FERPA is designed to protect the student, just because the institution employs someone, it does not mean they automatically have the right to access certain information. FERPA keeps everything confidential, some school officials may not be employees of the institution but have a legitimate interest based on the role served.