When I read FERPA, I don't see any clarification as to whether they are talking about written sharing of educational records, or whether they are also talking about verbal disclosures.
For example, here is their definition of disclosure:
Disclosure means to permit access to or the release, transfer, or other communication of personally identifiable information (PII) by any means (34 CFR §99.3). Disclosure can be Authorized, such as when a parent or an eligible student gives written consent to share education records with an authorized party (e.g., a researcher). Disclosure can also be Unauthorized or inadvertent (accidental). An unauthorized disclosure can happen due to a data breach or a loss, and an accidental disclosure can occur when data released in public aggregate reports are unintentionally presented in a manner that allows individual students to be identified.
"By any means" suggests that things that have not been disclosed in writing would also be included, but I'm not sure if I'm interpreting that correctly. For example, what about a student's counseling sessions with the school social worker? Does the parent need to be informed, and provide consent, for a university researcher sitting in on, and participating in, these sessions? What about verbal background information about the student's diagnoses shared by the school social worker with the professor? Is the answer different if the university and the high school have signed a memorandum of understanding? Is the answer different if information obtained through presence in the counseling sessions is used for the professor's research activities? The student is 15.
I'm aware that one can file a FERPA complaint in case of a violation. If there were a serious FERPA violation, is there also in theory some way of filing for legal damages in such a situation? This is New York, where human rights law does not apply to students in public schools.