I was suprised to learn we should restrict access to employee's who are also students to their own student records. 

I was suprised to learn that a student ID must be used with something else to verify a student's ID

One thing I learned about FERPA in this module that I previously didn't know was to use a "Need to know basis" within our organization to determine which employee's truly need access to student confidential information to fullfill the responsiblities of their job.