When Jacob Rooksby speaks at education conferences about student privacy rights, he starts off with a couple questions for the audience.

"I start with, 'True or false: If you make the wrong FERPA call, you can be personally sued'?" said Rooksby, referring to the federal privacy law known as the Family Educational Rights and Privacy Act.

At least half of the people typically think yes, Rooksby said, which is not true. He then asks whether it's true or false that if a school violates FERPA one time, it risks losing all of its federal funds. Again, he says, about half of people tend to answer "true." Again, this is incorrect.

FERPA applies to any school, public or private, that receives federal funding. Essentially, the law restricts schools from releasing anything from a student's "educational records" without that person's permission.

In practice, what often happens is that a school will cite FERPA when explaining to journalists why it can't say anything about a student's misconduct or disciplinary case. If a school does run afoul of FERPA, officials worry the school will lose all its federal funding, meaning it could no longer accept research grants or student loans -- even though this has never happened.

"FERPA is widely misunderstood in higher education," said Rooksby, a law professor at Duquesne University in Pittsburgh. "[Schools] often want to hide behind it -- it's the great boogeyman in higher ed."

In light of increased attention to college sexual assault , athletic scandals and fraternity misbehavior , schools have struggled in recent years to publicly address complaints about how cases are handled without violating FERPA. Author Jon Krakauer is currently battling for records on one case before the Montana Supreme Court, and the University of Virginia struggled to figure out last year what it could say about its handling of rape cases following a controversial and ultimately redacted Rolling Stone article.

Critics say that schools invoke FERPA too much and face little threat of consequence if they break it. The federal government has never financially penalized a college for violating FERPA, and students have no right to sue a school for violating their rights under that law. For a school to actually lose funding over FERPA errors, it would have to show a "pattern or practice" of violations and refuse to correct them even after instruction from the U.S. Department of Education.

"I'm confident from conversations I've had that schools hide behind FERPA when it advances the interest of the institution," Rooksby said. "It may be good lawyering, but I'm not sure it's good policy."

But others say the fact that schools adhere to FERPA -- even though it's never been used to devastate a school's funding -- is proof of the law's effectiveness.

"That it puts the fear of God in all of these schools suggests that it's actually working," said Michael Olivas, director of the University of Houston's Institute for Higher Education Law.

Recently, the Lawrence Journal-World, a Kansas newspaper, attempted to get information about two fraternities at the University of Kansas that had been sanctioned for hazing. At first, the university gave the Journal-World heavily redacted documents, saying the school had to censor a great deal of text so as to comply with FERPA. After an appeal, KU gave slightly less censored documents to the paper, revealing that not every redaction was actually necessary.

In one case, KU redacted a student's response of "No" to a question about whether anyone had ever broken into their bedroom. In another document, students were asked about whether drugs were used in their frat house. KU initially censored a response that turned out to be: "Occasionally. I never know who exactly it is, I just notice the smell." Apparently, there was concern that "I never know who exactly it is" might have constituted a privacy violation.

Often, colleges do have some leeway to release information despite FERPA -- they just choose not to use it. An exception came in October 2014, when Florida State University released of a timeline describing the sexual assault allegations against star quarterback Jameis Winston. FSU disclosed which agencies became aware of the case and when. It also acknowledged that the athletics department heard about the accusations against Winston, helped him find a lawyer and then decided not to tell anyone else at the university for nearly a year because Winston's teammates said the incident in question was consensual.

The Huffington Post recently pointed out the example of FSU to Stanford University, in the course of reporting about how the latter school handled several sexual assault cases . In response, Stanford said there were yet other legal considerations that restrained it from commenting on allegations of the institution's misdeeds.

That's indeed true, according to Steven MacDonald, general counsel for the Rhode Island School of Design. He notes that there have been cases where a student was able to collect hundreds of thousands of dollars simply for violations of common-law privacy rights. In other words, FERPA is sometimes not the only thing that makes a school reluctant to release information.

"FERPA is an important statute, but it's not the universe," MacDonald said.

Colleges are also fearful of running into conflict with accreditation agencies. In order to get federal funds, schools have to have their accreditation in good order.

"It's highly contextual," Olivas said. "It's hard to make national statements, since practices can vary so widely."

As it stands, the only chance a school has to completely go around FERPA is when it gets sued and has to provide a response in court papers. But even that may not necessarily be a full accounting, because a school in that position will be trying to avoid liability -- meaning it will have an incentive to challenge as much as it can.

MacDonald suggested that those who think FERPA needs to be reformed should take their views to Congress.

"The department has a law they have to interpret, the courts have a law they have to uphold," MacDonald said. "It's up to Congress if they want to change it."

______

Tyler Kingkade is a national reporter covering higher education, and is based in New York. You can reach him at tyler.kingkade@huffingtonpost.com , or on Twitter: @tylerkingkade .