Having worked in the medical field for 30 years, FERPA reminds me of HIPAA. Basically, if you treat student information the same as you would a patient's then all should be good. The basic difference being that when a student asks for information you have 45 days to comply, where as, with patient information, that is readily available to them. So that will be a change for me to remember that the students have to request access and it is not readily accessible for them.
