"Accidents like this happen all the time," said Helen Garrett, a national trainer for the Family Educational Rights and Privacy Act. "As long as the institution acknowledges that it happened, notifies the students affected, and takes steps to prevent it from happening again, they're doing their due diligence."