States often collect far more information about students than necessary and fail to take adequate steps to protect their privacy, a national study concludes. The dossiers go far beyond test scores, including Social Security numbers, poverty data, health information and disciplinary incidents.

The study from the Fordham University Center on Law and Information Policy, released Wednesday, casts light on data systems created at the urging of the federal government to track student progress. One finding: States often fail to spell out protocols for purging records after students graduate.

"Ten, 15 years later, these kids are adults, and information from their elementary, middle and high school years will easily be exposed by hackers and others who put it to misuse," said Fordham law professor Joel R. Reidenberg, who oversaw the study. States, he said, "are trampling the privacy interests of those students."

The movement toward statewide databases with unique student identifiers, rooted in the standards-and-testing movement of the 1990s, has grown significantly in this decade under the federal No Child Left Behind law and is getting a fresh push this year from the Obama administration. Federal officials want to link student test scores to teacher files to help evaluate instruction. They also envision systems that track students from pre-kindergarten through college, to help raise college completion rates.

Nearly all states, including Virginia and Maryland, have built or are planning virtual education "data warehouses," aided by federal funding. A similar effort is underway in the District, although contractor troubles have caused delays. Advocates say the warehouses have strong privacy protections, but they acknowledge potential shortcomings.

"Is there data collected that's not necessary anymore?" asked Aimee Guidera, executive director of the Data Quality Campaign, based in the District, which is funded by the Bill and Melinda Gates Foundation, among others. "Probably." She cited Kansas and Tennessee as leaders in establishing rules for data control.

But a larger concern, Guidera said, is that states often lack "a strategic, thoughtful way of connecting information and using it to answer questions."

The Fordham study canvassed public information on state data systems and compliance with federal privacy law. It omitted the District, and researchers said they were unable to obtain information from Maryland.

Among the findings: At least 23 states note reasons for withdrawal from school such as jail, illness or mental health issues. At least 22 count student absences. At least 29 track whether students are homeless. Those three tallies include Virginia.

The study also found that at least 16 states use or allow the use of Social Security numbers to identify students and at least 10 note whether a student is a single parent. Virginia was not among the 16 or the 10. Another finding: Florida, Kentucky, New Jersey and North Carolina track the date of a student's last medical exam.

The study recommended that states tighten protocols to keep data anonymous, with special provisions for those in local schools who need to know more; that they articulate reasons for collecting data and jettison what is unjustified; and that they appoint officers to oversee compliance with state and federal privacy laws.

Charles Pyle, a Virginia Department of Education spokesman, said data are protected through policies and programming that prevent unauthorized access. The data help the state comply with No Child Left Behind, he said, and help pinpoint student needs.

"You need a statewide system to keep track of the kids," said Grover "Russ" Whitehurst of the Brookings Institution, who oversaw education research for President George W. Bush's administration. "Otherwise, they fall off the screen."