I found that there is a hierarchy, there are other agencies that supersede FERPA. 

The key takeaway for me is that the institution must have policies to ensure the privacy of educational records. There are many instances where employees do NOT have the right to students' grades but may have access. 

FERPA policies must be understood by everyone. If in doubt this should be escalated to the administration. Realistically educational records are confidential and should only be accessed when people have a legitimate reason. 

Student educational records require the same level of confidentiality as medical records in the hospital. Which makes complete sense, just something I never really thought about in detail.