It is the Institution's policy monitored by Registrar. Things are so interconnected now. The consequence is withdrawal of federal funds if we don't comply. Federal agency revises edicts and we revise our policy. This policy does evolve.
SISS contains much more than student data.
The situation seems to be similar to the Duke website ownership. At Cornell, they hired a lawyer to take this responsibility. There is a Patient Confidentiality Committee that is part of the Medical Records Office. It seems that first step is a memo from Betty saying that it has been discussed and that there are concerns. There are many offices at Duke who have learned what requests not to handle.