25 C.F.R. § 43.23 – Conduct of employees.

(a) Employees whose duties require handling of student records shall, at all times, take care to protect the integrity, security, and confidentiality of these records.
(b) No employee of the educational institution may disclose student records unless disclosure is permitted under § 43.14 or made to the parent of the student or eligible student to whom the record pertains.
(c) No employee of the educational institution may alter or destroy a student record, unless:
1. (1) Alteration or destruction is properly undertaken in the course of the employee's regular duties, or
2. (2) Alteration or destruction is required by an authorized administrative decision or the decision of a court of competent jurisdiction.
(d) The educational institution responsible for a system of student records shall be responsible for assuring that employees with access to the system are made aware of the requirements of this section.