FERPA is the regulatory framework that governs how student records are handled. To the best of my knowledge it's similar to HIPAA but not as strong as it only applies to public schools. There may be additional state laws about it as well.

https://en.wikipedia.org/wiki/Family_Educational_Rights_and_...