A shocking allegation has rocked a small Illinois community — a superintendent and two school employees are accused of mishandling students’ most sensitive personal data. But here’s where it gets even more complicated: the records in question weren’t just any files — they were student vaccine records, protected under strict state and federal laws.
Authorities say that Timothy Farquer, superintendent of the Mercer County School District in northwestern Illinois, was arrested alongside two members of the district’s technology department, Amberly Norton and Andrea Long. According to law enforcement officials, all three face serious criminal charges. Farquer has been charged with felony official misconduct, as well as two misdemeanor counts: unauthorized access to medical records and computer tampering. Norton and Long are reportedly facing the same charges. If convicted, each could face up to five years in prison.
Court records filed on September 25 allege that Farquer accessed confidential student vaccine data, added it to a private database, and then shared the information without authorization. The most puzzling part? Investigators haven’t identified who received the data or explained why the superintendent accessed the records in the first place. The lack of clarity surrounding motive and intent is already sparking heated debate among parents and privacy advocates.
The Mercer County School District, which is based in Aledo—about 30 miles south of Moline—has issued a formal statement addressing the allegations. In it, the district acknowledged the arrests of Superintendent Farquer and two IT staff members, emphasizing that they are cooperating fully with investigators and legal counsel to ensure transparency and fairness throughout the process.
The statement also underscores that Illinois school districts are legally required to maintain student health information as part of each student’s educational record. This process, the district says, ensures safety, compliance with health requirements, and proper educational support. Under the Illinois School Student Records Act (ISSRA), student health data are recognized components of a student’s school record. Teachers, nurses, and school support personnel routinely use these files to meet students’ learning and health needs.
Notably, the district clarified that these records fall under the Family Educational Rights and Privacy Act (FERPA) and ISSRA—not under HIPAA, the federal law governing medical privacy for healthcare providers. The school board contends that secure digital access to such records, managed by the IT department, is standard practice and essential for educational administration.
The board concluded by reaffirming its dedication to protecting student privacy, supporting staff who act in good faith, and upholding the district’s integrity. It urged the public to refrain from making assumptions until all facts are fully reviewed and due process has been completed.
But this is where opinions may divide. Should schools handle sensitive health data the same way they manage academic records? Or should vaccine information be treated more like medical data under HIPAA protections? The case raises tough questions about privacy boundaries in education.
What do you think — did the district cross a line, or was this a misunderstanding of complex data laws? Share your thoughts and join the debate in the comments below.
