According to FERPA, when can a school disclose records without a student's consent?

Why was the Privacy Protection Act of 1980 drafted?

Smith Memorial Healthcare (SMH) is a hospital network headquartered in New York and operating in 7 other states. SMH uses an electronic medical record to enter and track information about its patients. Recently, SMH suffered a data breach where a third-party hacker was able to gain access to the SMH internal network.
Because it is a HIPPA-covered entity, SMH made a notification to the Office of Civil Rights at the U.S. Department of Health and Human Services about the breach.
Which statement accurately describes SMH's notification responsibilities?

Which of the following best describes what a "private right of action" is?

Within what time period must a commercial message sender remove a recipient's address once they have asked to stop receiving future e-mail?