FERPA controls who may access student education records and under what conditions. For school counseling records, these are education records, so disclosure is generally allowed only with written consent from the student (or parent for minors) or under one of the allowed exceptions. The most common exception is disclosure to school officials who have a legitimate educational interest—people like teachers, administrators, or other counselors who need the information to support the student's education, safety, or welfare. Other permitted purposes include disclosures to a different school the student is transferring to, to comply with a health or safety emergency, or to comply with a legal process, among others. Importantly, records must be kept secure and access should be limited to those with a legitimate need to know. This means the statement in the correct option is true: FERPA protects student records, requires consent for disclosures unless the disclosure meets one of the allowed exceptions (such as to school officials with legitimate educational interest or other permitted purposes), and records must be secured. The other options are inconsistent with FERPA’s protections and exceptions: it does not allow unrestricted sharing with all staff, it applies to all educational institutions receiving federal funds (not just colleges), and it does not mandate destruction of records after a fixed period like one year.