A private school may be outside the student privacy law entirely

The Family Educational Rights and Privacy Act (FERPA), enacted in 1974,
protects the privacy of student education records. It applies to **any public
or private elementary, secondary or post-secondary school**, and to **any state
or local education agency receiving funds under an applicable US Department of
Education programme.**

Funding is what triggers it, and that produces a split people do not expect.

Who is covered, and who is not

So a family's records may be protected by federal law at university and not at
the private school the same child attended at fourteen.

Schools that do not comply risk losing federal funding — which is the
enforcement mechanism, and also the reason the unfunded schools fall outside
it.

What parents and eligible students can do

• Inspect and review the student's education records. Schools need not
  provide copies unless reviewing the originals is impossible — for example if
  the family lives far away
• Request a correction of records they believe inaccurate or misleading. If
  the school refuses, they have the right to a formal hearing — and if the
  school still refuses after that, the right to **place a statement with the
  record** explaining their view of the contested information
• Stop the release of personally identifiable information
• Get a copy of the institution's policy on access to education records

The statement-with-the-record right is the interesting one: where the school
will not change what it wrote, the family's disagreement travels with the file
permanently.

**Schools need written permission to release any information from a student's
education record** — with defined exceptions under which disclosure is
permitted without consent.

*Source: Centers for Disease Control and Prevention, Public Health Law
Program.*