Editing Herzing Issues: Academic Integrity (section)

=== HU-185: The HESI secure examination browser permits in-exam access to outside reference content and a complete bypass out of the locked exam ===
{| class="wikitable" style="width:100%"
! style="width:14em" | Severity
| Critical
! style="width:14em" | Status
| CONFIRMED; demonstrated live by the reporting student during a screen share and directly observed and acknowledged by the Elsevier representative on the call
|-
! Issue type
| Examination Lockdown Browser Security Failure Permitting Outside Resource Access and Desktop Bypass
! Date added
| 2026-08-04
|-
! Owner
| colspan="3" | Elsevier / HESI product and technology teams; ProctorU (Meazure Learning); Herzing University academic leadership
|}
'''Finding.''' During joint troubleshooting on August 4, 2026, the reporting student demonstrated, on screen share, that within the HESI secure examination browser a student can click a word in an exam item and receive a macOS dictionary and thesaurus panel displaying the definition of that term. The same panel offers a Siri Knowledge option which renders full Wikipedia article content. The reporting student further demonstrated that selecting the Wikipedia option launches the article in Google Chrome outside the locked browser, at which point he had complete access to his computer, and that he could then return to the still-open exam via the application dock or the application switcher and repeat the cycle. He demonstrated this behavior on the legacy secure browser and stated it also occurred on the newer secure browser he was asked to load during the same call. The Elsevier representative observed the dictionary panel on the shared screen, stated that the behavior should not occur, said he was raising it within his internal group chat and updating an open ticket with his technology team, and thanked the reporting student for surfacing it. The reporting student noted on the call that a live ProctorU proctor watching the screen would likely observe such activity, but that the lockdown browser is itself the control intended to prevent access to outside resources, and that a student testing without an attentive live proctor would face no barrier at all.

'''Evidence.''' Recorded call and transcript, August 4, 2026. The reporting student demonstrated the dictionary and thesaurus panel appearing within the secure browser, demonstrated Siri Knowledge rendering Wikipedia content, and demonstrated launching a Wikipedia article into Google Chrome and returning to the open exam. The Elsevier representative acknowledged the behavior on the call, stated it should not be occurring, and stated he was escalating internally and updating a technology ticket. The reporting student also recorded a short screen capture of the behavior during the call and emailed it to the Elsevier representative after an in-call screen share attempt failed due to an external sharing restriction. Source Group: Recorded video call, August 4, 2026, between the reporting student, a representative of Elsevier/HESI who stated he also works with the Meazure Learning side, and Dr. Danielle Laban, Associate Vice President of Student Affairs, who joined near the end of the call; transcript provided by the reporting student. Speaker attribution in the automated transcript is inconsistent and the same speaker is labeled variously; the substance is clear but individual lines should be attributed by reference to the underlying recording rather than to transcript speaker labels.

'''Reported statement.''' <blockquote>I was able to completely bypass and go out of the lockdown browser into Google Chrome while I was showing him, and access the dictionary, and I had complete control over my computer during this time. [Elsevier representative:] that stuff should not be showing.</blockquote>

'''Standards.''' HLC Criterion 2.A (institutional integrity, including the integrity of academic assessment) and 34 C.F.R. Section 668.14 (administrative capability, including adequate oversight of third party vendors performing core institutional functions). Compare against Herzing's published Student Code of Conduct and Academic Integrity policy, which impose obligations on students not to access unauthorized resources during examinations; a proctoring control that does not in fact prevent such access places students at risk of integrity findings arising from software behavior rather than student conduct. Programmatic nursing accreditation standards regarding the integrity and validity of student evaluation are also potentially implicated; the applicable standard number should be confirmed against the current standards of the accreditor for this specific program before being cited in any filing.

'''Impact.''' This is an examination validity and academic integrity risk that runs to the institution and the student body rather than solely to the reporting student. If the lockdown control does not prevent access to reference material or to the desktop, the security assurance underlying every proctored HESI examination administered through this browser is weakened. For the reporting student specifically, the same defect creates the exposure documented at {{HU|HU-186}}, because his accommodation gesture triggers the dictionary panel. The reporting student raised on the call the question of whether other students on comparable devices could reproduce the bypass; that has not been tested and is not established.

'''Notes.''' Recommend requesting written confirmation from Herzing and Elsevier of the disposition of the technology ticket opened on August 4, 2026, whether the behavior has been reproduced by the vendor, and whether any examinations already administered are considered affected. The reporting student's screen capture of the behavior should be preserved as an exhibit. Whether other students can reproduce the bypass has not been tested and should not be asserted as established. Cross-References: {{HU|HU-186}} (text to speech gesture triggering the dictionary panel, arising from the same defect), {{HU|HU-175}} (the underlying accessibility failure and the August 4, 2026 root cause finding), {{HU|HU-188}} (compatibility check calculator defect surfaced on the same call).