10M former California students' SSNs/medical records/etc. being disclosed [pdf]

Mods, please change the link to this: http://www.cde.ca.gov/re/di/ws/documents/order2016jan26.pdf

I wasn't able to submit this link unfortunately, so I submitted the form.

Odd. Seems like the concerns could be taken care of by a) not just giving them a straight copy of the database and therefore b) just giving them controlled access via user credentials (i.e., that particular user only gets access to certain sanitized views or certain tables).

Seems like the privacy concerns could be fairly straightforward to address by a competent DBA or two.

IEP students in some cases have documented medical conditions that would be in those records.

Is this not in any way a problem in regards to HIPPA? Are IEP students (current and former) exempt from the protections of law? Am I off base here?

Shouldn't a superior judge or DA be filing an injunction or something of the sort?

Background?