Yes and no, mostly yes. The university stands between the federal government and the professor: the federal government requires things of institutions, which in turn establishes policies that implement those government rules. The statutory link is a restriction on federal funding to violator institutions, via 20 USC 1232g. This is fleshed out in 34 CFR 99, and starting with §99.30, there is extensive regulation of disclosing information. A university will (or should) then articulate privacy policies that say what employees may and may not do. Typically, universities impose ludicrous restrictions in order to cover their back pockets. (Following the letter of the rules, my university requires professors who communicate on academic matters with students, using email, that they do so on campus, using campus computers, sending to and from official university email addresses, and the email is to be encrypted – AFAIK this requirement is never obeyed).