I am very familiar with HIPAA but learned FERPA does not always result in a fine and that a student cannot demand their records and the institution has 45 days to get the student the records. The institution may charge for the records as long as the cost does not prohibit the student from obtaining them