My understanding is that FERPA is similar to HIPAA, except for college scores and enrollment information instead of medical records.
But there’s a rule in FERPA where you explicitly can’t leave a stack of exams and let students pick them, because it exposes students to others’ scores. Another rule is that you can’t associate a students exam with their student ID even if it’s a sequence of numbers, because the id is public information, but you wouldn’t expect someone to remember someone else’s id.
(I specifically remember some professors not following the exam rule, probably because they didn’t know or perhaps it didn’t exist yet. I don’t know if anything happened to them but I suspect if anything, they were simply asked to not do that in the future.)