Illinois General Assembly - Full Text of HB4229

LRB104 16470 LNS 29865 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
HB4229

Introduced 1/14/2026, by Rep. Katie Stuart

SYNOPSIS AS INTRODUCED:

New Act

Creates the Higher Education Enrollment Fraud Act. Requires the Board of Higher Education to convene a working group to develop policies and procedures for institutions of higher education to prevent fraudulent enrollment in online courses for the purpose of gaining access to financial aid, campus information technology systems, and student support services. Requires each institution of higher education to complete an annual cybersecurity self-assessment of its information technology infrastructure to determine its Information Technology Laboratory score and annually report local and systemwide technology and data security measures that support improved oversight of fraud mitigation, online learning quality, and cybersecurity efforts to the Board. Requires the self-assessment and report to be submitted to the Board by December 15, 2026 and each December 15 thereafter and the Board to compile a report of these submissions and submit that report to the General Assembly by January 15, 2027 and each January 15 thereafter. Includes other information an institution of higher education must submit related to enrollment fraud. Effective immediately.

STATE MANDATES ACT MAY REQUIRE REIMBURSEMENT MAY APPLY

A BILL FOR

AN ACT concerning education.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Higher Education Enrollment Fraud Act.

Section 5. Definition. As used in this Act, "institution of higher education" means any public or private college or university located in this State, including a public community college.

Section 10. Enrollment fraud working group.

(a) The Board of Higher Education shall convene a working group, consisting of representatives the Board deems necessary, to develop policies and procedures for institutions of higher education to prevent fraudulent enrollment in online courses for the purpose of gaining access to financial aid, campus information technology systems, and student support services. The Board shall submit a report of its findings to the General Assembly by January 15, 2027.

(b) This Section is repealed on January 15, 2028.

Section 15. Required self-assessment.

(a) Each institution of higher education shall complete an annual cybersecurity self-assessment of its information technology infrastructure to determine its Information Technology Laboratory score and annually report local and systemwide technology and data security measures that support improved oversight of fraud mitigation, online learning quality, and cybersecurity efforts to the Board of Higher Education. The self-assessment shall include, but not be limited to, the following information:

(1) the amount of fraudulent student enrollments reported since the COVID-19 pandemic that began in March 2020 or since the previous self-assessment;

(2) the percentage of fraudulent enrollments among total enrollments;

(3) any trends or patterns that can be identified in fraudulent enrollments, including preferred course types, such as online, in-person, or hybrid;

(4) the amount of financial aid that has been disbursed to fraudulent students annually since the COVID-19 pandemic that began in March 2020 or since the previous self-assessment;

(5) the estimated financial loss due to fraudulent enrollments;

(6) the specific costs associated with fraud prevention, including systemwide expenditures on cybersecurity, admissions verification, and administrative oversight;

(7) how fraudulent enrollments have impacted the distribution of State funding to the institution of higher education;

(8) any strategies the institution of higher education has implemented to detect and prevent fraudulent enrollments;

(9) any barriers that prevent the institution of higher education from effectively addressing fraudulent enrollments;

(10) if any classes have been canceled due to fraudulent enrollments failing to meet minimum student thresholds;

(11) if fraudulent enrollments contribute to inefficient resource allocation, including offering unnecessary course sections;

(12) the effectiveness of any systemwide fraud mitigation strategies used to reduce fraudulent enrollments;

(13) if the Board of Higher Education or the institution of higher education's governing body has provided sufficient guidance and support to combat fraud;

(14) any additional policies or resources needed to address the ongoing threat of fraudulent enrollments; and

(15) the impact on real students, including whether real students are prevented from getting classes due to fraudulent students.

The self-assessment and report shall be submitted to the Board of Higher Education by December 15, 2026 and each December 15 thereafter, and the Board shall compile a report of these submissions and submit that report to the General Assembly by January 15, 2027 and each January 15 thereafter.

(b) In addition to the self-assessment in subsection (a), each institution of higher education shall submit to the Board of Higher Education:

(1) a remediation update twice per year, for the fall and spring semesters, on vulnerability and other issues identified in the most recent self-assessment;

(2) a detailed after-action report of all cybersecurity incidents that either led to a breach of personally identifiable information or led to the disruption of services, including, but not limited to, a breach of student identification numbers, distributed denial-of-service attacks, and ransomware;

(3) a report of the total number of admission applications received that are determined to be fraudulent, including applications considered to be likely fraudulent, on an annual basis; and

(4) information that was requested on suspected fraudulent enrollments and the fraudulent receipt of financial aid, on an annual basis.

The Board of Higher Education shall compile an annual report of these submissions and submit the report to the General Assembly.

(c) If the self-assessment and reporting required under subsection (a) or the submissions required under subsection (b) are duplicative of other information provided by an institution of higher education to the Board of Higher Education, the institution of higher education may submit that information in lieu of the self-assessment and reporting required under subsection (a) or the submissions required under subsection (b).

Section 99. Effective date. This Act takes effect upon becoming law.