not collect medical diagnoses, treatment history, immunization records, or health insurance information.
Government identifiers: Social Security Number, collected only where required for personnel/pay processing, stored encrypted, and access-limited to the staff roles that need it.
Media & consent records: photos/video of cadets at events, and the parent/guardian consent decision on file for their use.
Travel, pay, and logistics records: information submitted for travel claims, travel orders, lodging, and equipment issue/turn-in, which may itself include some of the categories above.
Technical data: standard, privacy-preserving site usage analytics (Vercel Analytics — no cross-site tracking cookies) used to keep the portal reliable.

CACC does not intentionally request or maintain medical diagnoses, treatment records, prescriptions, immunization records, health insurance information, or other clinical information through the ordinary CACC cadet-record workflow. If health information is nevertheless received, CACC will evaluate whether it constitutes an education record, PHI, or information protected under another applicable law and will handle it accordingly.

CACC will not intentionally collect PHI through a Portal workflow unless the collection is necessary for an authorized function and the applicable legal and contractual requirements have been established in advance.

3. How we use this information

We use this information to operate the cadet program: verifying eligibility and unit assignment, administering promotions and training, processing travel and pay, maintaining the official service record, communicating with cadets and staff, obtaining and honoring media consent, and complying with CACC’s own administrative and California Military Department reporting requirements.

Where information constitutes an education record subject to FERPA, CACC will use and disclose that information only for authorized educational, administrative, safety, legal, or other purposes permitted by FERPA or by the responsible educational agency or institution.

Where information constitutes PHI subject to HIPAA, a HIPAA covered entity and its business associates will use and disclose that PHI only as permitted or required by the HIPAA Rules and applicable law. Covered entities must generally limit uses and disclosures subject to the minimum-necessary standard to the information reasonably necessary to accomplish the intended purpose.

CACC does not sell personal information, education-record PII, or PHI, and will not use protected student or health information for targeted advertising.

4. FERPA — Family Educational Rights and Privacy Act

To the extent the HQ Portal contains “education records” subject to FERPA, 20 U.S.C. § 1232g and 34 C.F.R. Part 99, CACC will handle those records in accordance with FERPA and applicable requirements of the educational agency or institution responsible for the records.

Inspection and review. A parent of a minor cadet, or an eligible student whose FERPA rights have transferred to the student, has the right to inspect and review education records subject to FERPA. FERPA rights generally transfer to the student when the student reaches 18 years of age or attends a postsecondary institution.
Amendment. A parent or eligible student may request amendment of an education record that the parent or eligible student believes is inaccurate, misleading, or otherwise violates the student’s privacy rights. If the responsible educational agency or institution declines to amend the record, the applicable FERPA hearing procedures will be made available.
Consent to disclose. CACC will not disclose PII from education records without prior written consent unless the disclosure is permitted by an applicable FERPA exception or other law.
Access by CACC personnel. CACC personnel do not receive unrestricted access to education records because of rank, title, employment status, CACC membership, or system-administrator privileges. Access must be based on an authorized role and legitimate educational interest or another lawful basis.
Response time. FERPA access requests will be processed within the applicable 45-day period when CACC is responsible for responding to the request, or will be promptly coordinated with the participating educational agency or institution legally responsible for the records.
No destruction during a pending request. CACC will not destroy an education record while a valid request to inspect and review that record remains outstanding.
CACC as a school official or service provider. Where CACC receives education-record PII from an educational agency or institution as a contractor, service provider, or other school official, CACC will remain subject to applicable FERPA requirements concerning direct control, legitimate educational interest, permitted use, and redisclosure.
Complaints. A FERPA complaint may be submitted to the U.S. Department of Education’s Student Privacy Policy Office.

5. HIPAA — Health Insurance Portability and Accountability Act

The HQ Portal is not a health care provider, health plan, or health care clearinghouse, and it does not collect protected health information (PHI) as HIPAA defines it — no diagnoses, treatment records, prescriptions, or health insurance information are stored in this system. The Cadet Fitness Test scores described in Section 2 are physical performance results used for training and awards, not medical records.

On that basis, CACC does not currently consider the HQ Portal a HIPAA “covered entity” or “business associate” system. We nonetheless apply the same security discipline described in Section 7 to this data as a matter of good practice.

5.1 HIPAA applicability

HIPAA applies to health plans, health care clearinghouses, and health care providers that conduct certain covered electronic transactions. Certain HIPAA requirements also apply to “business associates” that perform specified functions or services involving PHI on behalf of a covered entity.

CACC does not presently represent, solely by operating the HQ Portal, that it is a HIPAA covered entity or business associate. Whether HIPAA applies to a particular activity must be determined from the actual role of CACC, the participating organization, and the relevant service provider.

The HQ Portal is not intended to function as a medical-record or health-care delivery system. CACC does not intentionally collect diagnoses, treatment records, prescriptions, immunization records, health-insurance information, or other clinical information through its ordinary cadet-record workflows.

5.2 FERPA and HIPAA relationship

Information concerning a student that is an “education record” under FERPA may be governed by FERPA rather than the HIPAA Privacy Rule. HHS and the U.S. Department of Education have specifically explained that student health information maintained by an educational agency or institution as education records is generally excluded from HIPAA Privacy Rule coverage.

Accordingly, CACC will not assume that information is subject to HIPAA merely because it concerns health, fitness, injury, or a medical issue. CACC will determine, where necessary, whether the information is an education record under FERPA, PHI subject to HIPAA, or information subject to another applicable privacy law.

5.3 HIPAA-protected information

If CACC becomes a HIPAA covered entity or business associate, or receives PHI in circumstances in which HIPAA applies, CACC will implement the applicable HIPAA Privacy, Security, and Breach Notification requirements for that PHI.

PHI subject to HIPAA will be accessed only by persons authorized to perform their assigned duties and will be limited to the information reasonably necessary for the applicable purpose, consistent with the HIPAA minimum-necessary standard where that standard applies.

HIPAA-protected information will not be used or disclosed for marketing or other purposes prohibited by HIPAA without the authorization required by law.

5.4 HIPAA business associates and vendors

Where a CACC service provider creates, receives, maintains, or transmits PHI on behalf of a HIPAA covered entity in a manner that makes the provider a business associate, the covered entity and business associate will enter into a written Business Associate Agreement (“BAA”) meeting applicable HIPAA requirements.

The BAA or other applicable agreement will address permitted and required uses and disclosures, appropriate safeguards, breach reporting, subcontractor requirements, and other provisions required by the HIPAA Rules.

CACC will not represent a vendor as “HIPAA compliant” solely because the vendor uses encryption, maintains security certifications, or signs a general confidentiality agreement. HIPAA compliance depends upon the actual legal relationship, permitted uses and disclosures, required safeguards, and applicable contractual obligations.

5.5 HIPAA security requirements

If HIPAA applies to information maintained in the HQ Portal, the applicable covered entity and business associate will implement administrative, physical, and technical safeguards required by the HIPAA Security Rule for electronic PHI (“ePHI”).

These safeguards may include risk analysis and risk management, access controls, authentication, audit controls, integrity protections, transmission security, workforce policies, contingency planning, and other safeguards required by the applicable HIPAA Security Rule provisions.

5.6 HIPAA breach notification

If a breach of unsecured PHI subject to HIPAA occurs, the responsible HIPAA covered entity and/or business associate will follow the applicable HIPAA Breach Notification Rule. A business associate must notify the covered entity of a qualifying breach as required by the HIPAA Rules, and covered entities have notification obligations to affected individuals, HHS, and, when applicable, the media.

Nothing in this Policy limits any separate breach-notification obligations imposed by California law, federal law, contractual obligations, or the requirements of a participating educational agency or institution.

5.7 HIPAA individual rights

Where HIPAA applies, individuals will be afforded the HIPAA rights applicable to their PHI, including applicable rights to inspect and obtain copies of PHI in a designated record set and to request amendment of PHI, subject to the limitations and procedures established by the HIPAA Rules.

A HIPAA covered entity generally must act on an access request within 30 calendar days, with one additional 30-day extension permitted when the required written notice and other regulatory conditions are satisfied.

HIPAA rights described in this Section apply only when the information and entity involved fall within the scope of HIPAA. They do not replace or diminish any FERPA rights that may independently apply.

6. Minors & parental/guardian rights

Most cadets are minors. Cadets do not receive general HQ Portal staff accounts; where a cadet needs to interact with the system directly (for example, to take a promotion test or file their own request), access is through a narrowly scoped, cadet-specific sign-in — never a full staff account.

Photos or video of a cadet are used only with a parent/guardian’s on-file consent decision, collected through a personal, single-use link emailed to the parent/guardian — not a public form or a portal account. A parent/guardian may update that decision at any time by contacting their cadet’s unit staff or CACC IT Support (Section 8).

Where information involves a minor’s education records, CACC will apply the parental rights provided by FERPA until those rights transfer to the student under applicable law.

Where PHI is subject to HIPAA, parental access and authority will be determined under the applicable HIPAA personal-representative rules and other applicable law. CACC will not assume that being a parent automatically establishes a right to obtain all health information under HIPAA.

Where state or federal law limits a parent’s or guardian’s authority with respect to particular health information, CACC and applicable covered entities will comply with those limitations.

Where FERPA applies to student health information maintained as education records, FERPA procedures will govern instead of treating the information as HIPAA PHI merely because it concerns health.

7. How we protect your information

Sensitive fields — including SSN and guardian/emergency contact details — are encrypted at rest.
Access is role-based: staff see only the records their assigned staff section and echelon require, enforced at both the application and database layer.
Access to education records and, where applicable, PHI/ePHI shall be restricted according to user role and assigned duties.
Access privileges will be reviewed and modified or terminated when a person’s role, assignment, employment, volunteer status, or other authorization changes.
Shared credentials for accessing protected records are prohibited except where specifically authorized and technically controlled.
Changes to a cadet’s official record (promotions, corrections, disciplinary actions) are written to an audit trail.
The HQ Portal will maintain appropriate audit information concerning access to protected records consistent with applicable FERPA and HIPAA requirements and system-security needs.
All portal traffic is encrypted in transit (HTTPS).
Where HIPAA applies, the Portal and its responsible operators will implement the administrative, physical, and technical safeguards required by the HIPAA Security Rule for ePHI.
Where the HIPAA minimum-necessary standard applies, reasonable steps will be taken to limit use, disclosure, and requests for PHI to the minimum necessary to accomplish the intended purpose.
Security incidents involving education-record PII or PHI will be investigated and handled under CACC’s incident-response procedures and any applicable legal, contractual, FERPA, HIPAA, or educational-agency requirements.
Records are retained while a cadet or staff member is active in the program and archived (not publicly deleted) when they separate, consistent with CACC’s administrative record-keeping needs; see Section 10.

8. Your rights & how to request access or correction

To request access to records maintained in the HQ Portal, request amendment or correction of a record, ask a question concerning this Policy, or report a privacy concern, contact CACC IT Support at ITsupport@cacadets.org. A cadet’s own unit staff can also submit a record-correction request on the cadet’s or parent/guardian’s behalf through the HQ Portal’s internal process.

The applicable response procedure and deadline will depend on the legal classification of the record:

FERPA education-record requests: when CACC is responsible for responding, requests to inspect and review education records will be handled within the FERPA 45-day period.
HIPAA PHI requests: where HIPAA applies and CACC or its responsible covered entity is responsible for the request, applicable HIPAA access procedures and the 30-day response period, including any permitted extension, will apply.

A request will not be denied merely because the requester does not explain why access is being requested, except where applicable law provides otherwise. CACC may take reasonable steps to verify the identity and authority of a person requesting access before releasing information containing PII or PHI.

A parent or eligible student requesting amendment of an education record will be afforded the applicable FERPA amendment and hearing procedures. An individual requesting amendment of PHI where HIPAA applies will be afforded the applicable HIPAA amendment procedures and rights.

Where the same information is potentially subject to both FERPA and HIPAA-related protections, CACC will determine which legal framework governs the particular record and will apply any additional protection required by other applicable law.

9. Who we share information with

We share personal information only as reasonably necessary to administer the HQ Portal and perform authorized CACC functions and only where the disclosure is permitted by applicable law. We do not sell personal information to third parties.

Where education-record PII is subject to FERPA, disclosures to service providers or other third parties will occur only when an applicable FERPA exception permits the disclosure and the recipient satisfies applicable FERPA requirements.

Where PHI is subject to HIPAA, disclosures to a business associate will occur only pursuant to an appropriate Business Associate Agreement or other arrangement required by the HIPAA Rules, and the business associate will be restricted to permitted uses and disclosures.

Service providers may include:

Database and hosting providers, for authorized hosting, storage, backup, security, and operation of the HQ Portal.
Microsoft 365, for authorized email and secure document storage of certain official records.
Transactional email providers, for authorized account and record-related notifications.
AI services, including Anthropic’s Claude API, only where specifically authorized for the data and use case. Today that means reading certification documents you upload and an in-portal help assistant — not advertising or model training on your data.

CACC will not submit education-record PII or PHI to an AI provider unless the disclosure is legally authorized and the provider’s contractual and technical arrangement satisfies the applicable FERPA or HIPAA requirements.

Where an AI provider acts as a service provider for education records, CACC will require restrictions appropriate to the FERPA school-official requirements, including purpose limitation, direct control where required, and restrictions on unauthorized use or redisclosure. Where an AI provider acts as a business associate for PHI, CACC or the applicable covered entity will require the contractual protections required under HIPAA, including a BAA when legally required.

A vendor’s general privacy statement or assertion that it “does not train on customer data” does not, by itself, establish FERPA or HIPAA compliance.

CACC will not sell education-record PII, PHI, or other protected cadet information to third parties or use such information for targeted advertising.

10. Data retention

We retain a cadet’s or staff member’s record for as long as they are active in the program. When someone separates from CACC, their record is archived rather than deleted, so CACC can maintain accurate historical service records (for example, for a cadet requesting a record of service years later). Some fields required for personnel/pay history are retained without deletion as part of that official record.

We retain records in accordance with applicable records-retention schedules, legal requirements, legitimate administrative needs, contractual requirements, and applicable requirements of the responsible educational agency or institution. FERPA does not establish a single universal retention period for all education records. Records that constitute education records remain subject to applicable FERPA requirements for so long as they are maintained.

Where PHI is maintained in circumstances subject to HIPAA, the responsible covered entity or business associate will retain and dispose of PHI in accordance with applicable HIPAA, contractual, records-management, and other legal requirements. Where applicable HIPAA requirements impose retention, availability, documentation, or other obligations concerning PHI, those requirements will be followed by the responsible covered entity and business associate.

CACC will not destroy or permanently dispose of an education record while a valid FERPA request to inspect and review that record remains outstanding. Archived records will remain subject to applicable access, confidentiality, security, and disclosure restrictions.

11. Changes to this policy

We may update this Policy as the HQ Portal, CACC operations, applicable law, or security practices change. Material changes will be reflected in the “Last updated” date and, where appropriate, communicated to affected users or participating educational agencies and institutions. A change to this Policy does not waive or reduce any rights provided under FERPA, HIPAA, or other applicable law.

Continued use of the HQ Portal does not constitute FERPA consent or HIPAA authorization where separate consent or authorization is legally required.

Where FERPA requires written consent, the consent will identify the records or information to be disclosed, the purpose of the disclosure, and the party or class of parties to whom disclosure may be made, and will be signed and dated as required by law.

Where HIPAA requires an authorization for a use or disclosure of PHI, the authorization will satisfy the applicable HIPAA requirements and will be obtained separately from acceptance of this Privacy Policy.

12. Contact us

California Cadet Corps · CACC IT Support: ITsupport@cacadets.org

FERPA: for access, amendment, or privacy concerns about education records maintained in the HQ Portal, contact CACC IT Support. CACC will coordinate with the educational agency or institution legally responsible for the applicable education records when required.
HIPAA: for concerns involving PHI in a workflow subject to HIPAA, contact CACC IT Support or the applicable HIPAA covered entity/privacy official identified for that service or record.

FERPA complaints may be submitted to the U.S. Department of Education’s Student Privacy Policy Office. HIPAA complaints may be submitted to the U.S. Department of Health and Human Services, Office for Civil Rights, as provided by the HIPAA Rules.