I currently work with students in different schools around the country and am also working with an institution in its infancy with a goal of accreditation. It's interesting that FERPA does not define record retention aside from not destroying records of there is an outstanding review requirement.
I agree that there should be extensive training for both new and existing institution staff. It's also interesting to learn that state law can oppose FERPA requirements, and I would be interested to know what happens then?