I am a graduate student at a US university. I work for a professor as a TA. Recently, we graded students' tests by scanning them, and marking them electronically. After submitting grades, the professor asked me to email the electronic copies of the tests back to the students. Not being one to do work by hand that a computer can do for me, I wrote up a little program to email the tests for me. It all worked pretty well. I mentioned my program to another professor (not the one I work for), suggesting that he could use my code if he wanted. But he said that he thought emailing tests may be insecure, and might be a FERPA violation. Is he right? I did make sure to use an SSL encryption when sending the tests, but I don't know how secure this really is.
It is not a FERPA violation per se, but it might be a violation of university policy which is put in place to guarantee the privacy of student records. This is analogous to the law corresponding to the IRB requirement -- the US government doesn't say what the rule and procedure must be, just what the purpose is and that there must be rules and procedures. The main consideration is that student records can't be "shared" with unauthorized parties, the the university has an obligation to be sure that only authorized parties receive access to these records. My institution classifies all electronic communication with students as "student records", and requires all student records to be viewed and stored only on official university computers on campus, encrypted, and sent to an official campus email address. Technically, this means that if a student emails me a question, I can't reply until I'm on campus using an authorized university computer, and my response has to be encrypted.