FERPA is not enforceable by private lawsuits. You may have rights in your state for breach of privacy, but your damages and potential recovery are likely to be below the amount that would cover the costs of litigation against a school. I think you have had what remedy there is to be had with your DoE complaint and a new policy. That's a lot.
My responses to questions on Avvo are never intended as legal advice and must not be relied upon as legal advice. I give legal advice only in the course of an attorney-client relationship. Exchange of information through Avvo's Questions forum does not establish an attorney-client relationship with me. That relationship is established only by individual consultation and execution of a written agreement for legal services.